Often, users don’t even need an active internet connection if the payload is self-contained. The new technique sees attackers embed base64-encoded HTML in the QR code itself.

The vulnerability, tracked as CVE-2025-54136 (CVSS score: 7.2), has been codenamed MCPoison by Check Point Research, owing to ...