# Chrome Google Chrome is a web browser built for performance, with cross-platform support and browser extensions. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Chrome Adds Experimental Metrics to Measure Website Ad Load DevFeed: [Chrome Adds Experimental Metrics to Measure Website Ad Load]() Original publisher: [Read original article]() Author: Alex Harper Published: 2026-09-17T15:00:00Z Content type: article Language: en Sources: [Web Designer Depot]() Topics: [Chrome](), [Web](), [data](), [User Experience](), [Google](), [developer tooling](), [Core Web Vitals]() Tags: [ad-density](), [ad-performance](), [ad-tech](), [advertising](), [chrome](), [chrome-user-experience-report](), [core-web-vitals](), [crux](), [devtools](), [google](), [google-chrome](), [online-advertising](), [page-experience](), [performance](), [publishers](), [user-experience](), [ux](), [ux-usability](), [web-design](), [web-development](), [web-performance](), [website-ads](), [website-optimization](), [website-performance]() ### AI overview Chrome has introduced four experimental metrics to the Chrome User Experience Report (CrUX) that quantify website ad load: ad count, ad density, network weight, and CPU weight. The aggregated data is public and can be accessed through CrUX Vis, APIs, and Chrome DevTools, although availability and evaluation thresholds remain limited. ### Source excerpt Chrome can now measure exactly how obnoxious a website's ads are, from how much of your screen they swallow to how much data and CPU time they burn. Those ad-stuffed websites can finally be measured, and the results are public. ## Google Is Testing a Search Bar That Works Outside Chrome DevFeed: [Google Is Testing a Search Bar That Works Outside Chrome]() Original publisher: [Read original article]() Author: Simon Sterne Published: 2026-09-10T16:00:00Z Content type: article Language: en Sources: [Web Designer Depot]() Topics: [Chrome](), [Google](), [Chromium](), [Artificial Intelligence]() Tags: [ai](), [ai-assistants](), [ai-search](), [ai-tech](), [artificial-intelligence](), [browser](), [browser-design](), [chrome](), [chrome-canary](), [chromium](), [everywhere-omnibox](), [future-of-browsers](), [future-of-search](), [gemini](), [gemini-in-chrome](), [google](), [google-chrome](), [google-search](), [project-loom](), [search](), [search-technology](), [ui-design](), [ux-design](), [web-browsers](), [web-design]() ### AI overview Google is testing Project Loom, an experimental floating Search bar that can appear over other Windows apps instead of remaining inside Chrome. The feature is unfinished, with screen sharing, Lens, and AI Mode controls reportedly not yet working. ### Source excerpt Google is quietly testing a way to bring Search outside Chrome and directly on top of whatever app you're using. It's called Project Loom, and this little floating search box could hint at a much bigger future where Google follows you around your desktop. ## The thoroughness of Tom Johnson's free Documenting API's course on OpenAPI 3.0 and Swagger UI DevFeed: [The thoroughness of Tom Johnson's free Documenting API's course on OpenAPI 3.0 and Swagger UI]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-09-09T21:17:32Z Content type: article Language: en Sources: [T.J. Maher]() Topics: [OpenAPI Specification](), [Documentation](), [REST API](), [Swagger](), [Testing](), [Postman](), [JavaScript](), [JSON](), [Authentication](), [cURL](), [Chrome](), [Open Source]() Tags: [api](), [api-documentation](), [authentication](), [chrome](), [chrome-extension](), [curl](), [documentation](), [github](), [javascript](), [json](), [openapi](), [pdf](), [postman](), [rest-api](), [swagger](), [testing]() ### AI overview The article reviews Tom Johnson's free "Documenting APIs: A guide for technical writers and engineers" course. It describes the course's 17 chapters, practical API-learning exercises, coverage of REST APIs, OpenAPI, Swagger UI, testing and publishing API documentation, and a PDF edition exceeding 900 pages. ### Source excerpt While researching information for my job about the Swagger UI and how it can be used for testing, I came across this free course, called Documenting APIs: A guide for technical writers and engineers at https://idratherbewriting.com/learnapidoc/docapis_overview.html written by Tom Johnson, a technical writer based in Seattle who works for Google. The course looks intense, containing 17 chapters talking about Introduction to REST APIs, using