Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Adobe Patches for June 2026

For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.

Here’s this month’s overview table:

Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.

Microsoft Patches for June 2026

This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.

One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.

I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.

One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.

-   CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.

-    CVE-2026-45657 - Windows Kernel Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.

-    CVE-2026-47291 - HTTP.sys Remote Code Execution Vulnerability
Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.

-    CVE-2026-44815 - DHCP Client Service Remote Code Execution Vulnerability
Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.

-    CVE-2026-45585/CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability
If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “bone shattering” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.

 Here’s the full list of CVEs released by Microsoft for June 2026:

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.

Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.

There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be.

Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls.

Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.

There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.

I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.

There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

A remote code execution vulnerability exists in the HTTP Protocol Stack for Microsoft Internet Information Services implemented in HTTP.sys. The vulnerability is due to invalid validating incoming HTTP requests.

A remote, unauthenticated attacker can exploit this vulnerability by sending crafted HTTP packets to the target system. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges.

The Vulnerability

HTTP.sys is the kernel-mode HTTP protocol driver in Microsoft Windows. It provides HTTP request parsing, response caching, and SSL/TLS termination for Internet Information Services (IIS) and other applications that register URL prefixes. The driver listens on configured TCP ports (commonly 80 for HTTP and 443 for HTTPS) and processes inbound HTTP/1.x and HTTP/2 requests at the kernel level.

When operating over HTTPS, HTTP.sys delegates TLS processing to the Windows Secure Channel (SChannel) provider. Inbound TCP data is decrypted on a per-record basis: each TLS record constitutes an independent unit of encryption and is decrypted separately by SChannel before being delivered to HTTP.sys as a distinct plaintext buffer. A single TLS 1.3 application data record has the following structure:

The decrypted payload of each TLS record is delivered independently to the HTTP parser via

UlHttpBufferReceiveEvent(), regardless of how many TLS records the underlying TCP connection coalesces into a single TCP segment. This behavior is distinct from plaintext HTTP connections, where the Windows TCP stack coalesces multiple segments into a single receive indication before the data reaches HTTP.sys.

The HTTP parser maintains a per-request state object that includes a dynamically grown buffer reference array. The capacity field stores the current number of allocated slots in the buffer reference array. The count field stores the number of slots currently in use. The ref_array_ptr field points to the dynamically allocated array of 8-byte buffer reference entries.

An integer overflow vulnerability exists in HTTP.sys. The vulnerability is due to insufficient bounds checking when growing a buffer reference array during HTTP/1.x header parsing. When HTTP.sys receives data for an HTTP/1.x request, it allocates a UL_REQUEST_BUFFER structure for each receive indication and tracks these buffers in the per-request reference array described above. The count field records the number of active buffer references, and the capacity field records the total number of allocated slots.

As the HTTP parser (UlpParseNextRequest()) processes header lines, it calls an inline buffer reference routine each time a new receive buffer is consumed. When count reaches capacity, the routine grows the array by reallocating it with five additional slots. The new allocation size is computed as 0x28 + capacity * 8, the contents of the existing array are copied via memmove using count * 8 as the copy length, and capacity is incremented by 5 as a 16-bit unsigned integer addition. No overflow check is performed on this addition.

After 13,107 growth events, capacity reaches 0xFFFB. The next growth adds 5, producing 0x10000, which truncates to 0x0000 in the 16-bit field. On the subsequent buffer reference addition, count (which is now 65,536 or greater) exceeds the zero capacity, triggering another growth. The allocation size computation 0x28 + 0 * 8 produces a 40-byte allocation, but the memmove copies count * 8 bytes (approximately 524,256 bytes) from the old buffer into the 40-byte allocation. This results in a kernel pool heap buffer overflow of over 500 kilobytes.

Each buffer reference corresponds to one receive buffer delivered to the HTTP parser. For plaintext HTTP connections, the Windows TCP stack coalesces received segments into large indications, and UlpMergeBuffers() further combines buffers within HTTP.sys. Over TLS connections, each TLS record is decrypted independently by SChannel and delivered as a separate buffer through UlHttpBufferReceiveEvent() into UlpCopyIndicatedData(). If each TLS record contains exactly one complete header line (terminated by CRLF), the HTTP parser fully consumes the buffer without setting the partial-parse flag, causing UlpAdjustBuffers() to advance to the next buffer via its non-merge path. This creates a 1:1 correspondence between TLS records sent and buffer references accumulated.

To trigger the overflow, an attacker crafts an HTTP request in which each header line is encapsulated in a separate TLS application data record. Given a minimum header line size of approximately 4 bytes and a required count of 65,536 buffer references, the total request size comes to roughly 262,144 bytes. The MaxRequestBytes registry value (at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters) must be configured to a value of at least 262,144 bytes for the server to accept a request of this size. The default value of 16,384 bytes limits the request to approximately 4000 header lines, which is insufficient to trigger the overflow. As a mitigation, keeping MaxRequestBytes at or below 65,535 bytes represents the most conservative configuration to prevent this attack.

A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted HTTP/1.x request over a TLS connection to an affected server. Successful exploitation results in unexpected system termination due to a memory access exception in the context of the kernel. Under specific memory layout conditions, exploitation could result in arbitrary code execution in the context of the kernel.

Notes:

• The vulnerability is only reachable through HTTP/1.x header parsing over TLS connections. HTTP/2 and HTTP/3 use different parser paths that do not interact with the buffer reference array.

• Body data parsing (Content-Length or chunked transfer encoding) does not add entries to the buffer reference array. Only header parsing triggers buffer reference growth.

• At a sending rate of 10 milliseconds per TLS record, the overflow requires approximately 11 minutes to trigger.

Source Code Walkthrough

The following code snippet was taken from HTTP.sys version 10.0.26100.7705. Comments added by TrendAI Research have been highlighted.

In UlpParseNextRequest():

Detection Guidance

To detect an attack exploiting this vulnerability, the detection device must monitor and parse traffic on the TCP port 443.

The traffic on the affected port(s) is TLS-encrypted. The detection device must be able to decrypt the TLS traffic before applying the following detection method. The detection device should monitor for HTTPS connections.

An HTTP/1.x request [1] consists of a request line followed by zero or more header field lines, each terminated by CRLF. The following grammar defines the relevant structure:

Decrypted traffic inspection:

After decrypting the TLS session, the detection device must parse the HTTP/1.x request headers. The detection device must count the number of distinct header field lines present in a single HTTP request. If the number of header field lines in a single request exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Encrypted traffic heuristics:

Where decryption is not available, the detection device should inspect the pattern of TLS application data records within the encrypted session. If each TLS application data record contains a single short payload and the total number of such records on a single connection exceeds 1,000, the traffic should be considered suspicious; an attack exploiting this vulnerability is likely underway.

Notes:

• The preferred detection method (header line count) requires the ability to decrypt TLS traffic, for example through TLS inspection, a decrypting proxy, or possession of the server's private key. This method directly observes the attack indicator and produces low false-positive and false-negative rates.

• The TLS record heuristic operates on encrypted traffic and does not require decryption. This method is more prone to false positives (legitimate applications that send many small TLS records, such as interactive streaming sessions, may trigger the heuristic) and to false negatives (the threshold is based on observable record sizes rather than the actual header count that determines exploitability). Where possible, decrypted traffic inspection should be preferred.

• The attack requires approximately 11 minutes of sustained connection to accumulate sufficient header lines. Connection duration monitoring may serve as a supplementary detection heuristic.

Conclusion

This vulnerability was patched by Microsoft in the June 2026 release cycle. They note several mitigations that include editing the registry to ensure unpatched systems are not vulnerable to exploitation. However, the best method to ensure this bug has been fully remediated is to test and deploy the vendor-supplied patch.

Special thanks to Yazhi Wang and Jonathan Lein of the TrendAI Research team for providing such a thorough analysis of this vulnerability. For an overview of TrendAI Research services, please visit https://go.trendmicro.com/tis/vulnerabilities.html.

The threat research team will be back with other great vulnerability analysis reports in the future. Until then, follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

Pwn2Own Ireland returns for 2026, and it’s the third year for this event in the Emerald Isle. Despite the dreary Irish skies (and the threat of a random banshee), we had an amazing event, even if we did end up in a jail at the end. With that in mind, we’re excited to return to Cork this fall for yet another great Pwn2Own event. We’ll also be returning to some of the great pubs Ireland has to offer in the evenings and wrapping the event up at a special location (stay tuned for that announcement).

As for the contest itself, it will run from October 6-9, 2026. As always, we’ll have a random drawing to determine the schedule of attempts on the first day of the contest, and we will proceed from there. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2026. There are no exceptions for late entries, so if you have questions, please contact us at pwn2own@trendmicro.com (note the address). We will be happy to address your issues or concerns directly.

Due to the overwhelming amount of registrations and last-minute entries for our Pwn2Own Berlin event, we’re changing who can enter the contest a bit to ensure it’s fair for all researchers. To enter, you must have received an aggregate bounty payment totaling at least $15,000 during their life-time participation in ZDI. This includes past Pwn2Own events and our regular bug bounty program. We recognize there may be some who haven’t participated in the past with great exploits to demonstrate, so we will also accept up to 10 new contestants at our discretion. We’re capping the number of entries to 80 this year. Once we have 80 qualifying entries, we will close registration. That means if you want to enter, it is in your best interest to contact us sooner rather than later. Please read the rules thoroughly to ensure you meet all the requirements.

Now on to this year’s target categories. We’ll have seven different categories for this year’s event:

-- Mobile Phones
-- Smart Home Devices
-- Wellness
-- Printers
-- Messaging
-- AI Infrastructure
-- AI Coding Agents

Let’s take a look at each category in more detail, starting with mobile phones.

The Target Phones

Back in Amsterdam where this contest originated, it was originally dubbed “Mobile Pwn2Own” and our focus was strictly on phones. Mobile handsets remain at the heart of this event, and some of the Samsung entries from last year were absolutely smashing. As always, these phones will be running the latest version of their respective operating systems with all available updates installed. Last year we also introduced the USB attack vector, but no one submitted an entry for it. We’ll see if that changes this year.

Otherwise, contestants must compromise the device by browsing to content in the default browser for the target under test or by communicating with the following short-distance protocols: near field communication (NFC), Wi-Fi, or Bluetooth. The awards for this category are:

Back to top

Smart Home Devices

As you might have noticed, we have eliminated most of the consumer-related devices from this year’s event. However, there are still a few “pro-sumer” devices that still could have an impact on enterprises, and the first of these categories are the devices that control other devices and services. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Wellness Category

This is one of the new categories this year and our first foray into the world of healthcare devices. However, we don’t intend to make this too easy. Entries that require physically pressing any button on the target, or the use of any information, code or PIN printed on the device, are out of scope. Entries that require the contestant to be paired to the target prior to the start of the attempt are not in scope. An attempt in this category must be launched against the target’s exposed network services, RF attack surface, or exposed features from the contestant’s laptop within the contest network.

Back to top

Rage Against the Printers

Printers have long been the source of jokes and memes, but they are also an often overlooked attack surface in your office. The printer category always produces some interesting results, often by playing music it shouldn’t or the occasional Rick Roll. We’ve reduced the number of targets in this category this year, but we still expect to see some interesting exploits in these oft unheralded targets.

Back to top

The Messaging Category

We introduced WhatsApp as a target last year and came close to seeing a functioning exploit. Sadly, that didn’t happen. However, WhatsApp is used by more than three billion people globally, and some of the messages transmitted can be quite sensitive. That’s why we are bringing it back and hoping for some better results. We know the bugs are out there. We’re just hoping the right researcher decides to show us an exploit that leads to code execution. All of the target handset will be available as clients. Here’s the full prize list for Messaging category:

Back to top

AI Infrastructure Category

We introduced these targets at Pwn2Own Berlin, and we saw such…uh…enthusiasm from the community that we decided to immediately bring them back for our Ireland event. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Infrastructure category:

Back to top

AI Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a recently updated category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

Master of Pwn

No Pwn2Own contest would be complete without crowning a Master of Pwn, which signifies the overall winner of the competition. Earning the title results in a slick trophy, a different sort of wearable, and brings with it an additional 65,000 ZDI reward points (instant Platinum status in 2027).

For those not familiar with how it works, points are accumulated for each successful attempt. While only the first demonstration in a category wins the full cash award, each successful entry claims the full number of Master of Pwn points. Since the order of attempts is determined by a random draw, those who receive later slots can still claim the Master of Pwn title – even if they earn a lower cash payout. As with previous contests, there are penalties for withdrawing from an attempt once you register for it. If the contestant decides to remove an Add-on Bonus during their attempt, the Master of Pwn points for that Add-on Bonus will be deducted from the final point total for that attempt. For example, someone registers for the Apple iPhone 15 with the Kernel Bonus Add-on. During the attempt, the contestant drops the Kernel Bonus Add-on but completes the attempt. The final point total will be 20 Master of Pwn points.

