Google Chrome

OpenAI Rolls Out ChatGPT Integration with Google Chrome for Direct Tab Interaction and Task Automation

OpenAI has introduced a deeper integration between ChatGPT and Google Chrome that allows the AI assistant to access content from open tabs and execute user-directed actions directly within the browser. Home users and corporations can now leverage the tool for tasks such as form filling, file downloads, message sending, and organizing multiple tabs without manually copying information into the chat. The update enables complex workflows, including comparing products across several pages by characteristics, delivery times, and return policies, or analyzing tariffs from multiple services to identify the best match. A sidebar mode in Chrome lets users discuss articles, generate report summaries, or draft emails while staying on the relevant page. Combined with conversation history and connected plugins, the system supports advanced scenarios like extracting receipts from Gmail and transferring data into expense reimbursement forms. OpenAI demonstrated examples where the assistant completes registration forms but pauses before final submission, marking a shift from instructional guidance to direct task execution in active tabs.

Google Chrome Update Patches 37 Vulnerabilities Including Seven Critical Flaws

Google has released a security update for its Chrome browser that addresses 37 vulnerabilities across Windows, macOS, and Linux platforms. Seven of the issues are rated Critical, the highest severity level, while 29 are rated High and one is rated Medium. The update brings Chrome to versions 155.0.8059.80 on Windows and macOS and 155.0.8059.79 on Linux and macOS. Among the critical fixes is a buffer overflow in the ANGLE graphics component tracked as CVE-2026-110152, plus six Use After Free flaws affecting Browser, PDF, Network, Core, SVG, and Media components. The High-severity issues primarily involve Use After Free problems in V8, WebRTC, PDF, DOM, and Media. The single Medium issue is also included in the advisory.

Merkle Tree Certificates Proposed to Enable Lightweight Post-Quantum HTTPS in Chrome

Google Chrome developers, together with industry partners and the IETF PLANTS working group, are introducing Merkle Tree Certificates (MTC) as the first HTTPS change designed to address performance challenges of post-quantum cryptography. The new format replaces parts of traditional X.509 certificate chains with compact inclusion proofs inside a Merkle tree whose root is signed by a certificate authority. This approach significantly reduces the size of authentication data exchanged during TLS handshakes while preserving strong post-quantum security properties. MTC also enforces Certificate Transparency by design, making it impossible to issue a public certificate without recording it in a publicly verifiable log. Performance evaluations are currently underway with Cloudflare, and initial public MTC logs operated by experienced CT log providers are planned for early 2027. A dedicated post-quantum Chrome Root Store supporting only MTC is scheduled for the third quarter of 2027 and will run in parallel with the existing root store.

Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption

Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.

Google Patches Actively Exploited V8 Zero-Day in Chrome (CVE-2026-85046)

Google has released an urgent update for Chrome to address CVE-2026-85046, a high-severity zero-day vulnerability in the V8 JavaScript and WebAssembly engine that is being actively exploited in the wild. The flaw is a type confusion issue tied to the Maglev compiler and optimizations around Array.prototype.sort, which can lead to arbitrary memory read and write primitives inside the JavaScript heap. Successful exploitation allows a remote attacker to execute arbitrary code within the browser sandbox after a victim visits a specially crafted HTML page, a technique commonly seen in malvertising and compromised-site campaigns. The fix is included in Chrome 152.0.7977.82 and later for Windows, macOS, and Linux, and the update also resolves a total of twelve vulnerabilities. The vulnerability was reported on 4 August 2026 by researcher Salvatore Gulizia, known as Serotav, who received a $1,000 reward. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi will require corresponding updates from their respective vendors.

Google Chrome Tests Visible Global Privacy Control Toggle in Canary

Google is testing a new visible toggle for Global Privacy Control in Chrome Canary that lets users send a standardized request asking websites not to sell or share their personal data and not to use it for targeted advertising. When enabled, the browser adds the Sec-GPC: 1 header to web requests and exposes the setting via navigator.globalPrivacyControl. In regions with supporting laws such as California's CCPA, the signal can serve as a formal opt-out from data sales. The feature currently appears primarily on Android, with experimental flags available on Windows, macOS, Linux, and ChromeOS, though the desktop interface remains incomplete. Two separate flags are required—one to show the toggle and another to actually transmit the signal—because enabling only the UI does not send Sec-GPC: 1. The mechanism is not a guaranteed enforcement tool; websites decide how to respond, and effectiveness depends on legal frameworks and site compliance. The feature is absent from the stable Chrome release and may still change before wider rollout.

Browser Privacy Ranking 2026: Tor Browser Leads at 9.5 While Chrome and Yandex Rank Lowest

SecurityLab.ru has published a detailed 2026 browser privacy ranking that evaluates major browsers across six criteria including initial network behavior, site isolation, fingerprint resistance, funding model, configurability, and code auditability. Tor Browser scores highest at 9.5 for its comprehensive protections including unified fingerprinting and layered JavaScript controls, followed by Mullvad Browser at 9.0 and LibreWolf at 8.5. Brave earns 7.5 for built-in tracker blocking but faces criticism over default telemetry and cryptocurrency features. Firefox scores 6.0 out of the box yet reaches 8.5 after extensive configuration, while Google Chrome, Microsoft Edge, Opera, and Yandex Browser occupy the bottom positions due to persistent tracking mechanisms and closed-source components. The report also highlights the Local Mess localhost tracking technique used by Meta and Yandex that bypassed browser isolation entirely.

Ruthenium: Custom Chromium Build for Android Adds Russian Trusted Root CA Support

A developer has released Ruthenium, a modified Chromium browser for Android that embeds the Russian Trusted Root CA certificate issued by the Ministry of Digital Development. The build restricts trust to .ru and .рф domains only, avoiding changes to the system-wide Android certificate store. The project patches four Chromium source files to include the root with DNS constraints via CertWithConstraints, disables Google sign-in by default, and removes XR-related code for successful compilation. Ruthenium uses the official Chromium TLS verification logic without introducing a custom verifier. The APK is distributed with SHA-256 checksums, build metadata, and reproducible release tags tied to the exact Chromium revision and certificate digest. Users can install it alongside stock Chrome and use it selectively for Russian government and banking sites that rely on the state root.