APIs like a developer, Documenting API endpoints, the Open API spec, Testing API docs, Publishing API docs, and more. From the Course Introduction: "You'll first learn about API documentation by using a simple weather API to put a weather forecast on your site. [...] As you use the API, you'll learn about endpoints, parameters, data types, authentication, curl, JSON, the command line, Chrome's Developer Console, JavaScript, and more. The idea is that rather than learning about these concepts independent of any context, you learn them by immersing yourself in a real scenario while using an API. Immersion in real scenarios makes these tools and technologies more meaningful. "We'll then transition into standards, tools, and specifications for REST APIs. You'll learn about the required sections in API documentation, analyze examples of REST API documentation from various companies, learn how to join an open-source project to get experience, and more. "[...] We'll also dive into specifications such as the OpenAPI specification and Swagger UI (which provides tooling for the OpenAPI specification). Additionally, you'll learn how to document native library APIs and generate Javadoc". Tom Johnson offers a PDF version of this free course... over 900 pages, with more always being added. It also offers many workshop-like activities you could put in an actual itinerary. You would need for the course: Chrome, since it provides "a Javascript Console that works well for inspecting JSON", the JSON Formatter Chrome extension, Postman, a GitHub acco ## Maestro CLI 2.9.0: test light and dark mode in one flow DevFeed: [Maestro CLI 2.9.0: test light and dark mode in one flow]() Original publisher: [Read original article]() Author: Manu Armani Published: 2026-08-31T15:00:00Z Content type: release Language: en Sources: [mobile.dev - Medium]() Topics: [Command-line interface](), [Mobile](), [WebView](), [Web](), [Chrome](), [YAML]() Tags: [2-9-0](), [android](), [angular](), [chrome](), [cli](), [dark-mode](), [ios](), [react](), [release](), [vue](), [web](), [webview](), [yaml]() ### AI overview Maestro CLI 2.9.0 adds commands for testing light and dark themes within a single flow across iOS, Android, and Web. It also introduces negation globs for YAML files and improves Android WebView inspection, Chrome Web flows, Android reliability, and upload-status polling. ### Source excerpt Maestro CLI 2.9.0 adds dark-mode commands for iOS, Android, and Web, negation globs in config.yaml, and reliability work for Android WebViews and modern Chrome. ## WebMCP: A Browser API for Exposing Website Actions to AI Agents DevFeed: [WebMCP: A Browser API for Exposing Website Actions to AI Agents]() Original publisher: [Read original article]() Author: Avi Chawla Published: 2026-08-31T13:43:15Z Content type: article Language: en Sources: [Daily Dose of Data Science]() Topics: [browser](), [Chrome](), [Edge](), [Artificial Intelligence]() Tags: [agent](), [ai](), [browser](), [chrome](), [edge]() ### AI overview The article explains WebMCP, a browser API from the Chrome and Edge teams that allows websites to expose actions such as search, cart, checkout, and booking flows to AI agents. It contrasts this approach with screenshot-based navigation, which can be slower and fragile when page layouts change. ### Source excerpt Everything you need to understand WebMCP and expose your site's actions to an agent. ## The multi-layered defenses that harden Chrome against abusive notifications DevFeed: [The multi-layered defenses that harden Chrome against abusive notifications]() Original publisher: [Read original article]() Author: Nidhi Davawala Published: 2026-08-11T17:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Chrome](), [Security](), [Android](), [Firebase](), [API](), [Networks]() Tags: [android](), [api](), [chrome](), [chrome-security](), [firebase](), [malware](), [none](), [safety-security](), [security]() ### AI overview Chrome describes a defense-in-depth system for reducing abusive web notifications. The approach combines automatic permission revocation, behavioral detection of coordinated abuse networks, Safe Browsing and Firebase Cloud Messaging collaboration, and server-side Push API throttling to limit deceptive or unwanted notifications. ### Source excerpt Image of a URL with a small window saying "Get notifications?" ## Stronger with every update: How we're making Chrome and the web safer in the AI Era DevFeed: [Stronger with every update: How