The Complete Details

The full set of rules for Pwn2Own Ireland 2026 can be found here. They may be changed at any time without notice. We highly encourage potential entrants to read the rules thoroughly and completely should they choose to participate. We also encourage contestants to read this blog covering what to expect when participating in Pwn2Own.

Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. (Email only, please; queries via social media, blog post, or other means will not be acknowledged or answered.) If we receive more than one registration for any category, we’ll hold a random drawing to determine the contest order. Registration closes at 5:00 p.m. Irish Standard Time on Oct 1st, 2025.

The Results

We’ll be blogging and tweeting results in real-time throughout the competition. Be sure to keep an eye on the blog for the latest information. Follow us on Twitter at @thezdi and @trendaisecurity, and keep an eye on the #P2OIreland hashtag for continuing coverage.

We look forward to seeing everyone in Cork, and we look forward to seeing what new exploits and attack techniques they bring with them.

©2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

The post Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post GDC 2026: Announcing new tools and platform updates for Windows PC game developers appeared first on Windows Developer Blog.

Dieser Beitrag ThreatsDay: Wie scheinbar harmlose Updates und KI-Input-Agenten missbraucht werden erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Read more of this story at Slashdot.

Maximize app performance and ROI with the R8 Configuration Analyzer

A premium experience is only as good as its foundation, and a performant foundation is what allows your app to scale across the Android ecosystem. This is especially true with the release of Android 17, which introduces conservative, device RAM-based app memory limits to target extreme memory leaks and outliers before they cause system-wide instability. To stay below these new system thresholds and prevent your app from being terminated, having a lean footprint is no longer optional: it’s a critical requirement.

This year, we’re making it easier to build highly optimized, fast apps by introducing the R8 Configuration Analyzer in Android Studio. R8 is your most powerful tool for improving app performance, but its effectiveness is often limited by overly broad "keep rules" that prevent the compiler from stripping away unused code. The new Configuration Analyzer provides optimization, obfuscation, and shrinking scores, allowing you to identify specific rules that are preventing the benefits of R8 optimization.

By optimizing their R8 configurations, developers at Monzo achieved a 30% improvement in cold starts and a 35% reduction in ANRs. Smaller, faster code isn't just about efficiency; it's about ensuring your app has the memory headroom to deliver delight on every form factor, from the phone to the car.

Extend your reach with a unified approach to Widgets on Phones, Watches and Cars

User interaction is shifting toward quick, glanceable moments—short bursts of information that keep users connected without needing to open the full app. To help you increase the reach of your app content, we are unifying the development experience across the Android ecosystem with Jetpack Glance. By using a consistent, Compose-based model, you can elevate the content most important to your users straight to the phone’s home screen, Wear Widgets (previously Tiles!), and cars with a familiar workflow.

In order to help users engage with your content and features, even outside your app, we are making widgets more expressive and adaptive with RemoteCompose. On Wear OS, RemoteCompose allows you to use the Compose tools you’re already comfortable with to define UI logic that renders natively on remote surfaces, ensuring that your glanceable experiences remain highly performant and responsive even on resource-constrained hardware. On mobile and cars, RemoteCompose is used as a new framework giving Widgets new expressive capabilities.

You can use Jetpack Glance (together with RemoteCompose on Wear) to deliver a cohesive user journey. Whether it’s viewing flight status on the car dashboard, checking a gate change on a watch, or managing a boarding pass from a phone widget, this shared approach maximizes your app’s presence while keeping your development effort focused and efficient.

For more details, check out the premium Android experience YouTube playlist.

While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.

To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.

Optimize image loading

Detect and fix memory leaks with Android Studio

Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).

Android Studio Panda 3 features a dedicated LeakCanary profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.

The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.

Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.

Trim memory when app leaves visible state

Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in Overview of memory management. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.

If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the ComponentCallbacks2 interface. You can implement onTrimMemory in your Activity, Fragment, Service, or even your custom Application class. Using it in the Application class is highly effective for global cache management.

The provided onTrimMemory() callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.

In terms of memory lifecycle management, your implementation should focus exclusively on TRIM_MEMORY_UI_HIDDEN and TRIM_MEMORY_BACKGROUND. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.

TRIM_MEMORY_UI_HIDDEN: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.

TRIM_MEMORY_BACKGROUND: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.

import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level >= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level >= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}

Note: The onTrimMemory integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the game memory optimization documents.

Advanced memory observability with ProfilingManager

To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the ProfilingManager API. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.

For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to provide feedback.

Android 17 introduces new event-driven triggers, most notably TRIGGER_TYPE_OOM and TRIGGER_TYPE_ANOMALY:

• The OOM trigger automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the registerForAllProfilingResults callback.
• The Anomaly trigger detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.

  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer { profilingResult ->
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)

Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the Perfetto UI. To streamline your memory debugging workflow, use the Heap Dump Explorer, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.

Conclusion

Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised memory guidance.

Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.

Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the Android Open Source Project (AOSP). This allows you to examine the source code for a deeper understanding of how Android works.

Let's dive deeper into Android 17.

An intelligence system

With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the Model Context Protocol. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.

The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.

/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}

We’ve also launched an AppFunctions agent skill that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.

The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a test agent app that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at goo.gle/eap-af for a chance to be among the first apps to deploy AppFunctions to production.

Adaptive-first

Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over 580 million large screen devices in the hands of users and the forthcoming launch of Googlebooks, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an adaptive-first development standard.

No resizability/orientation restrictions on large screens

To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on large screen devices (sw > 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on app category in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.

Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP

Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:

• App Bubbles: Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.
• The Bubble Bar: On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.
• Desktop interactive PiP: In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.

App Bubbles and Bubble Bar in action

Activity recreation updates

To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including CONFIG_KEYBOARD, CONFIG_KEYBOARD_HIDDEN, CONFIG_NAVIGATION, CONFIG_TOUCHSCREEN, and CONFIG_COLOR_MODE).
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new android:recreateOnConfigChanges manifest attribute.

Continue On

Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.

Handoff Suggestion on a Tablet

class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}

Go adaptive-first with Jetpack Compose

To help you adapt your apps to meet the new Android 17 requirements, we've launched the Jetpack Compose adaptive skill. This AI-powered developer workflow helps you implement the best adaptive practices:

• Adaptive navigation: Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.
• Multi-pane layouts: Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.
• FlexBox & Grid APIs: Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.
• Advanced non-touch input: Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.
• Dynamic window states: Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.

Android is Compose-first

Compose offers the easiest way to build adaptive apps, and that's just one of the many reasons we believe that all Android UI should be built with Compose. To that end, Android development is now Compose-first. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.

TIP
Ready to migrate? Use our AI-driven XML to Compose Migration Skill to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.

Performance & efficiency

App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.

App memory limits

Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking. 

Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:

• R8 Optimizer: The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new R8 configuration analyzer to make sure your app is getting the most from R8.
  

• LeakCanary in Android Studio Panda: The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.
• ApplicationExitInfo: If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".
• On-Device Anomaly Detection: Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.

val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList<ProfilingTrigger>().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)

And, we're working to surface more in-field memory metrics to you within Google Play Console.

Generational garbage collection

Android 17 introduces more frequent, less resource-intensive young-generation collections to ART's Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.

Lock-Free MessageQueue

For apps targeting SDK 37 or higher, the core android.os.MessageQueue now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private MessageQueue fields and methods.  The peekWhen and poll APIs have been added to TestLooperManager for instrumentation testing without relying on MessageQueue internals.

Static final fields now truly final

Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s SetStatic<Type>Field methods family will immediately crash the application.

Custom notification view restrictions

To reduce memory usage we are further restricting the size of custom notification views. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.

Privacy & Security

Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.

Privacy-preserving choices

Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:

• System-Level Contact Picker: Utilizing ACTION_PICK_CONTACTS, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad READ_CONTACTS permission. It also fully supports work/personal profile separation.
• Customizable Photo Picker aspect ratio: UsingPhotoPickerUiCustomizationParams, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.
• System-rendered Location Button: A new system-rendered location button that you can embed in your app grants precise location access for the current session only.
• EyeDropper API: A new system-level API, ACTION_OPEN_EYE_DROPPER, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.

val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}

Picking a color from anywhere on the screen with the system EyeDropper

Local network access

Apps targeting Android 17 now either require the ACCESS_LOCAL_NETWORK runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because ACCESS_LOCAL_NETWORK falls under the existing NEARBY_DEVICES permission group, users who have already granted other NEARBY_DEVICES permissions will not be prompted again.

SMS OTP protection

Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:

• WebOTP Format: Delayed for all apps that are not the intended recipient (domain mismatch).
• Standard SMS OTP: Delayed for all apps targeting SDK 37+.
• Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the SMS Retriever or SMS User Consent APIs.

Post-Quantum Cryptography (PQC)

Android 17 is ready for the next generation of cryptographic security:

• Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.
• Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.

Safer native dynamic code loading 

Smarter password protection for physical inputs

With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.

Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).

These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields.

Media and camera features that empower creators and delight users

Android 17 introduces new creator features that give access to pro-quality cameras and media, all while improving the experience for consumers.

• Eclipsa Video: HDR video standard built upon the SMPTE ST 2094-50 specification that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.
• RAW14 image format: New support for the RAW14 image format provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.
• Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.
• Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.
• Versatile Video Coding (H.266): Enables OEMs to add codec support by defining the video/vvc MIME type in MediaFormat, adding new VVC profiles in MediaCodecInfo, and integrating support into MediaExtractor.
• Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.
• Constant Quality for Video Recording: SetVideoEncodingQuality in MediaRecorder configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.

Better support for hearing aids

• Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new AudioDeviceInfo.TYPE_BLE_HEARING_AID constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.
• Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.

CameraX and Media3

CameraX and Media3 have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture, smooth media playback, and creative and complex editing experiences.

We've released an agent skill that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.

Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.

Get your apps, libraries, tools, and game engines ready!

If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.

Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps running on and targeting Android 17 to focus your testing, including the following:

• Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints on large screens.
• Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.
• Enable CT by default: Certificate transparency (CT) is enabled by default. (On Android 16, CT is available but apps had to opt in.)
• Local network protections: Apps targeting SDK 37 or higher have local network access blocked by default. Switch to using privacy preserving pickers if possible, and use the new ACCESS_LOCAL_NETWORKpermission for broad, persistent access.
• Background audio hardening: Starting in Android 17, the audio framework enforces restrictions on background audio interactions including audio playback, audio focus requests, and volume change APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the updated guidance.
• NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare FEATURE_NEURAL_PROCESSING_UNIT in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the LiteRT NPU delegate, vendor-specific SDKs, as well as the deprecated NNAPI.

Get started with Android 17

Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can use the 64-bit system images with the Android Emulator in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.

Getting the Android 17 beta on partner devices

Android 17 is available in beta on handset, tablet, and foldable form factors from partners including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.

For the best development experience with Android 17, we recommend that you use the latest Canary build of Android Studio Quail. Once you’re set up, here are some of the things you should do:

Test your current app for compatibility, learn whether your app is affected by changes in Android 17, and install your app onto a device or Android Emulator running Android 17 and extensively test it.

Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.

For complete information on Android 17 please visit the Android 17 developer site.

Posted by Amman Asfaw, Product Manager, Android Studio

Android Studio Quail 2 is now stable and ready for you to use in production, bringing a shift to your IDE with concurrent agentic workflows, natively integrated memory leak profiling, and context-aware crash remediation. Whether you are performing a sweeping architectural overhaul, tracing a memory leak, or resolving a critical production crash, Android Studio keeps you anchored in your workspace by reducing manual friction.

Here’s a deep dive into what’s new:

Multi-tasking with parallel chats

In Android Studio Quail 2, we've been hard at work redesigning Agent Mode from the ground up. This new architecture provides better performance, offers more flexibility for decomposing complex tasks, and improves the suite of internal tools the agent uses to do its work.

• How to use: Click the "+" icon to start a new parallel conversation, and use the History icon to navigate between active tasks. Alternatively, select File > New > New Agent Tab to open a conversation in a dedicated tab.
• Note: Worktree support is currently unavailable. Exercise caution when running concurrent chats that modify the same project files, which can potentially lead to editor conflicts.

Run multiple agent tasks in parallel with different models of your choice.

Memory leak detection with LeakCanary

Memory leaks in Android occur when your code holds onto an object's reference long after its life cycle has ended. This prevents the Garbage Collector from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError.

Hunting down memory leaks can be a tedious, manual task. Starting with Android Studio Quail 2, the popular open-source leak detector LeakCanary is natively integrated directly into the Profiler as a dedicated, first-class task.

This integration transforms your debugging performance by lifting and shifting the heap analysis off your resource-constrained testing phone, and onto your powerful development computer. By running the analysis on your computer, leak tracing is up to five times faster and jank-free, leaving your test app running smoothly on the device.

