# chrome security Published articles for chrome security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The multi-layered defenses that harden Chrome against abusive notifications DevFeed: [The multi-layered defenses that harden Chrome against abusive notifications]() Original publisher: [Read original article]() Author: Nidhi Davawala Published: 2026-08-11T17:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Chrome](), [Security](), [Android](), [Firebase](), [API](), [Networks]() Tags: [android](), [api](), [chrome](), [chrome-security](), [firebase](), [malware](), [none](), [safety-security](), [security]() ### AI overview Chrome describes a defense-in-depth system for reducing abusive web notifications. The approach combines automatic permission revocation, behavioral detection of coordinated abuse networks, Safe Browsing and Firebase Cloud Messaging collaboration, and server-side Push API throttling to limit deceptive or unwanted notifications. ### Source excerpt Image of a URL with a small window saying "Get notifications?" ## Stronger with every update: How we're making Chrome and the web safer in the AI Era DevFeed: [Stronger with every update: How we're making Chrome and the web safer in the AI Era]() Original publisher: [Read original article]() Author: Chrome Security Team Published: 2026-07-30T17:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Chrome](), [Security](), [Vulnerabilities](), [Artificial Intelligence](), [Large Language Model](), [Fuzzing/Fuzz testing](), [Agent Harness](), [V8](), [JavaScript](), [interoperability](), [Resilience](), [Software]() Tags: [agent](), [ai](), [ai-models](), [bug](), [bugs](), [chrome](), [chrome-security](), [exploits](), [fuzzing](), [interoperability](), [javascript](), [none](), [resilience](), [security](), [vulnerabilities]() ### AI overview This article describes how Chrome's security teams use large language models, fuzzing, specialized research tools, and AI vulnerability-discovery agents to find and remediate security bugs more quickly. It highlights Big Sleep, an agent harness using Gemini, model interoperability, and a Chrome knowledge base built from CVEs and Git history. ### Source excerpt Video of Chrome logo turning into a shield ## Bringing AI agents to Chrome Enterprise security management DevFeed: [Bringing AI agents to Chrome Enterprise security management]() Original publisher: [Read original article]() Author: Shantanu Das Published: 2026-05-28T16:00:00Z Content type: article Language: en Sources: [Security]() Topics: [AI Agent](), [Chrome](), [MCP Server](), [Security](), [Model Context Protocol (MCP)](), [Open Source](), [Google]() Tags: [ai-agents](), [apis](), [chrome](), [chrome-security](), [cli](), [enterprise](), [google](), [mcp](), [mcp-server](), [none](), [open-source](), [security]() ### AI overview Google describes an open-source MCP server that connects Chrome Enterprise APIs to AI agents through Gemini CLI and other MCP-compatible clients. The article demonstrates natural-language security management workflows including environment health checks, connector configuration, DLP rule creation, event review, and policy optimization. ### Source excerpt Two dashboard side by side ## Architecting Security for Agentic Capabilities in Chrome DevFeed: [Architecting Security for Agentic Capabilities in Chrome]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2025-12-08T18:03:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [agentic browsing](), [Security](), [Chrome](), [prompt injection](), [Artificial Intelligence](), [browsers](), [Google]() Tags: [agentic-browsing](), [ai](), [chrome](), [chrome-security](), [gemini-in-chrome](), [google](), [llm](), [none](), [prompt-injection](), [real-time](), [red-teaming](), [safety](), [security]() ### AI overview Google describes Chrome's layered security approach for agentic browsing, focusing on indirect prompt injection from untrusted web content. The approach includes a User Alignment Critic, origin isolation, user confirmations for critical steps, real-time threat detection, and red-teaming. ### Source excerpt Posted by Nathan Parker, Chrome security team Chrome has been advancing the web's security for well over 15 years, and we're committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the preview of agentic capabilities, we want to share our approach and some new innovations to improve the safety of agentic browsing. The primary new threat facing all agentic browsers is indirect prompt injection. It can appear in malicious sites, third-party content in iframes, or from user-generated content like user reviews, and can cause the agent to take unwanted actions such as initiating financial transactions or exfiltrating sensitive data. Given this open challenge, we are investing in a layered defense that includes both deterministic and probabilistic defenses to make it difficult and costly for attackers to cause harm. Designing safe agentic browsing for Chrome has involved deep collaboration of security experts across Google. We built on Gemini's existing protections and agent security principles and have implemented several new layers for Chrome. We're introducing a user alignment critic where the agent's actions are vetted by a separate model that is isolated from untrusted content. We're also extending Chrome's origin-isolation capabilities to constrain what origins the agent can interact with, to just those that are relevant to the task. Our layered defense also includes user confirmations for critical steps, real-time detection of threats, and red-teaming and response. We'll step through these layers below. Checking agent outputs with User Alignment Critic The main planning model for Gemini uses page content shared in Chrome to decide what action to take next. Exposure to untrusted web content means it is inherently vulnerable to indirect prompt injection. We use techniques like spotlighting that direct ## HTTPS by default DevFeed: [HTTPS by default]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2025-10-28T17:01:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [Chrome](), [chrome security](), [Security](), [HTTP](), [Social engineering](), [Malware]() Tags: [browser](), [chrome](), [chrome-security](), [http](), [malware](), [none](), [security](), [social-engineering]() ### AI overview Google says Chrome 154, planned for October 2026, will enable "Always Use Secure Connections" by default. Chrome will ask for permission before a user's first access to a public site without HTTPS. ### Source excerpt One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable "Always Use Secure Connections". This means Chrome will ask for the user's permission before the first access to any public site without HTTPS. The "Always Use Secure Connections" setting warns users before accessing a site without HTTPS Chrome Security's mission is to make it safe to click on links. Part of being safe means