we're making Chrome and the web safer in the AI Era]() Original publisher: [Read original article]() Author: Chrome Security Team Published: 2026-07-30T17:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Chrome](), [Security](), [Vulnerabilities](), [Artificial Intelligence](), [Large Language Model](), [Fuzzing/Fuzz testing](), [Agent Harness](), [V8](), [JavaScript](), [interoperability](), [Resilience](), [Software]() Tags: [agent](), [ai](), [ai-models](), [bug](), [bugs](), [chrome](), [chrome-security](), [exploits](), [fuzzing](), [interoperability](), [javascript](), [none](), [resilience](), [security](), [vulnerabilities]() ### AI overview This article describes how Chrome's security teams use large language models, fuzzing, specialized research tools, and AI vulnerability-discovery agents to find and remediate security bugs more quickly. It highlights Big Sleep, an agent harness using Gemini, model interoperability, and a Chrome knowledge base built from CVEs and Git history. ### Source excerpt Video of Chrome logo turning into a shield ## When It Makes Sense To "Block" The Main Thread DevFeed: [When It Makes Sense To "Block" The Main Thread]() Original publisher: [Read original article]() Author: hello@smashingmagazine.com (Victor Ayomipo) Published: 2026-07-17T08:00:00Z Content type: article Language: en Sources: [Articles on Smashing Magazine -- For Web Designers And Developers]() Topics: [JavaScript](), [Chrome extension](), [Latency](), [modern web development](), [Chrome](), [Concurrency]() Tags: [architecture](), [browser](), [chrome](), [chrome-extension](), [coding](), [javascript](), [latency](), [main-thread](), [performance](), [techniques](), [thread]() ### AI overview This article examines when blocking the browser's main thread can be faster than transferring work to a background worker. Using a Chrome screenshot extension as an example, it explains how serialization, copying, and deserialization can introduce enough latency to outweigh the responsiveness benefits of offloading computation. ### Source excerpt The common rule of thumb is to never "block" the browser's main thread when running JavaScript tasks. But is this a hard rule? Victor Ayomipo describes a use case he encountered involving a screenshot extension where he made an exception to the rule and decided that blocking the main thread was absolutely the right thing to do. ## Automating Conversion of reveal.js Slides to PDF DevFeed: [Automating Conversion of reveal.js Slides to PDF]() Original publisher: [Read original article]() Author: Jan-Piet Mens Published: 2026-07-10T22:00:00Z Content type: article Language: en Sources: [Jan-Piet Mens]() Topics: [Automation](), [Emacs](), [Org mode](), [HTML](), [make](), [browser](), [Chrome](), [Command-line interface](), [Docker](), [npm](), [Script](), [Server]() Tags: [automation](), [browser](), [chrome](), [command-line](), [docker](), [emacs](), [html](), [jan-piet-mens](), [jpm](), [jpmens](), [make](), [npm](), [script]() ### AI overview The author describes using Emacs Org-mode and reveal.js to create training slide decks, then automating their conversion from HTML to PDF with decktape. They compare Docker-based and local installations, noting differences in Chrome and font rendering, and use a small shell script to run an HTTP server, invoke decktape, and clean up the process. ### Source excerpt A few years ago I began using Emacs Org-mode and reveal.js to generate slide decks I use in trainings, and I've been pleased with the results. (I believe it was Carsten who got me hooked.) It took me a bit to get the settings just the way I wanted to have them, but since then it's been a matter of typing make in a command line to generate the HTML from the .org file using this in my Makefile, and the resulting *.html is what I open in a browser for display. presentation.html: presentation.org emacs -u jpm \ --batch presentation.org \ --eval '(load user-init-file)' \ -f org-reveal-export-to-html For printing and handouts I want a PDF, but that's always required a bit of manual work to convert the HTML to PDF, because the tools I tried back then didn't produce the result I could get manually by opening in a Chrome browser with a ?print-pdf attached the the URL and then a judicious print-to-PDF and save. My idea was to automate that, and I was prompted a few days ago to revisit decktape. I shy away from installing NPM stuff because like Maven, Rust, and whatnot, they typically make me download half an internet, so I began by using the docker image as described at decktape. However I disliked the fonts and the overall impression of the generated PDF. "Disliked" is possibly unfair, but it just looked different... It dawned on me then, obviously, that the docker image was running some incantation of Chrome on Linux, whereas I'm used to Chrome on Mac and its fonts, etc., so I then did actually install decktape locally with the resulting PDF looking exactly like what I was used to! I've now got "automation" to (mostly) get the PDF output the way I wish to have it with a small script I've named runoff.sh (yes, the name is intentional :-) #!