Once a leak is detected during a profiling session:

• The Profiler renders an interactive, color-coded leak trace, grouping occurrences and estimating lost memory.
• You can click Go to declaration on any leaking object in the trace to instantly jump to that exact line of code in your editor.
• You can click Fix with Agent to have the Gemini agent ingest the trace, explain the root cause of the retained reference, and write the exact code change (such as unbinding a listener or clearing a static reference) to plug the leak.

Review memory leaks identified via LeakCanary through the Fix with Agent button.

App Quality Insights agent integration

Tracking down the root cause of an app crash can require manually synthesizing stack traces, device data, and source code. However Android Studio’s App Quality Insights (AQI) is now fully integrated with Agent Mode to do the heavy lifting for you.

When you click on a crash in the AQI panel, you immediately get a concise, high-level summary of the issue. If you need to dig deeper, simply click See more. This opens a dedicated chat where the agent uses your selected model and pulls in local source code and the full stack trace to deliver a comprehensive explanation of the failure.

With the new agent integration, you move directly from issue identification to resolution. By clicking Fix with AI, the agent will analyze the issue, propose a step-by-step fix plan, and—upon your approval—apply the necessary code changes directly to your project and verify the resulting fix

The Fix with AI button triggering the agent to analyze the issue, then propose the fix

Quality & stability improvements

Beyond new features, we’ve continued our focus on quality by addressing numerous bugs and incorporating the latest stability and performance improvements from the IntelliJ platform, making this a significant enhancement for your daily development.

Get Started

Ready to dive in and accelerate your development? Download Android Studio Quail 2 and start exploring these new features today! As always, your feedback is crucial to us. Check known issues, report bugs, and be part of our vibrant community on LinkedIn, Medium, YouTube, or X. 

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Thunderbird's localizers make it possible for users around the world our desktop and mobile clients in their own language. This month, Heather and Monica are chatting with Bogomil Shopov, one of our Bulgarian localizers who has been with Thunderbird from the start. Find out how he got started in open source, how he's mentoring the next generation of contributors, and his advice on getting involved with Thunderbird (and what music he uses to focus!)

Note: This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eastwood, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.

FBI, CISA, National Security Agency (NSA), and the following partners—hereafter referred to as “the authoring organizations”—are releasing this joint advisory on the targeting of critical infrastructure by pro-Russia hacktivists:

• U.S. Department of Energy (DOE)
• U.S. Environmental Protection Agency (EPA)
• U.S. Department of Defense Cyber Crime Center (DC3)
• Europol European Cybercrime Centre (EC3)
• EUROJUST – European Union Agency for Criminal Justice Cooperation
• Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
• Canadian Centre for Cyber Security (Cyber Centre)
• Canadian Security Intelligence Service (CSIS)
• Czech Republic Military Intelligence (VZ)
• Czech Republic National Cyber and Information Security Agency (NÚKIB)
• Czech Republic National Centre Against Terrorism, Extremism, and Cyber Crime (NCTEKK)
• French National Cybercrime Unit – Gendarmerie Nationale (UNC)
• French National Jurisdiction for the Fight Against Organized Crime (JUNALCO)
• German Federal Office for Information Security (BSI)
• Italian State Police (PS)
• Latvian State Police (VP)
• Lithuanian Criminal Police Bureau (LKPB)
• New Zealand National Cyber Security Centre (NCSC-NZ)
• Romanian National Police (PR)
• Spanish Civil Guard (GC)
• Spanish National Police (CNP)
• Swedish Polisen (SC3)
• United Kingdom National Cyber Security Centre (NCSC-UK)

The authoring organizations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include Water and Wastewater Systems, Food and Agriculture, and Energy.

The authoring organizations encourage critical infrastructure organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s Russia Threat Overview and Advisories webpage.

Download the PDF version of this report:

Background and Development of Pro-Russia Hacktivist Groups

Over the past several years, the authoring organizations have observed pro-Russia hacktivist groups conducting cyber operations against numerous organizations and critical infrastructure sectors worldwide. The escalation of the Russia-Ukraine conflict in 2022 significantly increased the number of these pro-Russia groups. Consisting of individuals who support Russia’s agenda but lack direct governmental ties, most of these groups target Ukrainian and allied infrastructure. However, among the increasing number of groups, some appear to have associations with the Russian state through direct or indirect support.

Cyber Army of Russia Reborn

The authoring organizations assess that the Russian General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455—tracked in the cybersecurity community under several names (see Appendix B: Additional Designators Used for Cited Groups)—is likely responsible for supporting the creation of CARR —also known as “The People’s Cyber Army of Russia”—in late February or early March of 2022. Actors suspected to be from GRU unit 74455 likely funded the tools CARR threat actors used to conduct distributed denial-of-service (DDoS) attacks through at least September 2024.

In April 2022, the group began using a new Telegram channel featuring the name “CyberArmyofRussia_Reborn” to organize and plan group actions. The channel creators recruited actors to use CARR as an unattributable platform for conducting cyber activities beneath the level of an APT, aimed at deterring anti-Russia rhetoric. CARR threat actors presented themselves as a group of pro-Russia hacktivists supporting Russia’s stance on the Ukrainian conflict, and they soon began claiming responsibility for DDoS attacks against the U.S. and Europe for supporting Ukraine.

CARR documented these actions through embellished images and videos shared on their social media channels, promoting Russian ideology, disseminating talking points, and publicizing leaked information from hacks attributed to Russian state threat actors.

In late 2023, CARR expanded their operations to include attacks on industrial control systems (ICS), claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted human-machine interface (HMI) devices, claiming intrusions at two U.S. dairy farms.

The authoring organizations assess that by late September 2024, CARR channel administrators became dissatisfied with the level of support and funding provided by the GRU. This dissatisfaction led CARR administrators and an administrator from another hacktivist group, NoName057(16), to create the Z-Pentest group, employing the same tactics, techniques, and procedures (TTPs) as CARR but separate from GRU involvement.

NoName057(16)

The authoring organizations assess that the Center for the Study and Network Monitoring of the Youth Environment (CISM), established on behalf of the Kremlin, created NoName057(16) as a covert project within the organization. Senior executives and employees within CISM developed and customized the NoName057(16) proprietary DDoS tool DDoSia, paid for the group’s network infrastructure, served as administrators on NoName057(16) Telegram channels, and selected DDoS targets.

Active since March 2022, NoName057(16) has conducted frequent DDoS attacks against government and private sector entities in North Atlantic Treaty Organization (NATO) member states and other European countries perceived as hostile to Russian geopolitical interests. The group operates primarily through Telegram channels and used GitHub, alongside various websites and repositories, to host DDoSia and share materials and TTPs with their followers. 

In 2024, NoName057(16) began collaborating closely with other pro-Russia hacktivist groups, operating a joint chat with CARR by mid-2024. In July 2024, NoName057(16) jointly claimed responsibility with CARR for an alleged intrusion against OT assets in the U.S. The high degree of cooperation with CARR likely contributed to the formation of Z-Pentest, which is composed of actors and administrators from both teams, in September 2024.

Z-Pentest

Established in September 2024, Z-Pentest is composed of members from CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure entities. Additionally, the group uses “hack and leak” operations and defacement attacks to draw attention to their pro-Russia messaging. Unlike other pro-Russia hacktivist groups, Z-Pentest largely avoids DDoS activities, claiming OT intrusions as attempts to garner more attention from the media.

Shortly after Z-Pentest’s inception, the group announced alliances with CARR and NoName057(16), possibly to leverage the other groups’ subscribers to grow the new channel. In March 2025, Z-Pentest posted evidence claiming OT device intrusions to their channel using a NoName057(16) cyberattack campaign hashtag. Similarly, in April 2025, Z-Pentest shared a video purporting defacement of an HMI by changing system names to NoName057(16) and CARR references. Z-Pentest continues to create new alliances with other groups, like Sector16, to continue growing their subscriber base and incidentally propagate TTPs with new partners.

Sector16

Formed in January 2025, Sector16 is a novice pro-Russia hacktivist group that emerged through collaboration with Z-Pentest. Sector16 actively maintains an online presence, including a public Telegram channel where they share videos, statements, and claims of compromising U.S. energy infrastructure. These communications often align with pro-Russia narratives and reflect their self-proclaimed support for Russian geopolitical objectives.

Members of Sector16 may have received indirect support from the Russian government in exchange for conducting specific cyber operations that further Russian strategic goals. This aligns with broader Russian cyber strategies that involve leveraging non-state threat actors for certain cyber activities, adding a layer of deniability.

Technical Details

Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 18. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

TTP Overview

Pro-Russia hacktivist groups employ easily disseminated and replicated TTPs across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions. These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure.

Pro-Russia hacktivist groups use the TTPs in this Cybersecurity Advisory to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions. While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention. They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems.

Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities. Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems. Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services. Consequently, these groups can indiscriminately compromise critical infrastructure entities, including those in the Water and Wastewater, Food and Agriculture, and Energy Sectors.

Pro-Russia hacktivist groups have successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions. As recently as April 2025, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:

• Scan for vulnerable devices on the internet [T0883] with open VNC ports [T1595.002].
• Initiate temporary virtual private server (VPS) [T1583.003] to execute password brute force software.
• Use VNC software to access hosts [T1021.005].
• Confirm connection to the vulnerable device [T0886].
• Brute force the password, if required [T1110.003].
• Gain access to HMI devices [T0883], typically with default [T0812], weak, or no passwords [T0859].
• Log the confirmed vulnerable device IP address, port, and password.
• Using the HMI graphical interface [T0823], capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs [T0828]:
  • Modify usernames/passwords [T0892];
  • Modify parameters [T0836];
  • Modify device name [T0892];
  • Modify instrument settings [T0831];
  • Disable alarms [T0878];
  • Create loss of view (a technique that mandates local hands-on operator intervention) [T0829]; and/or
  • Device restart or shutdown [T0816].
• Disconnect from the device, ending the VNC connection.
• Research the compromised device company after the intrusion [T1591].

Propagation

To reach a wider audience, pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs. For example, Z-Pentest jointly claimed intrusion of a U.S. system with Sector16. Sector16 later began posting additional intrusions for which the group claimed sole responsibility. It is likely that these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.

Reconnaissance and Initial Access

The threat actors’ intrusion methodology is relatively unsophisticated, inexpensive to execute, and easy to replicate. These pro-Russia hacktivist groups abuse popular internet-scraping tools, such as Nmap or OPENVAS, to search for visible VNC services and use brute force password spraying tools to access devices via known default or otherwise weak credentials. Threat actors typically search for these services on the default port 5900 or other nearby ports (5901-5910). Their goal is to gain remote access to HMI devices connected to live control networks.

Once threat actors obtain access, they manipulate available settings from the graphical user interface (GUI) on the HMI devices, such as arbitrary physical parameter and setpoint changes, or conduct defacement activities. Because pro-Russia hacktivist groups seem to lack sector-specific expertise or cyber-physical engineering knowledge, they currently cannot reliably estimate the true impact of their actions. Regardless of outcome, pro-Russia hacktivist groups often post images and screen recordings to their social media platforms, boasting the compromises and exaggerating impacts to garner attention from their peers and the media.

Impact

While pro-Russia hacktivist groups currently demonstrate limited ability to consistently cause significant impact, there is a risk that their continued attacks will result in further harm or grievous physical consequences. Attacks have not yet caused injury; however, the attacks against occupied factories and community facilities demonstrate a lack of consideration for human safety.

Victim organizations reported that the most common operational impact caused by these threat actors is a temporary loss of view, necessitating manual intervention to manage processes. However, any modifications to programmatic and systematic procedures can result in damage or disruption, including substantial labor costs from hiring a programmable logic controller programmer to restore operations, costs associated with operational downtime, and potential costs for network remediation.

MITRE ATT&CK Tactics and Techniques

See Table 1 to Table 10 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Incident Response

If organizations find exposed systems with weak or default passwords, they should assume threat actors compromised the system and begin the following incident response protocols:

1. Determine which hosts were compromised and isolate them by quarantining or taking them offline.
2. Initiate threat hunting activities to scope the intrusion. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.
3. Reimage compromised hosts.
4. Provision new account credentials.
5. Report the compromise to CISA, FBI, and/or NSA. See the Contact Information section of this advisory.
6. Harden the network to prevent additional malicious activity. See the Mitigations section of this advisory for guidance.

