← Back to Blog

Security Briefing, April 15 2026: Patch Tuesday, Malicious Chrome Extensions, and Access Drift

Today’s security briefing tracks three concrete stories shaping the day: Microsoft’s April Patch Tuesday, a campaign of 100+ malicious Chrome extensions stealing tokens and sessions, and access-governance failures at Kraken and McGraw-Hill.

---

---

1. Microsoft’s Patch Tuesday is big, and one SharePoint zero-day was already exploited

Microsoft released fixes for 167 vulnerabilities in April 2026, including two zero-days. One of them, a SharePoint Server spoofing vulnerability, was already exploited in the wild. Microsoft also shipped fixes for critical Office remote-code-execution bugs and a Defender privilege-escalation issue that updates through the antimalware platform.

• Patch internet-facing SharePoint and Office-heavy environments first.
• Do not mark the cycle complete until exceptions, staging copies, and admin nodes are reconciled.
• Force a post-patch exposure check instead of trusting ticket closure.

---

2. More than 100 Chrome extensions turned the browser into an identity theft surface

Researchers at Socket linked over 100 malicious Chrome Web Store extensions to one coordinated campaign. The extensions reportedly stole Google OAuth2 bearer tokens, harvested account data, hijacked Telegram Web sessions, and fetched remote commands in the background. That is not “just a browser add-on” risk. It is identity, session, and trust abuse inside the user’s already authenticated environment.

• Audit installed extensions on managed devices today, not next week.
• Revoke sessions and tokens when extension abuse is suspected.
• Treat the browser as part of the identity control plane.

---

3. Kraken and McGraw-Hill show why insider and third-party access still breaks clean stories

Kraken said an extortion group is threatening to release videos of internal systems after improper access by support employees exposed limited customer-support data affecting roughly 2,000 accounts. McGraw-Hill separately said attackers accessed limited internal data through a Salesforce-hosted webpage misconfiguration, while ShinyHunters claimed a much larger haul. The exact blast radius differs, but the pattern is the same: support workflows and hosted business systems often keep more trust than teams think.

• Time-bound support and contractor access by default.
• Review hosted pages, support tooling, and vendor-admin paths during incident response.
• Assume “limited data exposure” can still become a reputation and extortion problem.

---

What security teams should do today

1. Prioritize exploited and externally reachable Microsoft assets first.
2. Run an extension sweep and session revocation plan for high-risk users.
3. Audit support, supplier, and SaaS admin access with owners and expiry dates.
4. Use one executive update that covers patches, browser identity abuse, and third-party access in the same risk picture.

---

Bottom line: Today’s stories all point to the same operational truth. Attackers are winning in the gap between nominal control and verified control, between “patched” and actually fixed, between “logged in” and truly trusted, between “temporary access” and lingering privilege.