Threat Brief — 2026-07-13 — Mobile malware and library DoS spike

Executive summary: The most operationally relevant item today is a new RedHook Android malware variant that abuses Wireless ADB to gain shell-level privileges without a PC connection—worth flagging to any team managing Android fleets. On the vulnerability side, three newly disclosed CVEs in node-tar (DoS, crash, infinite-loop) collectively raise the risk of malicious archive handling across Node.js build and CI pipelines. The remaining CVEs (Edge spoofing, HTMLParser CPU-exhaustion) are lower-severity and currently informational.

Top items

• RedHook Android malware — Wireless ADB abuse for shell access
• What: New RedHook variant abuses Android Wireless Debugging (Wireless ADB) to gain shell-level privileges without requiring a USB/computer connection.
• Why it matters: Lowers the bar for device compromise on Android; anyone whose device has Wireless Debugging enabled is a broader target surface. Relevant to BYOD or managed-Android deployments.
• Actors/affected: RedHook (Android malware family).
• Source: bleepingcomputer

• node-tar — three CVEs in archive handling (CVE-2026-59871 / 59873 / 59874)
• What: Process crash via PAX numeric path type confusion; decompression/parse DoS via unlimited input; infinite loop from negative tar entry size during archive replace.
• Why it matters: node-tar is widely used in Node.js tooling and CI pipelines; maliciously crafted archives could crash processes or exhaust resources. Worth auditing dependency trees and pinning patched versions when available.
• Affected: node-tar npm package.
• Source: CVE-2026-59871, CVE-2026-59873, CVE-2026-59874

• Microsoft Edge (Chromium) spoofing — CVE-2026-45489
• What: Spoofing vulnerability in Chromium-based Edge; CWE metadata added (informational change only).
• Why it matters: Spoofing bugs can facilitate phishing or credential capture, but current disclosure is limited to an informational update—no PoC or patch details noted.
• Affected: Microsoft Edge (Chromium-based).
• Source: MSRC

• HTMLParser feed() CPU-exhaustion DoS — CVE-2026-15308
• What: Incremental HTMLParser feed() allows CPU exhaustion via repeated unterminated markup declarations.
• Why it matters: Relevant to services parsing untrusted HTML incrementally; a single malformed input could spin CPU. Confirm whether parsers in use are affected.
• Affected: HTMLParser library.
• Source: MSRC

Themes

Library/archive-parsing DoS cluster: Three of today's CVEs (node-tar ×2, HTMLParser ×1) are resource-exhaustion or crash conditions triggered by malformed/negative/underterminated input. A common takeaway: any service that ingests archives or parses untrusted markup should review input-size limits, timeout handling, and parser hardening—particularly in CI/build pipelines where node-tar is common.