Mitigations

OT Asset Owners and Operators

The authoring organizations recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

• Reduce exposure of OT assets to the public-facing internet. When connected to the internet, OT devices are easy targets for malicious cyber threat actors. Many devices can be found by searching for open ports on public IP ranges with search engine tools to target victims with OT components [CPG 3.S].
  • Asset owners should use attack surface management services and web-based search platforms to scan the internet. This mitigation can help identify if there are VNC systems exposed within the IP ranges they own, especially for connections set up by third parties.
    Note: For more information on attack surface management, see CISA’s Internet Exposure Reduction Guidance, CISA’s Cyber Hygiene Services for U.S. critical infrastructure, and NSA’s Attack Surface Management for the U.S. Defense Industrial Base.
  • Implement network segmentation between IT and OT networks. Segmenting critical systems and introducing a demilitarized zone (DMZ) for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations [CPG 3.I].
  • Consider implementing a firewall and/or virtual private network if exposure to the internet is necessary for controlling access to devices.
    • Consider disabling public exposure by default and implementing time-limited remote access to reduce the amount of time systems are exposed.
    • Restrict and monitor both inbound and outbound traffic at OT perimeter firewalls. Configure OT perimeter firewalls to enforce a default-deny policy for all traffic. Asset owners should explicitly permit authorized destinations and protocols based on operational requirements.
    • Implement strict egress filtering to prevent unauthorized data exfiltration or command-and-control callbacks.
    • Regularly audit firewall rulesets and monitor outbound traffic patterns for anomalies indicative of threat actor activity, such as beaconing or unexpected protocol usage.
• Adopt mature asset management processes, including mapping data flows and access points. Generating a complete picture of both OT and IT assets provides visibility to operators and management, allowing organizations to monitor and assess deviations for criticality [CPG 2.A].
  • Keep remote access services updated with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.
    • Keep VNC systems updated with the latest version available.
  • Refer to the joint Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators to help with reducing cybersecurity risk by identifying which assets within their environment should be secured and protected.
• Ensure OT assets use robust authentication procedures.
  • Many devices lack robust authentication and authorization. Devices with weak authentication are vulnerable targets to threat actors using credential theft techniques.
  • Implement MFA where possible. Where MFA is not feasible, use strong, unique passwords. Apply password standards for operator-accessible services on underlying OT assets, as well as network devices protecting those services. This is especially important for services that require internet accessibility [CPG 3.A] [CPG 3.B] [CPG 3.C] [CPG 3.F].
  • Establish an allowlist that permits only authorized device IP addresses and/or media access control addresses. The allowlist can be refined to operator working hours to further obstruct malicious threat actor activity; organizations are encouraged to establish monitoring and alerting for access attempts not meeting these criteria [CPG 3.E].
  • Disable any unused authentication methods, logic, or features, such as default authentication keys and default passwords. Block all unused high ephemeral ports and monitor for attempted connections using standard protocols on non-standard ports [CPG 3.R].
  • Authenticate all access to field controllers before authorizing access to, or modification of, a device’s state, logic, program, or filesystems.
• Enable control system security features that can separate and audit view and control functions. Limiting remotely accessible or default user accounts to “view-only” removes the potential for impact without exploiting a vulnerability [CPG 3.G].
• Implement and practice business recovery/disaster recovery plans. Plans should also take into consideration redundancy, fail-safe mechanisms, islanding capabilities, backup restoration, and manual operation.
  • Include scenarios that necessitate switching to manual operations. Maintaining the capability of an organization to revert to manual controls to quickly restore operations is vital in the immediate aftermath of a cyber incident [CPG 6.A].
  • Create backups of the engineering logic, configurations, and firmware of HMIs to enable fast recovery. Organizations should routinely test backups and standby systems to ensure safe manual operations in the event of an incident [CPG 3.O].
• Collect and monitor the traffic of OT assets and networking devices. This includes unusual logins or unexpected protocols communicating over the internet, and functions of ICS management protocols that change an asset’s operating mode or modify programs.
• Review configurations for setpoint ranges or tag values to stay within safe ranges and establish alerting for deviations.
• Take a proactive approach in the procurement process by following the guidance outlined in the joint guide Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.

OT Device Manufacturers

Although critical infrastructure organizations can take steps to mitigate risks, it is ultimately the responsibility of OT device manufacturers to build products that are secure by design. The authoring organizations urge device manufacturers to take ownership of the security outcomes of their customers in line with the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software.

• Eliminate default credentials and require strong passwords. The use of default credentials is a top weakness threat actors exploit to gain access to systems.
• Mandate MFA for privileged users. Changes to engineering logic or configurations are safety-impacting events in critical infrastructure. MFA should be available for safety critical components at no additional cost.
• Practice secure by default principles. OT components were initially designed without public internet connectivity in mind. When internet connection becomes necessary, implementing additional security measures is essential to safeguard these systems. Manufacturers should recognize insecure states and promptly inform users so they can make informed risk decisions.
  • Include logging at no additional charge. Change and access control logs allow operators to track safety-impacting events in their critical infrastructure. These logs should be available for no cost and use open standard logging formats.
• Publish Software Bill of Materials (SBOMs). Vulnerabilities in underlying software libraries can affect a wide range of devices. Without an SBOM, it is nearly impossible for a critical infrastructure system owner to measure and mitigate the impact of a vulnerability on their existing systems. See CISA’s SBOM webpage for more information.

Additionally, see CISA’s Secure by Design Alert on how software manufacturers can shield web management interfaces from malicious cyber activity. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.

For more information on secure by design, see CISA’s Secure by Design webpage.

Validate Security Controls

In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK Matrix for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how it performs against the ATT&CK techniques described in this advisory.

To start:

1. Select an ATT&CK technique described in this advisory (see Table 1 to Table 10).
2. Align your security technologies against the technique.
3. Test your technologies against the technique.
4. Analyze your detection and prevention technologies’ performance.
5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Resources

Entities requiring additional support for implementing any of the mitigations in this advisory should contact their regional CISA Cybersecurity Advisor for assistance. Key resources organizations should reference include:

• CISA, EPA, NSA, FBI, ASD’s ACSC, Cyber Centre, BSI, NCSC-NL, and NCSC-NZ’s Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators offers best practices to assist organizations in identifying and prioritizing which assets should be secured and protected.
• CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, Cyber Centre, and NCSC-UK’s guidance on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity that can help organizations protect OT systems from pro-Russia hacktivist activity.
• NSA and CISA’s guidance on Control System Defense: Know the Opponent helps organizations defend OT and ICS assets against malicious cyber activity.
• CISA and EPA’s resource page on Water and Wastewater Cybersecurity to help organizations reduce risks posed by malicious cyber actors targeting water and wastewater systems.
  • For additional guidance, see CISA, EPA, and FBI’s fact sheet on Top Cyber Actions for Securing Water Systems.
• The Food and Ag-ISAC’s best practices on Food and Ag Cybersecurity: A Guide for Small & Medium Enterprises provides recommendations to help mitigate against cyber threats.
• DOE and National Association of Regulatory Utility Commissioners Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER) webpage provides resources for state public utility commissions and utilities, as well as DER operators and aggregators to help mitigate cybersecurity risks.

Additional resources that apply to this advisory include:

• EPA’s Cybersecurity for the Water Sector resource page provides organizations with guidance on implementing basic cyber hygiene practices.
• CISA’s Cross-Sector Cybersecurity Performance Goals enables critical infrastructure organizations to reduce the likelihood and impact of known risks and adversary techniques.
• CISA’s Require Strong Passwords webpage supports small and medium-sized businesses mitigating against malicious cyber activity that targets weak passwords.
• CISA, NSA, FBI, EPA, TSA, and international partners’ guidance Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.
• DOE’s guidance on Cyber-Informed Engineering recommends considering cyber-enabled risks during the conception, design, and development phases when manufacturing physical systems.
• CISA’s Cyber Hygiene Services help enable critical infrastructure organizations to reduce their exposure to threats by taking a proactive approach to monitoring and mitigating attack vectors.
• CISA, NSA, FBI, and international partners’ guidance on Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software urges software manufacturers to provide customers with products that are safer and more secure.
  • See more information in these Secure by Design Alerts: How Manufacturers Can Protect Customers by Eliminating Default Passwords and How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity.

Contact Information

U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:

• Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472) or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.
• For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov.

Australian organizations: Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

Canadian organizations: Report incidents by emailing Cyber Centre at contact@cyber.gc.ca.

New Zealand organizations: Report cyber security incidents to incidents@ncsc.govt.nz or call 04 498 7654.

United Kingdom organizations: Report a significant cyber security incident: report.ncsc.gov.uk (monitored 24 hours) or, for urgent assistance, call 03000 200 973.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and co-sealers.

Acknowledgements

Schneider Electric, Nozomi Networks, Eversource Energy, Electricity Information Sharing and Analysis Center, Chevron, BP, and Dragos contributed to this advisory.

Version History

December 09, 2025: Initial version.

Appendix A: Targeting Methodologies for Pro-Russia Hacktivist Groups

For further information on targeting methodologies for pro-Russia hacktivist groups, see:

• CISA’s alert Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology;
• The joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology; and
• CISA’s Russia Cyber Threat webpage.

Appendix B: Additional Designators Used for Cited Groups

The cybersecurity industry and cyber actor groups often use various names to reference actor groups. While not exhaustive, the following are the most notable names used within the cybersecurity community to reference the groups in this advisory.

Note: Cybersecurity organizations have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the authoring organizations’ understanding for all activity related to these groupings.

• GRU military unit 74455
  • Sandworm Team
  • Voodoo Bear
  • Seashell Blizzard
  • APT44
• Cyber Army of Russia Reborn (CARR)
  • CyberArmy of Russia
  • Народная CyberАрмия (НКА)
  • People’s CyberArmy of Russia (PCA)
  • Russian CyberArmy Team (RCAT)
• NoName057(16)
  • NoName057(16) Spain
  • NoName057(16) Italy
  • NoName057(16) France
• Z-Pentest
  • Z-Pentest Beograd
  • Z-Pentest Alliance
  • Z-Alliance

• The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!
  • This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.
  • You will be able to manage this feature in Settings under Sync (for now)
    • 
  • You can read more about the feature here
• As followups to the recent addition to the WebExtension tabs API to support the new SplitView tabs feature, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window – Bug 2029099 / Bug 2029534
• Adaptive autofill has been enabled on Nightly.
  • Previously, autofill only completed domains (e.g. typing red autofilled reddit.com). Now it can also complete full URLs for pages you visit often (e.g. red → reddit.com/r/firefox), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.
    • If you run into issues or have feedback, you can file a bug here!
• Markus Stange [:mstange] implemented dynamic toolbar on top in RDM (#1978145), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android
  • dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled
  • it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom
  • 

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Amin Amir
• aoia7rz7l
• Chukwuka Rosemary
• DrSeed
• Frédéric Wang Nélar
• japandi
• John Iweh
• jonathancabera
• Josh Aas
• Keji Bakare
• kofoworola shonuyi
• konyhéa
• liz
• Mathew Hodson
• Okhuomon Ajayi
• Oluwatobi
• ROSHAAN
• Sam Johnson

New contributors (🌟 = first patch)

•  Anthony Mclamb: Disable the legacy Edge migrator
•  Amin Amir
  • 🌟Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled
  • Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs
  • 🌟 Amine Zroual: Omitted maxResults property not handled correctly in getRecentlyClosed
• any1here: install_sig_alt_stack incorrectly checks mmap’s return value
• 🌟 Armin Ulrich: Fix MessageHandlerRegistry.sys.mjs calling getExistingMessageHandler with an unused second argument
• japandi
  • Cannot remove amazon.com from top sites list
  • The height of the pinned tabs area should be responsive to the number of pins
  • Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations
• Nathan Johnson [:narjoDev]: Remove browser.display.use_system_colors pref
• DrSeed
  • Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting
  • The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again
• Keji Bakare:
  • Split view’s focus-outline is clipped on the right side of left tab
  • White space on the right side of left panel in split view
• 🌟 gotyaoi: Reload toolbar button is active on about:newtab
• Itoro James: [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it
• John Iweh: The notification dot is not displayed if the tab is in a Split View
• 🌟 John Iweh: sidebar-shown attribute remains when sidebar.revamp is false
• 🌟 jonathancabera:
  • The Move tab to Split View option is also displayed for the tabs that are within the Split View
  • A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled
  • Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode
• Aloys: Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67
• liz:
  • Create test to ensure maxRenderCountEstimate is never being set to Infinity in virtual-list component in Fx View
  • Button accessible name does not convey its function: missing topic context (Settings dialog > Topics dialog > buttons Following/Unfollow/Blocked/Unblock)
• Mary cathline: Tab Group Label does not respect touch density in vertical tab bar
• 🌟 Brandon Lucier: Popups opened with window.open give window type normal instead of popup
• karan68: [dialog] New Shortcut dialog needs a label/accessible name
• 🌟 Vector: Button does not programmatically indicate that it opens a dialog (Recent activity section > story card > ••• disclosure > Delete from History button)
• 🌟 Osoble: Update font size and weight for synced tabs device name headers in Firefox View
• konyhéa:
  • Add test for sync admin disabled to browser_syncedtabs_errors_firefoxview.js
  • Check all second paramaters for TestUtils.waitForCondition in Fx View test files
  • Recently Closed Tabs, Tabs from Other Devices, and History pages should have Cmd / Ctrl + Click on a link open the link in the new background tab.
• Noble Chinonso: #shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled
• Pranjali Srivastava: Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)
• Okhuomon Ajayi:
  • More spacing is needed between the tab note icon and the close icon on the tab
  • The tabs in vertical mode collapsed state are positioned differently in Split View
  • Keep vertical split view tabs stacked vertically even when the sidebar is expanded when expand on hover is enabled
  • Vertical split view tabs can be too big or small when tabs are overflowing
• 🌟 Rishan: Fix duplicated arrow function in browser_history_sidebar.js
• Chukwuka Rosemary:
  • “Forget About This Site” context menu option missing from Firefox View history
  • Long strings are not displayed properly on the about:opentabs page search filed
  • Add test for Forget This Site option in Fxview history context menu.
• ROSHAAN:
  • 🌟Tab note background colour is incorrect for default light theme
  •  [win/linux] The splitter between content areas does not match Figma spec
  • Fix typo in OpenInTabsUtils.confirmOpenInTabs()
• Sameeksha: Disclosure button expanded/collapsed state not programmatically defined (Customize button)
• kofoworola shonuyi:
  • 🌟Actually hide or remove sidebar-shown attribute when in fullscreen.
  • Add a test for checking sidebar-shown attribute in fullscreen mode
• 🌟 Sayd Mateen: Page URL is displayed as tab name when page’s contains about:reader?</a></p> <p>