ensuring that when a user types a URL or clicks on a link, the browser ends up where the user intended. When links don't use HTTPS, an attacker can hijack the navigation and force Chrome users to load arbitrary, attacker-controlled resources, and expose the user to malware, targeted exploitation, or social engineering attacks. Attacks like this are not hypothetical--software to hijack navigations is readily available and attackers have previously used insecure HTTP to compromise user devices in a targeted attack. Since attackers only need a single insecure navigation, they don't need to worry that many sites have adopted HTTPS--any single HTTP navigation may offer a foothold. What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's "Not Secure" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place. To address this risk, we launched the "Always Use Secure Connections" setting in 2022 as an opt-in option. In this mode, Chrome attempts every connection over HTTPS, and shows a bypassable warning to the user if HTTPS is unavailable. We also previously discussed our intent to move towards HTTPS by default. We now think the time has come to enable "Always Use Secure Connections" for all users by default. Now is the time. For more than a decade, Google has published the HTTPS transparency report, which tracks the percentage of navigations in Chrome that ## Advancing Protection in Chrome on Android DevFeed: [Advancing Protection in Chrome on Android]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2025-07-08T17:36:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [Chrome](), [Android](), [chrome security](), [Security](), [Exploit]() Tags: [android](), [chrome](), [chrome-security](), [exploit](), [none](), [security]() ### AI overview This Chrome Security post explains how Android Advanced Protection integrates with Chrome on Android. It covers HTTPS enforcement through Always Use Secure Connections, full Site Isolation on devices with 4GB or more RAM, and disabling JavaScript optimizations to reduce Chrome's attack surface. ### Source excerpt Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team Android recently announced Advanced Protection, which extends Google's Advanced Protection Program to a device-level security setting for Android users that need heightened security--such as journalists, elected officials, and public figures. Advanced Protection gives you the ability to activate Google's strongest security for mobile devices, providing greater peace of mind that you're better protected against the most sophisticated threats. Advanced Protection acts as a single control point for at-risk users on Android that enables important security settings across applications, including many of your favorite Google apps, including Chrome. In this post, we'd like to do a deep dive into the Chrome features that are integrated with Advanced Protection, and how enterprises and users outside of Advanced Protection can leverage them. Android Advanced Protection integrates with Chrome on Android in three main ways: Enables the "Always Use Secure Connections" setting for both public and private sites, so that users are protected from attackers reading confidential data or injecting malicious content into insecure plaintext HTTP connections. Insecure HTTP represents less than 1% of page loads for Chrome on Android. Enables full Site Isolation on mobile devices with 4GB+ RAM, so that potentially malicious sites are never loaded in the same process as legitimate websites. Desktop Chrome clients already have full Site Isolation. Reduces attack surface by disabling Javascript optimizations, so that Chrome has a smaller attack surface and is harder to exploit. Let's take a look at all three, learn what they do, and how they can be controlled outside of Advanced Protection. Always Use Secure Connections "Always Use Secure Connections" (also known as HTTPS-First Mode in blog posts and HTTPS-Only Mode in the enterprise policy) is a Chrome setting that forces HTTPS wherever possible, and asks for explicit ## Chrome enables Kyber post-quantum key exchange by default for TLS 1.3 and QUIC DevFeed: [Chrome enables Kyber post-quantum key exchange by default for TLS 1.3 and QUIC]() Original publisher: [Read original article]() Author: Chromium Blog (noreply@blogger.com) Published: 2024-05-23T17:19:00Z Content type: release Language: en Sources: [Chromium Blog]() Topics: [Post-quantum cryptography](), [Chrome](), [chrome security](), [Google](), [TLS (Transport Layer Security)](), [Security]() Tags: [chrome](), [chrome-security](), [google](), [none](), [post-quantum-cryptography](), [quic](), [security](), [tls]() ### AI overview Google announces that Chrome 124 enables the latest Kyber draft specification by default for TLS 1.3 and QUIC on desktop platforms. The rollout exposed existing TLS middlebox bugs, and Chrome provides a temporary enterprise opt-out policy while fixes are deployed. ### Source excerpt Google and many other organizations, such as NIST, IETF, and NSA, believe that migrating to post-quantum cryptography is important due to the large risk posed by a cryptographically-relevant quantum computer (CRQC). In August, we posted about how Chrome Security is working to protect users from the risk of future quantum computers by leveraging a new form of hybrid post-quantum cryptographic key exchange, Kyber (ML-KEM)1. We're happy to announce that we have enabled the latest Kyber draft specification by default for TLS 1.3 and QUIC on all desktop Chrome platforms as of Chrome 124.2 This rollout revealed a number of previously-existing bugs in several TLS middlebox products. To assist with the deployment of fixes, Chrome is offering a temporary enterprise policy to opt-out. Launching opportunistic quantum-resistant key exchange is part of Google's broader strategy to prioritize deploying post-quantum cryptography in systems today that are at risk if an adversary has access to a quantum computer in the future. We believe that it's important to inform standards with real-world experience, by implementing drafts and iterating based on feedback from implementers and early adopters. This iterative approach was a key part of developing QUIC and TLS 1.3. It's part of why we're launching this draft version of Kyber, and it informs our future plans for post-quantum cryptography. Chrome's post-quantum strategy prioritizes quantum-resistant key exchange in HTTPS, and increased agility in certificates from the Web PKI. While PKI agility may appear somewhat unrelated, its absence has contributed to significant delays in past cryptographic transitions and will continue to do so until we find a viable solution in this space. A more agile Web PKI is required to enable a secure and reliable transition to post-quantum cryptography on the web. To understand this, let's take a look at HTTPS and the current state of post-quantum cryptography. In the context of HTTPS, cryptography is pr