<p><strong>TLDR:</strong> A patched Firefox vulnerability let websites fingerprint users across origins using IndexedDB ordering, including through Tor Browser’s “New Identity” reset. Separately, a Vercel security breach was traced back to a developer downloading Roblox cheat scripts. Chrome is getting agentic AI features baked in at the enterprise level. The React ecosystem keeps moving with TypeScript 7.0 beta and a wave of library updates.</p>
<hr>
<h2>Firefox IndexedDB fingerprinting bug (CVE-2026-6770)</h2>
<p>Researchers found that the <code>databases()</code> API in Firefox returned entries in an order derived from a process-wide hash table, not scoped per origin. That meant unrelated sites could observe the same permutation and link user activity across origins without cookies. With 16 controlled database names, you get roughly 44 bits of entropy — enough to uniquely identify a browser instance. Worse, it survived Tor Browser’s “New Identity” reset, which is supposed to be the whole point of that feature. Mozilla patched it in Firefox 150 and ESR 140.10.0. If you’re building anything privacy-sensitive, this is a good reminder that browser APIs can leak identity in non-obvious ways.</p>
<h2>Vercel breach traced to Roblox cheat scripts</h2>
<p>A <a href="http://context.ai" target="_blank" rel="noopener nofollow">context.ai</a> employee downloaded Roblox cheat scripts on a company laptop. The scripts contained Lumastealer malware, which harvested session cookies and credentials. Attackers pivoted through <a href="http://context.ai" target="_blank" rel="noopener nofollow">context.ai</a>’s AWS environment, found stored OAuth tokens, and eventually reached a Vercel employee’s Google Workspace account. From there they accessed Vercel’s internal systems and non-sensitive environment variables across user projects. The attackers, claiming to be ShinyHunters, demanded $2 million. Vercel says Next.js and Turbopack were unaffected and has made environment variables sensitive by default. If you’re on Vercel, rotate your non-sensitive env vars now.</p>
<h2>North Korean fake interview campaign spreads through victim repos</h2>
<p>Void Dokkaebi (also tracked as Famous Chollima) has added a new wrinkle to its fake job interview attacks: after compromising a developer’s machine via a malicious <code>.vscode/tasks.json</code> in an interview repo, it deploys a tool that injects obfuscated JavaScript into the victim’s own repositories with backdated commits. Anyone who clones those repos gets the same payload. By March 2026, researchers had identified over 750 infected repositories. Command-and-control infrastructure runs on Tron, Aptos, and Binance Smart Chain, making takedowns harder. Practical steps: run interview code in an isolated VM, add <code>.vscode/</code> to your <code>.gitignore</code>, and watch for outbound connections to blockchain APIs from dev workstations.</p>
<h2>Chrome becomes an agentic enterprise platform at $6/user/month</h2>
<p>Google announced at Cloud Next 2026 that Chrome is getting Auto Browse (autonomous multi-step task handling), Chrome Skills (saveable AI workflows), and a persistent side panel integrated with Gmail, Calendar, and Drive. Chrome Enterprise Premium at $6/user/month adds real-time data loss prevention, data masking, and AI governance controls. Google claims a 50% reduction in unauthorized AI data transfers. This is a direct shot at Island (valued at $4.85B) and Microsoft Edge for Business. Whether the 67.7% browser market share actually translates to enterprise stickiness is the real question.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Firefox 150 release:</strong> Adds light-dark() image support, color-mix() updates, and media-based pseudo-classes, alongside the IndexedDB fingerprinting fix.</li>
<li><strong>TypeScript 7.0 beta:</strong> The Go rewrite is real — roughly 10x faster, covered in this week’s React ecosystem roundup alongside Rspack 2.0 with experimental RSC support.</li>
<li><strong>GitHub Copilot BYoK:</strong> Business and Enterprise users in VS Code can now bring their own API keys from Anthropic, OpenAI, Gemini, OpenRouter, Azure, Ollama, and Foundry Local. Usage bills directly to the provider and doesn’t count against Copilot quotas.</li>
<li><strong>Atomic Mail + Gemini Nano:</strong> First email client to run AI features entirely on-device via Chrome’s built-in Gemini Nano, with no server calls. Toggle it under Privacy Center &gt; Security Options.</li>
<li><strong>Shadcn radio button critique:</strong> A Frontend Masters post found that shadcn’s radio button expands a single HTML input into 45 lines across three imports, built on a 215-line RadixUI primitive, with no measurable accessibility improvement over the native element.</li>
<li><strong>ES2025 features worth using:</strong> Native Set methods, Promise.withResolvers(), lazy Iterator helpers, RegExp.escape(), and the using/await using syntax for resource cleanup are all production-ready on TypeScript 5.6+ and Node.js 22+.</li>
<li><strong>CSS @starting-style:</strong> A walkthrough covers using @starting-style for entry/exit animations without JavaScript class toggling, including animating the display property with allow-discrete.</li>
<li><strong>Container queries with ch units:</strong> Using 90ch as a breakpoint for a three-column layout means each column is roughly 30 characters wide, aligning with readable line-length guidelines and adapting automatically to font size changes.</li>
<li><strong>Red Hat strangler fig migration:</strong> A nine-month frontend rewrite of the Red Hat Hybrid Cloud Console access management UI used behavioral tests written against V1 before any migration work began, ending with 959 browser tests and 207 E2E tests.</li>
<li><strong>Penpot:</strong> Open-source Figma alternative that outputs real CSS from its inspect view, self-hostable via Docker Compose, and worth a look for teams that want to avoid vendor lock-in.</li>
<li><strong>Vercel breach context:</strong> Affected users should rotate all non-sensitive environment variables; Vercel has changed the default so env vars are now treated as sensitive.</li>
<li><strong>WASM debugging in Chrome DevTools:</strong> For WASM GC type debugging specifically, the built-in debugger with breakpoints and exception pausing is significantly more useful than printf-style approaches given how opaque GC references are to the host.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A roundup of notable developer news: a patched Firefox bug (CVE-2026-6770) allowed cross-origin fingerprinting via IndexedDB ordering with ~44 bits of entropy, surviving Tor Browser's 'New Identity' reset — fixed in Firefox 150. A Vercel security breach was traced to a developer downloading Roblox cheat scripts containing Lumastealer malware, which eventually gave attackers access to Vercel's internal systems; users should rotate env vars. North Korean threat group Void Dokkaebi is injecting backdoored JavaScript into victim repositories via malicious VS Code task files in fake interview repos. Chrome is gaining agentic AI enterprise features at $6/user/month. Also covered: TypeScript 7.0 beta (Go rewrite, ~10x faster), GitHub Copilot BYoK support, ES2025 production-ready features, CSS @starting-style animations, and an open-source Figma alternative (Penpot).

Firefox IndexedDB fingerprinting bug lands, Vercel breach traced to Roblox malware