• Oluwatobi:
  • Unable to delete selected history entries from sidebar
  • Incorrect Sidebar button state/tooltip hover text
  • The city name heading level doesn’t follow the correct heading level order
• Nishchay [:nish]: Unable to add tabs to old closed tab groups (tabGroupState.splitViews is undefined)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) – Bug 2032014
  • NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes

WebExtensions Framework

• Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors – Bug 2033173
  • Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!
• Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail – Bug 2034329
  • Thanks to Simon Farre for promptly investigating and fixing this recent regression!

WebExtension APIs

• Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted – Bug 1392125
  • Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!

DevTools

• Artem Manushenkov fixed an issue where autosuggestion popup was removing overridden indicators from properties in the Inspector (#1983408)
• Andrea Marchesini [:baku] fix DevTools cookie header serialization for long cookies, which could lead to cookies not being visible in Netmonitor (#2031299)
• Julian Descottes [:jdescottes] fixed a toolbox crash that was happening we couldn’t find a localization file (e.g. when using a language pack on Nightly) (#2028930)
• Nicolas Chevobbe [:nchevobbe] improved @container tooltip so it show the value of variables used in style()(#2030239), has enough contrast in dark mode (#2033782) and contains a link to select the container (#2031688)
  • 
• Hubert Boma Manilla (:bomsy) is making good progress on migrating the Console to CodeMirror 6 (#2032758, #2026569)

Fluent

• We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!
• 

Migration Improvements

• Thanks to dao for fixing a recent alignment issue in the migration wizard dropdown
• Thanks to volunteer contributor Anthony Mclamb for his patch that disables the legacy EdgeHTML Edge migrator! Once that finishes rolling out, presuming no surprises, we’ll go ahead and remove the migrator entirely.

New Tab Page

• Nova for New Tab has ridden the trains to Beta! It will be enabled by default, globally, when Firefox 151 goes out to release on May 19th
  • It’s possible that we’ll do a train-hop coupled with an experiment to enable HNT Nova for a few clients a bit earlier.
• Maxx Crawford enabled Nova designs for New Tab, rolling out the updated layout, widgets, and customization panel behind HNT Nova flags.
• Maxx Crawford fixed the Nova content feed to render the intended four‑column layout by correcting CSS grid breakpoints.
• Maxx Crawford resolved a first‑load failure in the Weather widget by fixing init order and fetch timing, eliminating the “Oops” error.
• Maxx Crawford synchronized the Weather toggle between about:preferences#home and the panel via the shared showWeather pref to prevent desync.
• Maxx Crawford updated Nova grid focus order to align tab flow with visual order for keyboard users.
• Maxx Crawford fixed critical UI issues in Lists and Timer widgets covering overflow, controls, and layout stability.
• Maxx Crawford guarded document.dir access in Nova render paths to avoid startup cache worker errors and improve startup stability.
• Rolf added a new normalization method for the inferred interest vector to stabilize topic relevance across sessions.
• Rolf prevented unnecessary content refreshes during Pocket New Tab experiments, reducing jank and bandwidth.
• Sameeksha defined the Customize button’s expanded/collapsed state programmatically using aria-expanded for better a11y.
• liz clarified follow/unfollow/blocked button names with topic context so screen readers announce clear actions.
• Vector marked the Delete from History control as opening a dialog via aria-haspopup=dialog for assistive tech.
• Scott Downe fixed a regression that flipped the Wallpapers pref off, restoring user selections.
• Irene Ni corrected privacy link color and focus styles for contrast and keyboard visibility.
• Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
• Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
• Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
• Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
• Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
• Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
• Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
• Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.
• Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
• Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
• Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
• Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
• Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
• Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
• Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
• Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.

Search and Urlbar

• Marco has fixed a couple of issues with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.
• Work continues on the new separate search bar to improve the functionality, e.g. allowing middle click to perform a search in a new tab, avoiding performing a search when adding a search engine.
• Work also continues on the new Nova layouts.

Smart Window

• uplifted 10 bugs to 150.0.1 dot release addressing initial user feedback from diary study and Connect
  • jump to bottom of conversation 2028692
  • stop streaming button 2029204
  • back/forward navigation from assistant 2029229
  • dark mode for various chips 2024499
• search engine switching from smart bar 2021973
• Nova styling within smart window 2026794

Storybook/Reusable Components/Acorn Design System

• Dustin converted moz-breadcrumb-group variables into JSON design tokens Bug 2029181 – Convert moz-breadcrumb-group variables into JSON design tokens
• Dustin converted moz-box-* variables into JSON design tokens Bug 2029180 – Convert moz-box-* variables into JSON design tokens
• Dustin converted moz-promo variables to JSON design tokens Bug 2029190 – Convert moz-promo variables into JSON design tokens
• Dustin converted moz-reorderable-list variables to JSON design tokens Bug 2029191 – Convert moz-reorderable-list variables into JSON design tokens
• Dustin converted moz-visual-picker variables to JSON design tokens Bug 2029193 – Convert moz-visual-picker-item variables into JSON design tokens
• Dustin updated browser-shared.css so it passes use-design-tokens Bug 2022985 – Update browser-shared.css so it passes use-design-tokens
• Dustin updated popup.css so it passes use-design-tokens Bug 2022979 – Update popup.css so it passes use-design-tokens
• Jon added opacity tokens and added opacity to use-design-tokens stylelint rule  Bug 1955325 – Create opacity tokens
• Jon converted toolbar design tokens to JSON Bug 2017970 – Convert toolbar design tokens to json
• Anna fixed moz-select with panel-list drop-down size inconsistency Bug 2032365 – Applications Action drop-down menus sometimes have a different size when opened
• Anna fixed issue with the disabled state of moz-radio component Bug 2027123 – moz-radio disabled state cannot be changed while the moz-radio-group is disabled
• Anna updated moz-button and moz-box-button components to prevent label corruption when accesskeys are present and the label changes.   Bug 2022326 – moz-button with accesskey label becomes corrupted when l10nId updates dynamically

UX Fundamentals

• The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – 2027209
• In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – 2031837

Settings Redesign

• Tim converted settings related to Accessibility page to config-based pane Bug 1968116 – Convert settings related to Accessibility page to config-based settings
• Benjamin converted Privacy & Security page to the config-based pane Bug 1968112 – Convert settings related to Privacy & Security page to config-based settings
• Finn integrated Firefox Labs page into setting-pane config Bug 2021047 – Integrate Firefox Labs page into setting-pane config
• Anna converted Firefox Updates section to config-based prefs Bug 1990961 – Convert Firefox Updates section to config-based prefs
• Mark Kennedy added moz-promo, that is welcoming users to the redesigned settings Bug 2015093 – Add a moz-promo to welcome users to the redesign
  • 
• Anna added possibility to search for actions in the redesigned “Applications” section Bug 2020370 – It’s no longer possible to search for actions in the new “Applications” section
• Anna fixed the Settings navbar layout breakage

• James enabled adaptive autofill in Nightly for testing, which we believe should provide better results in the URL bar when doing autocomplete!
• Jack updated the illustrations shown on some of our error pages to match the latest approved designs, giving users more polished artwork when the browser encounters connection or security errors!

• Controls for the Memories feature can now be set during Smart Window onboarding

• We’ve disabled the CSS filter implicitly applied to WebExtension pageAction SVG icons across all release channels starting in Firefox 152, completing the deprecation
  • NOTE: The blog post published at WebExtensions API changes in Firefox 149-152 provides to extensions developers more details about this deprecation and links to the related MDN docs.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Amin Amir
• Pranjali Srivastava
• Sam Johnson

New contributors (🌟 = first patch)

•  🌟:23rd: Regression: The new swipe-to-navigation indicator stucks for a moment, when deciding not to navigate the other page
• 🌟Akeem Omosanya: Remove commented-out code in SearchService.sys.mjs
• Amin Amir:
  • 🌟Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled
  • Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs
• 🌟Sahaj: Suggest the default target language for translation after changing the detected source language
• 🌟JIANG Zhirui: Breakpad build failed on Windows using VS2026 due to removal of stdext
•  John Iweh: Add “Open in New Tab” and “Open in New Container Tab” options to the context menu for Tabs from Other Devices
• Jak: Bookmarks and History – should respect the “When you open a link, image or media in a new tab, switch to it immediately” setting
• 🌟Andy [:rgbcmy]: Autoplayed next video should also be PIP
•  konyhéa: “Escape” key should collapse the expanded on hover sidebar launcher even if hover is still active.
•  Pranjali Srivastava:
  • Remove icon property from sidebar extensions
  • Show language-agnostic SelectTranslations context menu item when the source and target languages are the same

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• Fixed long-standing regression on the autocomplete and datalist popups for extension inline options pages on about:addons (introduced in Firefox 68 by Bug 1532724, fix shipping in Firefox 152) – Bug 1595158

WebExtensions Framework

• Fixed access to web-accessible resources declared with <all_urls> from sandboxed documents (null-principal URLs), restoring extension redirects from the context-menu search flow, starting in Firefox 152 – Bug 2033905

WebExtension APIs

• Added exhaustive test coverage for tabs.move() against additional edge cases related to split-view tabs – Bug 2029092

DevTools

• Andreas Farre improved the Session History tab in the Application panel (still behind devtools.application.sessionHistory.enabled)
  • added support for remote debugging (#2014064, #2016121)
  • made sure that calls to History.replaceState are reflected in the UI (#2037359)
• Julian Descottes [:jdescottes] fixed the most frequent DevTools crash we were observing in Telemetry, adding a guard against IDBTransaction errors when retrieving breakpoints in the Debugger (#2030260)
• Nicolas Chevobbe [:nchevobbe] fixed the image preview tooltip for relative URLs images in constructed stylesheet (#2035503)
• Julian Descottes [:jdescottes] reduced the overhead we had because of network requests monitoring by only decoding response content when the user actually want to see the response (#2026228)

WebDriver

• Amin Amir cleaned up an incorrect variable assignment in our browsingContext module.
• Logan Rosen updated stale references and broken links in our documentation about Marionette.
• Sameem improved the Marionette and WebDriver BiDi screenshot commands to enforce maximum allowed dimensions.
• Leo McArdle fixed the regression in the “log.entryAdded” event, which lacked an error message in the “text” field for the messages of type “error”.
• Henrik Skupin fixed an issue in Marionette where WebDriver:Navigate and WebDriver:Refresh did not handle errors when the underlying navigation failed.
• Henrik Skupin improved geckodriver to detect an early Firefox exit during startup on Android, avoiding up to 60 seconds of unnecessary connection attempts.
• Henrik Skupin updated the geckodriver CI build job to produce a universal macOS binary supporting both x64 and aarch64.

Lint, Docs and Workflow

• Sylvestre ported some linters (e.g. file-whitespace, test-manifest-toml, license, file-perm, rejected-words & more) to Rust to help improve the runtime of the code review bot.
• Dale has been working on migration to moz-src for customkeys, dom/quota and odom/geolocation
  • https://arewemozsrcyet.com/

New Tab Page

• We did our first region-specific trainhop on May 11th (just 15% of the US), and turned on HNT Nova (and sometimes Widgets) for those clients to get some advance-data of its behaviour in the wild! A note that HNT Nova gets turned on for everybody when Firefox 151 ships on May 19th.
  • We’ll be launching a similar experiment in the DE, probably on May 12th, also at 15% population.
• Most of the team is heads down building out a sports-tracking widget, attempting to get that ready in time to be generally available for the upcoming World Cup event.
• Dre landed a new world clock widget, which is currently off by default, but pretty snazzy!

