SWIFT Banking & Government Middleware Enables RCE

Bay Area Labs researchers found a critical drive-by RCE flaw (CVE-2026-18397, CVSS 9.4) in Thales SConnect middleware, which connects hardware MFA tokens to sensitive systems. The extension, with over a million Chrome users, is used to access the SWIFT banking network, Qatar’s Tawtheeq identity platform, and Sweden’s Skatteverket — a malicious webpage alone could compromise an endpoint in seconds.