/bin/sh set -e python3 -m http.server --bind 127.0.0.1 8108 & httpid=$! trap "{ echo Killing http.server on $httpid; kill $httpid; exit 0; }" 0 1 2 15 echo PID=$httpid npm exec decktape -- \ --size 998x780 \ --pdf-author "Jan-Piet Mens" \ -- ## A developer toolkit to make your website agent-ready DevFeed: [A developer toolkit to make your website agent-ready]() Original publisher: [Read original article]() Author: Kasper Kulikowski X GitHub LinkedIn Michael Hablich GitHub LinkedIn Bluesky Homepage Published: 2026-06-22T07:00:00Z Content type: article Language: en Sources: [developer.chrome.com: Blog]() Topics: [agentic browsing](), [AI Agent](), [Chrome](), [developer tooling](), [Accessibility](), [Document Object Model (DOM)](), [Web](), [Search engine optimization (SEO)]() Tags: [accessibility](), [agentic-browsing](), [ai](), [ai-agent](), [audits](), [chrome](), [debug](), [seo](), [web]() ### AI overview This article explains how developers can make websites ready for AI agents that browse and interact with web pages. It covers Lighthouse's Agentic browsing category, Chrome DevTools enhancements, deterministic audits, accessibility and layout stability, and WebMCP integration. ### Source excerpt Learn how to build agent-ready websites using the Lighthouse Agentic browsing category and Chrome DevTools for agents. ## Unlock runtime insights: Introducing third-party developer tools for Chrome DevTools for agents DevFeed: [Unlock runtime insights: Introducing third-party developer tools for Chrome DevTools for agents]() Original publisher: [Read original article]() Author: Wolfgang Beyer X GitHub Published: 2026-06-18T07:00:00Z Content type: article Language: en Sources: [developer.chrome.com: Blog]() Topics: [AI Agent](), [Chrome](), [MCP Server](), [Tooling](), [debugging](), [Puppeteer](), [Document Object Model (DOM)](), [JSON Schema](), [JavaScript](), [Angular](), [React](), [Vue.js]() Tags: [ai](), [ai-agent](), [ai-coding](), [angular](), [chrome](), [debugging](), [developer-tools](), [javascript](), [json](), [mcp](), [mcp-server](), [react](), [vue](), [web-development]() ### AI overview Chrome DevTools for agents now supports third-party developer tools that expose runtime context from frameworks and applications to AI coding assistants. The article explains how these tools help agents inspect internal state, connect DOM elements to framework components, access server-side or database state, and debug issues beyond static source-code analysis. ### Source excerpt Chrome DevTools for agents introduces third-party developer tools, which lets frameworks and applications share rich, runtime context with AI coding assistants. ## What's New in WebGPU (Chrome 149-150) DevFeed: [What's New in WebGPU (Chrome 149-150)]() Original publisher: [Read original article]() Author: François Beaufort GitHub Published: 2026-06-17T07:00:00Z Content type: article Language: en Sources: [developer.chrome.com: Blog]() Topics: [webgpu](), [Chrome](), [GPU](), [shaders]() Tags: [chrome](), [gpu](), [shaders](), [validation](), [webgpu]() ### AI overview WebGPU updates in Chrome 149-150 introduce immediates for passing small, frequently changing values directly to shaders and refine validation rules for transient render attachments. ### Source excerpt Immediates and stricter validation for transient attachments. ## Chrome 150 beta DevFeed: [Chrome 150 beta]() Original publisher: [Read original article]() Author: Rachel Andrew GitHub LinkedIn Mastodon Bluesky Homepage Published: 2026-06-03T07:00:00Z Content type: release Language: en Sources: [developer.chrome.com: Blog]() Topics: [Chrome](), [CSS](), [Beta channel](), [CSS functions](), [Web]() Tags: [beta-channel](), [chrome](), [css](), [css-functions](), [developers](), [release](), [web]() ### AI overview Chrome 150 beta previews CSS and UI updates