Search and Urlbar

• Nova (URL Bar Design Refresh)
  • Drew and Daisuke continued their work on Nova styling for the Address bar (input and view).
• Search and Suggest
  • Drew finalized two bugs for World Cup and sports suggestions, which were landed and uplifted: one to update the localization string for scheduled games and another to show both teams’ icons in suggestions. Drew also landed and uplifted a fix for rich search suggestion icons being forced into a square aspect ratio.
  • Standard8 updated Ecosia favicons to the latest branding, including QA testing and publishing.
• Settings Redesign (SRD)
  • Stephanie landed a test to ensure search suggestion settings are hidden when quicksuggest is disabled, as well as a patch to resolve TypeScript issues in search.mjs, and is adding test coverage to confirm removed search engines are not displayed in the default engines dropdown.
• General URL Bar and Component Updates
  • Daisuke landed implementation of the context menu on URL bar results, and a fix to show the loading URL in the URL bar when starting up with a homepage.
    • Marco is working on several tasks, including a PDF download / focus stealing issue and allowing arrays to be bound in Sqlite.sys.mjs. Marco also worked on fixes related to Places, such as avoiding replacing the favicons database if it is not corrupt.
  • Standard8 finalized the URL bar test manifest split. Standard8 also upgraded us to TypeScript 6.
  • Moritz landed a fix for URL bar abandonment telemetry being recorded when clicking an engine in the unified search button popup (Bug 2032973), which was also uplifted. Moritz also simplified search mode switcher item activation in tests, and made it so that the unified search button popup closes when installing an open search engine.

Smart Window

• natural language starting with tab close/undo 2035343 with expandable action log 2031508

• assistant rendering feedback up/down 2032994 and markdown table 2027029
• nova styling blur 2027877 and suggestions 2026823
• accessibility screen reader 2028676 and keyboard focus 2037565
• optimize conversation starters extra requests 2030005 and caching 2033430

Storybook/Reusable Components/Acorn Design System

• Nova token updates occasionally, focused on SRD

UX Fundamentals

• Added support for the “SEC_ERROR_CA_CERT_INVALID” certificate error to the Felt Privacy error pages. – 2035942

Settings Redesign

• Settings redesign is being tested and will hopefully go out in Firefox 152!

• Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
• Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.
  • You can try it out on this Instagram reel in Nightly

• A note to WebExtension authors – as part of a planned deprecation announced last month, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 – Bug 2015559
• Nicolas Chevobbe [:nchevobbe] added support and debugging for modern attr()(which is enabled on Nightly) (#2014751)

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

• Sam Johnson
• Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

• Immaculate Atim: Switch to using an array instead of an object string for browser.backup.enabled_on.profiles
• liz: Screenshots overlay visible on both splitview browsers
• 🌟 Rahman Mahmutović [:r_m]: Can’t change content in box model in inspector for box-sizing:border-box elements
• Takeru Mitsumori: Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html
• 🌟 Freya Arbjerg [:freyacodes]: Blackboxed columns are ignored
•  tom.passarelli: tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

• As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767

WebExtensions Framework

• Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
• Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054
  • Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.

WebExtension APIs

• Fixed handling of <all_urls> as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

• Rahman Mahmutović [:r_m] made it possible to edit width/height in the box model section of the Layout panel (#1717176)
• Sebastian Zartner [:sebo] improved toggling tools driving in-page highlighters (e.g. the Measuring) (#1262773)
• Sebastian Zartner [:sebo] added a setting to control visibility of HTML comments in the markup view (#1455294)
• Freya Arbjerg [:freyacodes] fixed an issue in script blackboxing (#2036767)
• Alexandre Poirot [:ochameau] replaced custom preference to log RDP messages with MOZ_LOG (#1622857)
• Alexandre Poirot [:ochameau] fixed retrieval of garbage collected script text content (#1758454)

WebDriver

• Sameem updated the “Take Element Screenshot” command from WebDriver Classic to crop screenshots of elements which exceed the viewport. This aligns with the specification and avoids errors when attempting to capture huge elements.
• Alexandra Borovova updated the events for new top-level browsing contexts: we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used. This is required to align with the expected per-spec behavior.
• Henrik Skupin landed a patch allowing geckodriver to gracefully shut down Firefox when geckodriver itself is terminated.
• Hiroyuki Ikezoe disabled Firefox’s “scroll axis lock” feature so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.

Lint, Docs and Workflow

• Added a rule to prevent new uses of Preferences.sys.mjs.
• The browser environment globals within ESLint have now been updated. These include Sanitizer, VideoFrame and a few other new ones.
• Temporal, and some other definitions have been added to TypeScript.

New Tab Page

• Much has happened in the last 2 weeks! Here’s a full bug list, and here are some highlights.
• Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (2033592) — prevents accidental list creation and improves the Lists UI reliability.
• Maxx Crawford fixed Weather widget small card layout issues with opt-in location options and an error message displayed, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.
• Reem Hamoui added key dates state to the Sports widget, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.
• Scott Downe added a manage widgets option to the New Tab nova widgets context menu, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.
• Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see Newtab widget base component.
• Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see Convert widget expansion handling to shared widget expansion.
• Nina Pypchenko [:nina-py] updated the Sports widget to populate the “follow teams” state from the /teams endpoint, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.
• Scott Downe moved widget menu items within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.
• Dre fixed a World Clock city search bug for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.
• Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see Newtab small weather widget size change doesn’t always work.
• Nina Pypchenko [:nina-py] added a group stage section to match highlights in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.
• Dre fixed the small world clock widget not expanding to large while editing clocks so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.
• Maxx Crawford added WCW OMC message strings so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.
• Reem Hamoui added a “View all” button and a list view for the results tab at medium widget size so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.
• Maxx Crawford added WCW “Watch Live” stream strings to the Sports widget strings bundle so the widget can surface a localized “Watch Live” CTA for applicable events.
• Dre restored VoiceOver reachability for Edit/Remove in World Clock on macOS so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.
• Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (2041033).
• Mike Conley added New Tab jest tests to the node tests Tier 1 CI job Run newtab jest tests as part of node tests Tier 1 job to catch regressions earlier in CI
• Irene Ni shipped multiple visual fixes for the Sports widget Sports widget – various visual fixes (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.

Picture-in-Picture

• kpatenio adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably, especially when selecting videos from the YouTube search page.
• Thanks to Sylvestre for patching some bugs to prevent some spurious console errors!
• Niklas fixed captions on autopip videos failing to sync with the origin videos.

Performance Tools (aka Firefox Profiler)

• Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.
  • https://www.npmjs.com/package/@firefox-devtools/profiler-cli
  • You can install it with npm install -g @firefox-devtools/profiler-cli@latest

Search and Urlbar

Nova UI refresh

• Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.
• 2019154, 2019152, 2041501, 2040532

Suggest

• Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
• 2040561, 2039753, 2035614, 2038843

Adaptive autofill

• James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
• 2040819, 2037177

Quick actions

• Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
• Caleb added Calculator support for certain unicode operators.
• 2023169, 1928635, 1923383, 2033861

Multi Context Address Bar

• Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
• 2039297, 2036095, 2039844, 2037933, 2030050

Other

• Marco, Drew and Daisuke fixed several intermittent test failures.
• 2038510, 2023908, 2011584, 1938142, 1971091

Search

• Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
• Caleb fixed multiple documentation issues and added a test covering searches from a private window.
• 1904613, 2035878, 2037942, 2033545, 2005724

Places

• Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
• Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
• 2039534, 1505800, 2008829, 2029541, 2035084

While previous policy updates focused heavily on certificate revocation, automation, and operational resilience, MRSP v3.1 focuses on a different challenge: ensuring that Certification Authority (CA) operations are sufficiently transparent, understandable, and auditable.

Trust in the Web PKI depends not only on technical requirements, but also on the ability of Mozilla, auditors, and the broader community to understand how CA systems are designed, operated, and assessed. MRSP v3.1 introduces new requirements intended to improve the quality of CA documentation and strengthen independent assurance of the design and effectiveness of controls that protect CA systems.

Improving CP/CPS Documentation

Certification Practice Statements (CPSes) and combined Certificate Policy / Certification Practice Statement documents (CP/CPSes) are among the most important public documents published by a CA. They describe how a CA conducts its operations and meets industry requirements.

Over the years, we have seen significant variation in the quality, structure, and level of detail provided in CP/CPS documentation. Some documents provide extensive implementation detail, while others rely heavily on incorporation by reference or provide only high-level descriptions of CA practices.

The revised policy will continue to require conformance with RFC 3647, as modified by applicable CA/Browser Forum requirements. Improvements to section 3.3 in the MRSP will establish clearer expectations regarding the content and quality of CP/CPS documentation. The new requirements emphasize that documentation must be explicit, bounded, auditable, and sufficiently detailed to describe the CA operator’s certificate issuance and management activities, while also establishing requirements for version control, accessibility, and ongoing maintenance. The objective is to ensure that a technically competent reviewer will be better-able to determine what commitments the CA has made, how those commitments are implemented, and whether the documented practices support technical, operational, and performance oversight.

Mozilla believes that these new CP/CPS requirements will improve transparency, reduce misunderstandings, support more effective audits, and help reduce the risk of certificate misissuance by ensuring that operational practices are documented accurately, consistently, and in sufficient detail to permit meaningful review.

Introducing Detailed Controls Reports

A second major enhancement in MRSP v3.1 is the introduction of Detailed Controls Reports (DCRs). Traditional WebTrust and ETSI audit reports provide valuable independent assurance regarding compliance with established criteria. However, they generally provide only limited visibility into the specific controls, testing procedures, and operational environments that support those conclusions.

Beginning with audit periods starting on or after July 1, 2027, CA operators with root certificates enabled for TLS website authentication will be required to obtain a DCR. The purpose of the DCR is to provide CA management, auditors, and Mozilla with greater visibility into the controls, testing, and operating effectiveness of CA systems that support compliance with the CA/Browser Forum’s TLS Baseline Requirements and Network and Certificate System Security Requirements. Mozilla generally expects to review DCRs only on an as-needed basis, such as during compliance reviews, incident investigations, root inclusion evaluations, or other oversight activities.

A DCR must include:

• The scope and boundaries of the audited CA systems;
• Applicable audit criteria;
• Controls implemented by the CA;
• The auditor’s testing procedures;
• Results of control testing; and
• Information regarding control exceptions or deficiencies.

Mozilla expects that DCRs will complement existing audit reports and strengthen transparency and assurance by providing additional detail regarding system boundaries, control implementation, testing procedures, and control effectiveness that is not typically available in traditional audit reports. Effective compliance requires more than documented policies and successful audits; it also requires management understanding, oversight, and engagement. By providing greater visibility into CA systems, controls, testing activities, and operational risks, DCRs can help reinforce a strong tone at the top regarding compliance expectations, support informed decision-making and resource allocation, enable earlier identification of weaknesses, and promote a culture of continuous improvement. The intent is not to replace existing audit reports, but to provide additional information that supports effective governance, oversight, and informed trust decisions.

Additional Clarifications and Improvements

MRSP v3.1 also includes several targeted clarifications and refinements:

• aligns Mozilla’s mass revocation planning requirements with the corresponding CA/Browser Forum Baseline Requirements, helping ensure consistency across compliance frameworks;
• clarifies audit expectations for root inclusion requests, including requirements relating to audit continuity and root key generation ceremonies;
• requires root CA key pairs submitted for inclusion to have been generated within the previous five years, helping ensure that newly included roots are based on contemporary cryptographic practices and controls; and
• clarifies expectations when ownership or operational control of a CA changes, helping ensure that Mozilla receives timely notice and can evaluate the impact of acquisitions or organizational changes on continued compliance.

Looking Forward

Mozilla recognizes that these changes will require preparation by CA operators, auditors, and other ecosystem participants. To support implementation, Mozilla is publishing accompanying wiki guidance regarding both CP/CPS Documentation and Detailed Controls Reports.

As with previous policy updates, these changes were informed by discussions with CA operators, auditors, and members of the Web PKI community. We appreciate the feedback received during the review process and look forward to continued collaboration as the ecosystem evolves.

Mozilla has a longstanding focus on building confidence in the Web PKI through transparency, accountability, and continuous improvement. By requiring higher-quality CP/CPS documentation and strengthening independent assurance, MRSP v3.1 advances Mozilla’s commitment to protecting its users and maintaining their trust in the systems that help secure the web.

