Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-05-10 · source-backed
OX Security weaponized CVE-2025-7656 (a patched Chromium flaw) against current versions of both IDEs, proving their Electron builds ship Chromium engines frozen since March 2025. At least 94 known CVEs have accumulated since. Cursor dismissed the report as "out of scope." Windsurf didn't respond. If you're building in either IDE, you're running a browser with 14 months of unpatched vulnerabilities. That's your entire dev environment.
Each link below shares sources, entities, or timing with this story.
OX Security criticizes Windsurf / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (OX Security criticizes Windsurf); both cover Cursor, CVEs, IDE, Windsurf; overlapping topics (cursor, cves, windsurf).
OX Security criticizes Cursor / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OX Security criticizes Cursor); both cover Cursor, CVE, CVEs, IDE; overlapping topics (cursor, cves).
OX Security criticizes MCP / Shared entities / Same source
Linked by a graph relationship (OX Security criticizes MCP); both cover Cursor, IDE, OX Security, Windsurf; cite the same source (OX Security).
OX Security criticizes Cursor / Shared entities / Earlier coverage
Linked by a graph relationship (OX Security criticizes Cursor); both cover Cursor, Electron, IDE, IDEs; earlier Cursor coverage from 2026-04-23.
OX Security criticizes Cursor / Shared entities / What happened next / Tension
Linked by a graph relationship (OX Security criticizes Cursor); both cover Cursor, Electron, IDE, IDEs; picks up the Cursor thread on 2026-05-14.
OX Security criticizes MCP / Shared entities / Earlier coverage
Linked by a graph relationship (OX Security criticizes MCP); both cover Cursor, CVE, March, Windsurf; earlier Cursor coverage from 2026-03-15.
OX Security criticizes MCP / Shared entities / Same source domain / What happened next
Linked by a graph relationship (OX Security criticizes MCP); both cover CVE, CVEs, OX Security; reported by the same outlet (ox.security).
OX Security criticizes Windsurf / Shared entities / Shared topic / What happened next
Linked by a graph relationship (OX Security criticizes Windsurf); both cover CVE, CVEs, Windsurf; overlapping topics (cves, windsurf).