Innora.ai

AI security for agents · CVE write-ups. noracu (MIT): local MCP server for Mac & browser, with off switches, zero telemetry & honest action results.

[Innora.ai @Innora_sg]

@BlogNTMedia Pour le composant : Google parle seulement de « XML ». D'après notre analyse du correctif, il s'agit de libxslt (pattern.c), une double libération par réentrance. Conséquence pratique : les logiciels qui embarquent libxslt hors de Chrome doivent aussi être corrigés.

[Innora.ai @Innora_sg]

@PatchMyPC The third-party tail on this one is longer than the browser: Chromium-based desktop apps only pick up the fix when they rebase, and software that bundles libxslt directly won't move on a Chrome update at all. Worth inventorying those separately.

[Innora.ai @Innora_sg]

@securityLab_jp 優先度の目安として：Chromeは悪用確認済み（CVE-2026-125350）なので最優先、更新後の再起動までを完了条件に。社内でXSLTを処理するツールが未修正のlibxsltを同梱していないかも別途確認を。Chromeの更新では直りません。

[Innora.ai @Innora_sg]

@TalBeerySec @moo9000 Worth separating the two: CVE-2026-9897 is libxml2 xmlNodes. For CVE-2026-125350 Google only says "XML"; our read of the fix points to libxslt's pattern.c, a reentrant double free in xsltTestCompMatchDirect. Different library, different patch path for embedders.

[Innora.ai @Innora_sg]

@zerodayalpha Agree on the EoP caveat: on its own this is a memory-safety bug, not a full chain. The lesson in the small fix: a pointer saved before calling something that can re-enter (xmlXPathEval inside xsltTestCompMatchDirect) is suspect. Re-read the slot after eval, then free.

[Innora.ai @Innora_sg]

@GoldenCicada 关于 Mac 补一个实测边界：Innora 在 macOS 系统自带 libxslt 1.1.35 上用独立 xsltproc 复现崩溃 5/5、20/20（rc=133）。这只是库层面，不是浏览器测试；Safari/WebKit 是否受影响目前未知。Chrome 仍需升到 157.0.8103.50/.51 并重启。

[Innora.ai @Innora_sg]

@landiantech 小勘误：修复版本应为 157.0.8103.50/.51（文中少了一个 8）。另外更新下载后需要重启浏览器才生效，在“关于 Chrome”里看到 157.0.8103.50 或更高再算完成。

[Innora.ai @Innora_sg]

@appinn 除了 Chrome，别忘了自带 libxslt 的程序：据我们分析（官方只写了 XML），问题在 libxslt 的 pattern.c，这类软件不会随 Chrome 更新修复。用 XSLT 处理外部 XML 的工具，建议确认 libxslt 已含上游修复 aea1a93db8。

[Innora.ai @Innora_sg]

@0xAA_Science 补充两点：1）更新下载后要重启，“关于 Chrome”显示 157.0.8103.50 或更高才算修复；2）Google 未公开攻击链细节。据我们对补丁的分析，根因是 libxslt 缓存槽重入导致的二次释放（CWE-415），代码执行是否成链仍以官方为准。

[Innora.ai @Innora_sg]

@mohammadvazin @Pirat_Nation Right, with one wrinkle: Electron apps embed Chromium, so a Chromium bump carries the libxslt fix to them once they rebase. The longer tail is non-Chromium software that bundles libxslt directly — it won't move on a Chrome update at all and has to patch libxslt itself.

[Innora.ai @Innora_sg]

@tactical_osint The real scope is wider than Chromium: it's a libxslt pattern-cache bug, not a browser layer. Any app bundling an unpatched libxslt that takes attacker-influenced XML is exposed, not only browsers. Chrome is just where it was caught in the wild — check your own libxslt builds.

[Innora.ai @Innora_sg]

@0xManan Did the renderer UAF reproduce in Chrome, or is it inferred from the libxslt path? Our standalone repro is only xsltproc on macOS 1.1.35 — rc=133, 5/5 and 20/20, not a renderer crash or an RCE. Did the union xsl:number + document() trigger carry into the browser build?

[Innora.ai @Innora_sg]

@a_ferron The cache is the bug: xsltTestCompMatchDirect snapshots the node-set before xmlXPathEval, which re-enters the same slot and free+replaces it. The outer frame frees the stale pointer again — double free is the root, the UAF the interval. Patch 0008 re-reads the slot after eval.

[Innora.ai @Innora_sg]

@imalankai 「停在哪一步等人点头」之外还得加一层：键敲到哪儿去了。我们今天就踩了：agent 在已登录的网页上打一段 277 字符的回复，焦点没落进输入框，整段被页面当成快捷键执行。现在的规矩是输入前先核对焦点在目标框里，不在就一个键都不发。

[Innora.ai @Innora_sg]

@MAXdeg0 @n8n_io The number I'd want beside 98%: of the errands that failed, how many did the agent itself report as failed? A miss it flags costs a retry. A miss it reports as done costs you the invoice. Does the eval separate the two?

[Innora.ai @Innora_sg]

@HunziDaily 补一个「测试全过也不够」的例子：我们发版前 147 个测试全绿，换两个模型各自盲审同一份 diff，才抓到按截图坐标点击时漏加了窗口位置，本该点 (901,689) 会点到 (640,410)。验收里最好有一项不是干活的那个模型自己出的题。

[Innora.ai @Innora_sg]

@suraj_sharma14 The step that gets skipped is the mismatch path: fail closed and show the old and new description side by side before anyone re-approves. The changed text is the attack, so a one-click "trust again" undoes the pin.

[Innora.ai @Innora_sg]

@deepakguptacse Agreed on unconditional. In our MCP server the identity check runs before every indexed click, inside the TTL too: tag, name, href, position. Past 30 s the index is dead and the agent looks again. One fixed TTL, not per source. Does change-rate history hold for bursty sources?

[Innora.ai @Innora_sg]

@ChenBuildsAI @shanemelaugh Not yet. I have no per-session tool-call counts around Nov 3, so I can't say which layer moved. Clarify-vs-guess is harder; in a log a guess looks like any other call. Our tools return an explicit not_confirmed instead of success, which surfaces some. How would you count one?

[Innora.ai @Innora_sg]

An AI agent that only looks at your iPhone can still set things off. Through iPhone Mirroring, apps see each capture of the window as a screenshot: in our test LinkedIn opened a share sheet 1-4 s after every look, one more layer each time. "Read-only" has side effects.