The post Improving Transparency and Assurance in the Web PKI: Mozilla Root Store Policy v3.1 appeared first on Mozilla Security Blog.

The owner of British Gas has claimed that most households would rather speak with an AI chatbot than deal with the company’s staff as it prepares to cut 1,300 jobs from its call centres and back office.

Centrica, the supplier’s FTSE 100 owner, plans to cut 800 jobs as the company carries out a “targeted deployment of AI tools”, on top of the 500 cuts it confirmed last month.

Read more of this story at Slashdot.

• The best games of 2026 so far

Comfort is crucial to the gaming experience. It’s hard to focus on blasting aliens or taking Stoke to the Champions League final if your bum has gone to sleep because you’ve been sitting on an old chair for three hours. We’re spending more time playing games than ever before, so good posture matters. If you have set up a dedicated gaming space, then a rickety seat just won’t cut it.

From luxurious ergonomic thrones to cheap-and-cheerful bucket seats, the options available are bewildering. So I set out on an epic quest: to find the most comfortable, durable and stylish gaming chairs. Here’s what I discovered.

Best gaming chair overall:
Secretlab Titan Evo

Best budget gaming chair:
ThunderX3 Solo 360

The Cyber Express Weekly Roundup 

U.S. Accounts for Nearly Half of Global Ransomware Attacks in H1 2026 

Dubai Police Warns Against Online Visa Fraud Schemes 

Craneware Data Breach Exposes Employee and Customer Information 

U.S. Targets Illegal FIFA World Cup Streaming Networks 

Chick-fil-A Customer Accounts Targeted in Credential Attack 

South Korea Diplomatic System Breach Lasted Nearly 10 Months 

Weekly Cybersecurity Takeaway 

Read more →

The post Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions appeared first on IT Security News.

The post Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Read more →

The post JetBrains Patches Multiple Vulnerabilities Affecting IntelliJ IDEA and TeamCity appeared first on IT Security News.

The post JetBrains Patches Multiple Vulnerabilities Affecting IntelliJ IDEA and TeamCity appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Google Fined Over Self-preferencing on Google Search

Google Play Restrictions Lead to Second Fine

Digital Markets Act Enforcement Brings Compliance Deadline

Commission Investigations Began in 2024

Ich weiß nicht, wie es in Ihren Schubladen aussieht, aber meine sind voll mit Kabeln, die ich wahrscheinlich nie wieder benutzen werde, weil die Technologie sich ziemlich weiterentwickelt hat. Zum Glück scheint sich USB-C durchzusetzen, denn es gibt keinen falschen Weg, diese Dinger anzuschließen. Aber nicht nur Smartphones, Tablets und Laptops verwenden diese Anschlüsse, sondern auch eine lange Liste von Gadgets.

Wir haben den Markt nach versteckten Perlen durchforstet: Gadgets, bei denen Sie denken werden: “Wow, ich wusste gar nicht, dass ich das brauche, aber es wird mein Leben so viel einfacher machen!” Schauen wir uns also an, mit welchen coolen Geräten Sie Ihre Typ-C-Kabel und -Anschlüsse nutzen können.

heat it Insektenstichheiler

PCWelt/heat it/Amazon

Wer im Sommer oder Urlaub oft von Mücken geradezu heimgesucht wird, wird sich besonders über dieses geniale Gadget freuen: Dieses winzige Gerät, das sich einfach per USB-C mit Ihrem Smartphone verbinden lässt, kann mit gezielter Wärme den Juckreiz von Stichen und Insektenbissen deutlich reduzieren.

Ähnlich wie größere Varianten, etwa diesen hier von Beurer, muss man den kleinen Stichheiler von heat it einfach nur per App aufladen und dann auf den Stich halten. Die Hitze erledigt dann den Rest und zersetzt die Proteine, die im Mückenstich dafür sorgen, dass die Stelle anschwillt, juckt und schmerzt. Ein echtes Must-have für den Sommer, und es kostet nicht mal 25 Euro.

Mini-Ventilator

KIMMOO / Amazon / PC-WELT

Ziemlich genial sind auch diese kleinen Ventilatoren, die man im Sommer einfach in der Hosentasche mitnehmen und bei Bedarf schnell einsetzen kann. Wer schon einmal bei 30 Grad in einer vollen S-Bahn saß und sich zumindest ein wenig frische Luft gewünscht hat, der wird dieses Gadget lieben.

Der Mini-Ventilator für unter 20 Euro mit USB-C-Ladeanschluss kann ganz einfach über Powerbanks, Computer, Laptops oder USB-Ladegeräte betrieben werden. Es gibt aber noch kleinere und günstigere Ventilatoren, die man direkt ans Handy anschließen kann, und gerade mal 2-3 Euro pro Stück kosten. Diese sorgen aber auch für einen weniger starken Luftstrom, daher würden wir eher die erste Variante empfehlen.

USB-C zu HDMI Adapter

Anker

Wenn Ihr Laptop über einen USB-C-Anschluss verfügt, Sie Ihren Monitor aber schon seit Ewigkeiten nicht mehr geupgradet haben, verfügt Ihr Bildschirm vermutlich nicht über einen Typ-C-Anschluss. Dieser Adapter von Anker löst dieses Problem für Sie, sodass Sie das normale HDMI-Kabel, das Sie an Ihren Monitor anschließen, mit diesem Gerät verbinden können.

Der Adapter unterstützt Auflösungen von bis zu 4K bei 60 Hz, was ziemlich beeindruckend ist. Dies ist auch eine raffinierte Möglichkeit, Ihr Smartphone oder Tablet an Ihren Monitor oder Fernseher anzuschließen. Das Gerät kostet circa 13 Euro, aber wir haben es schon für nur 13 Euro bei Amazon gesehen.

Mini-Schraubendreher

Amazon

Wenn Sie häufig an Ihrem Computer oder anderen Geräten herumschrauben müssen, ist dieser elektrische Mini-Schraubendreher vielleicht genau das Richtige für Sie. Dieser stiftförmige Schraubendreher verfügt über vier LED-Leuchten, damit Sie besser sehen können, woran Sie gerade arbeiten, und dreht sich 200 Mal pro Minute, sodass Sie die Arbeit schneller erledigen können.

Der Schraubendreher verfügt über 64 verschiedene Aufsätze, es sollte also für so gut wie jeden Einsatzzweck ein passender dabei sein. Er kann über USB-C aufgeladen werden und hält bis zu drei Stunden lang. Der Elektroschraubendreher kostet normalerweise 41 Euro, ist aber auch für 32 Euro im Angebot erhältlich.

USB-C microSD-Kartenleser

Ugreen / Amazon

Die meisten Laptops verfügen heutzutage nicht mehr über einen Kartenleser, daher muss man andere Wege finden, um Daten von diesen kleinen Dingern zu übertragen. Egal, ob Sie Daten von der Karte Ihrer Dashcam oder Ihrer Kamera übertragen möchten, dieser winzige Ugreen USB-C microSD-Kartenleser ist dafür bestens geeignet.

Der Kartenleser ist so klein, dass Sie ihn wahrscheinlich an einem Schlüsselbund befestigen können. Wenn Sie eine etwas vielseitigere Version bevorzugen, bietet Ugreen ein Modell an, das auch mit SD-Karten kompatibel ist und sowohl über USB-C- als auch USB-A-Anschlüsse verfügt. Alle diese Modelle kosten weniger als 10 Euro und sind daher eine lohnende Investition.

Anker Nano Power Bank

Anker

Eine Sache, die Sie unbedingt in Ihrer Tasche, Reisetasche oder in Ihrem Rucksack haben müssen, ist eine Powerbank. Denn man weiß schließlich nie, wann das Telefon einen mal im Stich lässt und nach einer Aufladung schreit. Die Anker Nano Power Bank ist zum Glück so klein, dass sie fast überall hinpasst.

Sie verfügt über einen faltbaren USB-C-Anschluss und einen Anschluss an der Seite, sodass Sie bei Bedarf zwei Geräte gleichzeitig aufladen können. Die Kapazität von 5.000 mAh reicht gerade aus, um Ihr Handy einmal vollständig aufzuladen, was in der Not entscheidend sein kann. Außerdem kostet sie gerade mal 26 Euro, ist aber immer wieder mal reduziert.

Endoskopkamera mit Licht

Ennovor

Auch wenn Sie diese Endoskopkamera von Ennovor nicht jeden Tag benutzen werden, kann sie doch sehr nützlich sein. Sie schließen sie einfach an Ihr Telefon an, installieren eine App und sehen alles, was Ihre Kamera macht. Mein Kollege schwört darauf und verwendet sie, um alles zu finden, was so hinter dem Schreibtisch verloren geht.

Gerade dann, wenn Sie am Auto arbeiten oder nach undichten Leitungen suchen, ist das Teil super nützlich. Da sie die Schutzklasse IP67 hat, können Sie sie sogar in Ihr Aquarium stellen. Die Kamera wird mit einem circa 5 Meter langen, halbstarren Kabel und diversem Zubehör geliefert, darunter ein Haken, ein Magnet und ein Spiegel. Sie können diese Kamera im Moment für um die 22 Euro kaufen.

Blukar Taschenlampe

Blukar

Egal, wer Sie sind oder wo Sie so unterwegs sind: Sie brauchen eine Taschenlampe. Je kleiner, desto besser, denn so können Sie sie in jede Tasche stecken. Dieses Modell von Blukar verfügt über einen eingebauten 1800mAh-Akku, den Sie mit einem der vielen Typ-C-Kabel aufladen, die Sie so herumliegen haben.

Mit einer einzigen Ladung können Sie bis zu 16 Stunden arbeiten, was ziemlich gut ist. Sie können zwischen vier verschiedenen Blitzmodi wählen, darunter auch einer, der Ihnen hilft, Hilfe zu signalisieren. Außerdem kostet die kleine Taschenlampe weniger als 10 Euro. Es gibt also keine Ausrede, sich diesen Tipp entgehen zu lassen.

Samsung Flash-Laufwerk

Samsung

Die allermeisten Flash-Laufwerke haben einen USB-A-Anschluss, aber dieses von Samsung besitzt einen Typ-C-Anschluss. Mit Übertragungsgeschwindigkeiten von bis zu 400 MB/s können Sie Dateien im Handumdrehen verschieben. Das Coole an diesem USB-Stick ist, dass Sie ihn sogar in Ihr Smartphone stecken können, um 4K-Videos direkt darauf aufzunehmen.

Das Samsung Type-C Flash-Laufwerk ist in verschiedenen Speicheroptionen erhältlich, angefangen bei 64 GB bis hin zu 512 GB.

Mini Luftpumpe

PCWelt/Cycplus/Amazon

Ebenfalls perfekt für den Sommer geeignet ist diese kleine Luftpumpe von Cycplus, die unterwegs in jede Tasche passt. Sie kann nicht nur einen Fahrradreifen innerhalb von zwei Minuten auf Knopfdruck wieder aufpumpen, sondern wird auch per USB aufgeladen. Sie eignet sich laut Hersteller für Mountainbikes, Rennräder, Motorräder und sogar Autos!

Neben der Luftpumpe selbst lässt sich dieses praktische Gadget auch als Taschenlampe oder Powerbank für unterwegs einsetzen. Alles Dinge, die man auf einer Fahrradtour sehr gut gebrauchen kann. Und für den Preis von nur 45,99 Euro wirklich empfehlenswert, wenn Sie schnelle Hilfe bei platten Reifen benötigen. Im Angebot kostet sie sogar nur 37 Euro.

Leselampe mit Buchklemme

Gritin / Amazon

Wer auch gerne und viel liest, und das teilweise bis spät in die Nacht hinein, wird sich über dieses kleine Teil hier freuen: eine Leselampe, die Sie einfach an Ihr Buch klemmen können. Das ist jetzt vielleicht nichts bahnbrechend Neues, doch mit insgesamt drei Farbtemperaturen und fünf verschiedenen Lichtmodi können Sie individuell anpassen, wie viel Licht Sie zum Lesen brauchen.

Die Leselampe von Gritin kostet bei Amazon gerade mal 13 Euro und besitzt einen 1200-mAh-Akku, der je nach Nutzung bis zu 80 Stunden durchhält. Danach können Sie ihn einfach per USB wieder aufladen. Den Hals der Lampe können Sie nach Belieben hin- und herschwenken, und es gibt sogar eine kleine Ladeanzeige. Was will man mehr?

Externes DVD-Laufwerk

Amicool

Wenn Ihr Laptop wie viele heutzutage kein DVD-Laufwerk besitzt, dann wird Ihnen dieses kleine Gerät sehr nützlich sein. Dieses externe DVD-Laufwerk von Amicool wird über USB-C (oder USB-A) an Ihren Laptop angeschlossen und bietet Ihnen das optische Laufwerk, das Sie manchmal benötigen.

