Chrome V8 code exec, HyperDX broken auth, and a sneaky MongoDB SQL injection

A memory read bug in Chrome's V8 JavaScript engine lets an attacker run code inside the browser sandbox by getting a user to visit a malicious page. Exploitation still requires a sandbox escape for full system compromise, but in-sandbox code execution is a serious stepping stone. No reports of exploitation in the wild yet, but browser bugs like this tend to get weaponized fast.

Affected estate

Anyone managing Chrome deployments, whether on desktops, kiosks, or Chromium-based browsers like Edge

How to check

Open chrome://version or query your endpoint management tool for Chrome version. Anything below 151.0.7922.72 is affected.

Included because

CVSS 8.8; code execution via crafted web page; browser is internet-facing; extremely common product

Action

Push Chrome 151.0.7922.72 or later via your update policy or management console. Restart browsers to complete the update.

Why it matters

A malicious web page can run attacker code inside the browser sandbox with no user interaction beyond visiting the page.

HyperDX through 1.10.1 doesn't check roles on its team management API endpoints. Any authenticated team member, even the lowest-privilege one, can delete other members (including owners), rotate API keys, and rename teams. If you're using HyperDX for observability, a compromised or rogue low-privilege account can lock everyone else out and rotate your ingestion keys.

Affected estate

Teams running self-hosted HyperDX 1.10.1 or earlier for observability and log management

How to check

Check your HyperDX deployment version in the admin UI or container image tag. Versions through 1.10.1 are affected.

Included because

broken access control; authenticated low-privilege user can escalate; API key rotation risk

Action

Upgrade HyperDX to a patched version. If no patch exists yet, restrict API access to trusted networks and audit current team members and API keys.

Why it matters

Any team member can delete owners, rotate API keys, and effectively take over or disrupt your observability platform.

The MongoDB Connector for BI drops MongoDB object names (collection, field, index names) into SQL DDL output without escaping quote delimiters. If someone with write access to a sampled MongoDB collection creates an object with a specially crafted name, the generated SQL will contain injected statements. Those statements run with whatever privileges the session has when an operator or automation tool replays the DDL against a SQL server. This is a second-order SQL injection: the attacker poisons the data, then the damage happens later when someone trusts the generated output.

Affected estate

Teams using MongoDB Connector for BI (mongosqld) where MongoDB collection write access is shared with less-trusted users

How to check

Check the installed version of mongosqld. Review whether any automation replays SHOW CREATE output against a SQL database.

Included because

CVSS 8.0; second-order SQL injection; requires write access to MongoDB but can escalate to SQL server privileges

Action

Upgrade the MongoDB Connector for BI to the latest patched release. Audit any workflows that replay generated DDL.

Why it matters

An attacker who can write to a sampled MongoDB collection can inject SQL that runs with the privileges of your downstream SQL session.

The Synergis Softwire installation folder has broken access controls, letting local users tamper with it. This affects Genetec Streamvault all-in-one appliances (SV-100E and SV-300E series) and Synergis Softwire installed on Windows servers. A local attacker could modify or replace binaries to escalate privileges or disrupt access control operations.

Affected estate

Physical security teams running Genetec Streamvault SV-100E or SV-300E appliances, or Synergis Softwire on Windows servers

How to check

Check the Synergis Softwire version in the Genetec Config Tool or Programs and Features. Review NTFS permissions on the Synergis Softwire installation directory for overly permissive access.

Included because

CVSS 7.9; local privilege escalation; physical security system, high operational impact if compromised

Action

Apply the vendor patch from Genetec. Immediately tighten NTFS permissions on the installation folder so only admins have write access.

Why it matters

A local user can tamper with the access control software binaries, potentially escalating privileges or disabling physical security controls.