Tag: chrome

Security researchers at Socket have uncovered a large impersonation and browser traffic redirection campaign in the Chrome Web Store.

According to a news post on the official website, the campaign uploaded 737 VPN extensions to the Chrome Web Store and managed to lure more than 75,000 users to installing them on their devices.

The extensions impersonated 66 legitimate privacy and VPN brands—such as NordVPN, Proton VPN, and Surfshark—to deceive users into downloading them.

Core Threat Behaviors

• Traffic Interception: Once activated, the extensions route the victim’s entire browser session through a SOCKS5 proxy controlled by a single threat actor. This places the attacker in a position to read and monitor all browser traffic.
• Subscription Fraud: The extensions funnel users toward a paid subscription tier that promises premium server locations (such as Japan, Canada, and Australia). However, Socket found that none of these premium servers actually exist.

Deceptive Tactics & Evasion

• DNS-over-HTTPS Evasion: The extensions use Cloudflare and Google’s DNS-over-HTTPS to silently resolve proxy IPs, preventing the victim’s machine from emitting plaintext DNS queries that security software might flag.
• Store Review Gaming: The developers submitted false justifications to Chrome Web Store reviewers and used post-approval code substitution to sneak in the malicious proxy behaviors.
• Hidden Domains: An internal developer manual accidentally left inside one of the extensions revealed explicit instructions to staff to never hardcode the actual domains into the extension, ensuring they stay hidden from automated scanners.

The campaign specifically targets Russian-speaking users who are trying to bypass internet censorship to access blocked services like YouTube, Instagram, and ChatGPT. By impersonating trusted anti-censorship tools, the attackers successfully tricked thousands of users into handing over full visibility of their web browsing activity to a threat actor based in Russia.

Back in May 2026, some users of Google’s Chrome web browser discovered a jump in used storage space on their devices. The culprit at the time was an AI model that the browser downloaded automatically to user devices for on-device artificial intelligence processing.

The main idea here is to allow some AI tasks to run locally only, meaning that no interaction with a Google server is needed to make use of the functionality. The whole download felt forced to some users, who had no say in the matter whatsoever.

Now, Google and also Microsoft have increased the local storage requirements for AI significantly. Instead of 4 gigabytes of free disk space, Google requires a whooping 20 gigabytes as the bare minimum.

Google says that the model is only downloaded if Chrome runs on a device with supported hardware capabilities, but fails to specify what that means.

The best way to check whether your device is eligible is to load chrome://settings/system in the browser’s address bar and check the “On-device AI” setting there.

If it is turned on, the device has the requirements apparently and there is a good chance that a gigabyte-sized AI model has been downloaded to the system.

The model is downloaded to this folder: %LOCALAPPDATA%\Google\Chrome\User Data\OptGuideOnDeviceModel

The AI file is not downloaded in all cases, even with the On-device AI feature enabled. I checked on a test system that had the toggle set to on but no such file on the local hard drive.

You can turn off the functionality, which has three consequences according to Google:

• Any AI model downloaded automatically to the local system is removed.
• Chrome won’t download AI models.
• Features that rely on the functionality won’t work.

The main features that are not available when you turn off local AI are:

• Help with writing or rephrasing text
• Warn you about scams
• Summarize web pages
• Organize your tabs

While local AI processing is without a doubt beneficial to privacy, companies like Google should consider giving their customers a clear choice before they start downloading gigabyte-sized files to their devices.

Mobile devices and web browsers support the sharing of the current location. This gives apps, websites and services access to a user’s location in the world. Ideally, to provide custom information, such as zooming to that location on a map, showing businesses nearby, providing directions, or loading specific information on a website.

While useful in that regard, location does reveal information about the user. The feature is usually locked behind a permission, but some apps may not start at all without it or block access to features.

Google announced on its official The Keyword blog that it is introducing approximate location sharing in Chrome. The feature lands in Chrome for Android first before it will also be introduced in the desktop versions of the browser.

Here is what it does: Google Chrome’s new Approximate Location Sharing feature enhances privacy by giving users a third option when websites request their whereabouts: sharing a general regional area rather than the exact coordinates. While users can still grant precise location access for tasks that genuinely need it—such as getting turn-by-turn navigation, placing a delivery order, or finding a nearby ATM—everyday browsing activities like checking local weather or reading regional news can now function perfectly well with just a neighborhood or city-level location.

In other words, websites and apps get information about a region a user is in and not the precise location. This new permission is intended for services that do not require accurate information and for users who do not want to share their exact location.

When a location prompt pops up on the mobile, users can now pick between “precise” and “approximate” and the usual options to “never allow”, “allow this time”, or “allow while visiting the site” options. Google says that the feature will land on desktop in Chrome in the coming months as well. For now, it is only available in Chrome for Android.

How useful is it for privacy? It can be used to share less-exact information about ones location. That is useful, especially for services that do not require it to function. If you want to get local news or weather, it does not really matter if the service that is providing the information knows the exact location or not. In that regard, it is a useful addition for users who share location but prefer it to be less exact whenever possible.

Google has issued an urgent security update for the Chrome desktop browser following the discovery of a high-severity vulnerability being actively exploited in the wild.

The update, which brings the Stable channel to version 145.0.7632.75 or 145.0.7632.76 for Windows and Mac, and 144.0.7559.75 for Linux, specifically addresses a “use after free” flaw within the browser’s CSS engine.

Identified as CVE-2026-2441, the bug was reported by security researcher Shaheen Fazim just days prior, prompting an accelerated rollout to protect users from potential attacks that leverage this exploit to compromise system memory.

Here are the key points from the update:

• New Versions: The Stable channel has been updated to 145.0.7632.75/76 for Windows and macOS, and 144.0.7559.75 for Linux.
• Zero-Day Patch: The update addresses CVE-2026-2441, a high-severity security flaw classified as a “Use after free” vulnerability in CSS.
• Active Threat: Google has confirmed that they are aware of an exploit for this specific vulnerability existing in the wild.
• Rapid Response: The bug was reported by researcher Shaheen Fazim on February 11, 2026, just two days before the release of this patch.
• Rollout: The update will continue to become available to all users over the coming days and weeks.

How to install the Chrome update

Most unmanaged Chrome installations should receive the update automatically. The browser is configured to install updates automatically by default. Since this does not happen immediately, it is recommended to run a manual check for updates to speed up the process.

Open Google Chrome and select Menu > Help > About Google Chrome to do so. The browser should begin downloading and installing the security update immediately.

Windows users may also run winget upgrade google.chrome.exe to install the update from the command line without opening Chrome at all.

Note that it is highly recommended to upgrade the browser, even if it is not the main browser on the system. In short, if the browser is installed, upgrade it to protect it from potential exploits.