Es kann DVDs und CDs problemlos lesen und brennen, sodass Sie Software installieren, Dateien kopieren, Daten sichern, Spiele spielen und vieles mehr können. Sie müssen nicht einmal Treiber installieren, da dieses Gerät Plug-and-Play-fähig ist. Normalerweise kostet es 28 Euro, aber oft ist es schon für etwa 20 Euro zu haben, was ein absolutes Schnäppchen ist.

Wiederaufladbare Handwärmer

Amazon / PC-WELT

Wenn es langsam wieder kälter wird, wünscht man sich oft nichts sehnlicher, als seine Hände etwas schneller aufwärmen zu können. Das geht natürlich auch mit Handschuhen oder einer Tasse Tee, doch diese Handwärmer für 20 Euro sind nicht nur wiederaufladbar, sondern halten Ihre Finger mit einer einzigen Ladung auch bis zu 24 Stunden lang warm.

Die beiden Gadgets verfügen über einen Temperatursensor-Chip, mit dem Sie eine von drei Temperaturen für eine präzise Steuerung auswählen können. Außerdem stehen verschiedene Farben zur Auswahl, wodurch sie sich auch bestens als Geschenk eignen.

Können Geräte keine Verbindung zum WLAN herstellen oder läuft die Datenübertragung plötzlich lediglich noch im Schneckentempo, ist die Ursache oftmals schwer zu bestimmen. Der Fehler kann an veralteten oder beschädigten Treibern liegen, an einem überlasteten oder falsch konfigurierten Router, an Störsignalen durch benachbarte Funknetze oder daran, dass der Client zu weit vom Router entfernt ist.

Um sich einen Überblick über den WLAN-Status zu verschaffen und damit diese Probleme zu lösen, bringt Windows ein spezielles Tool mit: Es liefert Ihnen in Sekundenschnelle eine Übersicht zu Ihrem Netzwerk. Hierzu benötigen Sie die Kommandozeile oder Powershell: Starten Sie das gewünschte Eingabeprogramm, indem Sie in der Taskleiste in das Suchfeld Eingabeaufforderung oder Power shell eingeben.

Achten Sie darauf, dass der Treffer markiert ist und klicken Sie dann auf der rechten Seite auf „Als Administrator ausführen“. In der Eingabeaufforderung tippen Sie den Befehl netsh wlan show wlanreport ein und bestätigen mit Enter. Windows erzeugt nun den WLAN-Bericht und speichert ihn in der Datei „wlan-report-latest.html“ in dem Ordner „C:\ProgramData\Microsoft\Windows\WlanReport“.

Foundry

Am besten markieren Sie diesen Pfad direkt in der Eingabeaufforderung mit der Maus und übernehmen ihn mit Strg-C in die Zwischenablage. Öffnen Sie danach das Suchfeld in der Taskleiste, kopieren Sie den Pfad mit Strg-V hinein und bestätigen Sie mittels Enter. Windows ruft nun Ihren Standardbrowser auf und lädt die HTML-Datei des Berichts. Falls das nicht funktioniert, steuern Sie den Ordner über den Explorer an.

Allerdings ist das Verzeichnis in den Standardeinstellungen versteckt – Sie müssen es zunächst über die Einstellungen des Explorers sichtbar machen. Klicken Sie anschließend doppelt auf die HTML-Datei, um sie im Browser zu öffnen. Im Bericht sehen Sie ganz oben eine Übersicht der WLAN-Ereignisse der letzten 48 Stunden. Sie können über einzelne Verbindungen mit der Maus fahren, um Details einzusehen.

Die Ereignisse sind mit farbigen Punkten und Buchstaben gekennzeichnet: Ein schwarzes X auf rotem Grund steht beispielsweise für einen Fehler, N zeigt an, dass die Verbindung zu einem WLAN unterbrochen wurde. Weiter unten finden Sie bei „Report Info“ das Datum, an dem der Bericht erzeugt wurde, sowie die Berichtsdauer.

Foundry

Darunter folgt die „General System Info“, die Details zur Hardware, zum Bios und zur Windows-Version verrät. Diese Daten können beispielsweise bei Kompatibilitätsproblemen helfen. Der Abschnitt „User Info“ nennt einige grundlegende Benutzerdaten:

Darunter finden Sie bei „Network Adapters“ die installierten Netzwerkadapter, und zwar sowohl den oder die Hardwareadapter sowie Softwareadapter, beispielsweise für eine VPN-Verbindung oder für Bluetooth und virtuelle Adapter. Bei „Script Output“ beginnt die Anzeige der Ausgabebildschirme von einigen Troubleshooting-Tools in Windows.

So liefert der Befehl ipconfig /all zum Beispiel Angaben zur aktuellen Netzwerkkonfiguration sämtlicher Adapter. Das Kommando netsh wlan show all ermittelt Daten zu den installierten Netzwerktreibern, Details zu Ihrem WLAN und den in der Vergangenheit genutzten Access Points.

Foundry

Darüber hinaus führt Windows für den Bericht den Befehl certutil aus, der Ihnen weitere Einzelheiten über die verschiedenen WLAN-Profile präsentiert. Weiter unten folgt im Bereich „Summary“ ein Überblick über die erfolgreichen und die gescheiterten WLAN-Verbindungen. Dort nennt der Bericht auch die Gründe, warum beispielsweise der Kontakt zu einem WLAN verlorengegangen ist.

Diese Informationen sind oft besonders hilfreich, wenn es um die Fehlersuche im Netzwerk geht. Ganz am Schluss des Berichts steht der Abschnitt „Wireless Sessions“: Dort sind den WLAN-Adaptern unter anderem Informationen zur Verbindungsmethode und der SSID des WLAN zugeordnet. Des Weiteren stehen an dieser Stelle die Event-IDs und Beschreibungen der Ereignisse beim Aufbau der Verbindung.

Auch daraus lassen sich Schlussfolgerungen für die Lösung von Verbindungsproblemen ziehen.

Lesetipp: Die besten Tools für WLAN & Heimnetz

The post Claude Cowork SharedRoot Sandbox Escape Exposes Mac Files and Cloud Credentials appeared first on Cyber Security News.

Full Changelog: desktop-v0.0.3...desktop-v0.0.4

In our sample game we look at playing as Austria and aiming for a Diplomatic Victory. And our focus is on puppeting City-States, but I misunderstood and instead of making a Diplomatic Victory easier, it makes it harder. I still managed to get my Diplomatic Victory, but a Science or Domination Victory would definitely have been easier in this scenario.

Playing Civilization V, Part 14

Now I am at turn 340, I just puppeted another City-State, and I have one more on the way. I have sent a large number of military units, both land and sea, to the City-States that are on Japan’s border. If he tries anything now he will likely regret it. Now I am starting to build things I had not bothered with before, like Granaries and Amphitheaters. I got a couple of Great Engineers, and used them to rush build Wonders. I am nearly finished puppeting all of the City-States, and my Happiness and Income are both quite healthy. I am in such good shape I started to build the World’s Fair, which I initally proposed then ignored.

At this point I only have one more City-State to puppet, then I will have puppeted every City-State in the game. So it is time to put my large income to use in other ways by giving gifts to the other players. I may want to get a few more votes on my side to get over the top in the World Leader vote when it happens. On turn 357 I completed the puppeting of all of the City-States in the game. Meanwhile, I am building up my Science and building Wonders as they become available. I didn’t build any in the early game because I had other priorities, but now I have a strong military, high income, and no other pressing needs. My score on the Leader Board is now double that of my nearest competitor which is still Japan. And their denunciation me of just expired with them taking no action.

I used a Great Engineer to rush build the Porcelain Tower, earning me another Great Scientist, which I then used to build another Academy. At this point it is mostly a slog to the finish. Since I was so dominant and so wealthy I could afford to pursue a couple of other options just in case. One was a Science victory, which looked like a possibility, though it would be close. I had to be very focused in my Science Research. The other option was a Culture victory, and I had dominated two other empires culturally without half trying, and I was generating Great Artists, Great Musicians, and Great Writers pretty rapidly. So I built Museums, then Archeologists, and grabbed every artifact I find to stuff into the Museums. But the final Victory came when I researched Globalization. This tech allows you to get an extra vote in a World Council for every Spy you send to another empire’s capital and designate as an Ambassador. I immediately sent my spies out (they had previously been in my cities doing counter-espionage since I had a tech lead). And a few turns later a vote for World Leader came up and I won.

This was my first time using Maria Theresa of Austria as my leader, and it was fun, but in the end puppeting all of the City-Staters actually made it harder to win a Diplomatic victory. In other games I have played, every City-State that was an ally was an extra vote in the World Council, and I assumed that making them puppets would mean I would get that many votes. But that didn’t happen. Of course, if I had read more carefully in the Civilization Wiki I would have realized this, because it says there very clearly that Austria is one of the worst Empires to pick if you are going for a Diplomatic victory. So the fact that I managed it anyway is nice. I think I actually could have done a Science victory as I had my Spaceship half-built when I won the Diplomatic Victory. But I hope this analysis of how I actually played this game will be helpful to someone else.

Links

• https://www.palain.com/gaming/civilization-v/playing-civilization-v-part-14/

Provide feedback on this episode.

The company announced that GPT-Live now powers the ChatGPT desktop application on macOS and Windows, integrating directly with agentic systems like Codex and ChatGPT Work (which are separate experiences available in the ChatGPT desktop app).

When OpenAI initially launched GPT-Live on July 8, 2026, it introduced a continuous audio model capable of listening and speaking simultaneously—eliminating rigid turn-taking while delegating complex reasoning to background models like GPT-5.5.

Today's release expands that conversational layer to technical tasks, enabling software engineers to orchestrate multi-threaded coding jobs, review pull requests, and debug applications using natural voice commands.

As such, it could usher in a new era of "hands free" software development and even live, in-person group coding parties for Codex's more than 5 million weekly active users. Codex, of course, is the name given to OpenAI's models and harness focused on coding, but which the company has this year expanded into a more general productivity platform. An OpenAI spokesperson told VentureBeat this is the first time voice activation has been included natively with Codex on the desktop.

OpenAI posted a promotional video showing some of its employees, Codex developer experience engineer Jason Liu and Codex technical staffer Guinness Chen, speaking to the same ChatGPT desktop app session in the same room, each issuing different instructions and conversing with the same model.

New capabilities unlocked

At its core, this integration relies on decoupling the real-time voice layer from the underlying execution engines.

While GPT-Live maintains fluid conversation—inserting natural verbal acknowledgments like "got it" without interrupting the user—it passes heavy computational workloads to background reasoning models.

On macOS, the desktop application incorporates "Appshots" and screen context features, allowing ChatGPT Voice to analyze the frontmost window alongside local files, codebase structures, and active plugins.

This architecture creates a pair-programming dynamic where developers talk through problems conversationally while agents execute tasks asynchronously.

Rather than manually stopping coding sessions to type detailed instructions or switch windows, developers direct the system hands-free.

The full-duplex engine dynamically decides when to speak, pause, or invoke tools, maintaining conversational state even as background agents process complex code modifications.

Directing coding and complex builds with your voice alone

The central operational capability in this update centers on multi-task execution across Codex and ChatGPT Work environments.

Software engineers can initiate multiple concurrent task threads from a single spoken prompt. For instance, a developer preparing to ship a feature can instruct the system to investigate an open authentication bug, review a pending API migration pull request, and generate missing unit tests simultaneously.

The desktop application coordinates these actions across disparate contexts, tracing issues through Slack conversations, GitHub repositories, and local codebases.

Developers can also verbally convert design mockups into working code, splitting tasks across frontend, backend, and testing layers.

With support for multi-folder projects (build 26.715) and remote execution via iOS, engineers can check task progress, answer agent prompts, and redirect active jobs without switching applications or managing individual processes line by line.

Proprietary license

OpenAI’s voice-enabled desktop release operates under a proprietary, commercial enterprise model. Access is restricted to paid subscribers across Plus, Pro, Business, Enterprise, and Education plans.

For individual developers and corporate engineering departments, this commercial structure means the model weights, voice processing pipelines, and agent state architectures remain fully closed.

Organizations cannot modify or self-host the underlying systems. Furthermore, tasks initiated via ChatGPT Voice consume standard usage allocations directly from existing Codex and ChatGPT Work plan quotas, treating voice-triggered actions identically to standard agentic workloads.

Community reactions

Developer communities immediately noted the implications of bringing continuous full-duplex voice to autonomous coding workflows.

Reacting to the build 26.715 release announcement—which details voice integration and multi-folder project support—AI Insider journalist @ChrisGPT noted on X: "Today OpenAI will release voice and remote guidance for codex ! One step closer to personal AGI".

Early technical feedback highlights widespread enthusiasm for orchestrating complex agentic tasks hands-free, particularly when stepping away from the workstation or managing build pipelines remotely.