across Android, ChromeOS, Linux, macOS, and Windows, including system colors, rounded CSS shapes, animatable zoom, CSS URL request modifiers, responsive text sizing, border clipping, and color image functions. ### Source excerpt Get a preview of the next Chrome release with this post detailing the features in the current beta. ## Seamless PWA origin migration: Change domains without losing users DevFeed: [Seamless PWA origin migration: Change domains without losing users]() Original publisher: [Read original article]() Author: Dibyajyoti Pal LinkedIn Dan Murphy X LinkedIn Marijn Kruisselbrink LinkedIn Published: 2026-06-03T07:00:00Z Content type: article Language: en Sources: [developer.chrome.com: Blog]() Topics: [PWA](), [migration](), [Chrome](), [Security](), [User Experience](), [Web](), [Web app]() Tags: [chrome](), [dialog](), [feature](), [how-to](), [manifest](), [migration](), [security](), [update](), [user-experience](), [web](), [web-apps]() ### AI overview Chrome 150 introduces PWA Origin Migration, allowing installed Progressive Web Apps to transition to a new same-site origin while keeping users informed through an update dialog. The article explains the old and destination manifest requirements, the migration handshake, rollout behavior, and update considerations. ### Source excerpt From Chrome 150 you can seamlessly transition a PWA to a new same-site origin. ## Bringing AI agents to Chrome Enterprise security management DevFeed: [Bringing AI agents to Chrome Enterprise security management]() Original publisher: [Read original article]() Author: Shantanu Das Published: 2026-05-28T16:00:00Z Content type: article Language: en Sources: [Security]() Topics: [AI Agent](), [Chrome](), [MCP Server](), [Security](), [Model Context Protocol (MCP)](), [Open Source](), [Google]() Tags: [ai-agents](), [apis](), [chrome](), [chrome-security](), [cli](), [enterprise](), [google](), [mcp](), [mcp-server](), [none](), [open-source](), [security]() ### AI overview Google describes an open-source MCP server that connects Chrome Enterprise APIs to AI agents through Gemini CLI and other MCP-compatible clients. The article demonstrates natural-language security management workflows including environment health checks, connector configuration, DLP rule creation, event review, and policy optimization. ### Source excerpt Two dashboard side by side ## What's new in web extensions: I/O 2026 recap DevFeed: [What's new in web extensions: I/O 2026 recap]() Original publisher: [Read original article]() Author: Milica Mihajlija X GitHub Homepage Published: 2026-05-22T07:00:00Z Content type: news Language: en Sources: [developer.chrome.com: Blog]() Topics: [Extension](), [Chrome](), [Google](), [AI-assisted coding](), [Tooling](), [Web platform]() Tags: [ai](), [ai-coding](), [chrome](), [developer](), [extensions](), [google](), [management](), [metrics](), [monitor](), [tools](), [updates](), [web](), [workflows]() ### AI overview Google I/O 2026 extension updates include broader developer registration, an Extensions skill for AI coding agents, Chrome DevTools support for extension debugging, and granular Chrome Web Store member roles and permissions. ### Source excerpt Another Google I/O is behind us and we have covered all the exciting extensions updates! ## Making it easier to understand how content was created and edited DevFeed: [Making it easier to understand how content was created and edited]() Original publisher: [Read original article]() Author: Laurie Richardson Published: 2026-05-17T13:43:50Z Content type: article Language: en Sources: [Google DeepMind News]() Topics: [synthid](), [Artificial Intelligence](), [watermarking](), [Chrome](), [Web](), [Cloud]() Tags: [ai](), [chrome](), [cloud](), [gemini-in-chrome](), [none](), [products](), [synthid](), [watermarking](), [web]() ### AI overview Google DeepMind describes expanded tools for verifying how digital content was created and edited. The update extends SynthID watermark verification and C2PA Content Credentials across Gemini, Search, Chrome, Pixel phones and Cloud, helping users identify AI-generated media and determine whether content is original or modified. ### Source excerpt We're expanding our tools to help you understand how content was created and edited across the web. ## Meet HoloTab by HCompany. Your AI browser companion. DevFeed: [Meet HoloTab by HCompany. Your AI browser companion.]() Original publisher: [Read original article]() Author: Marc Thibault; Pierre-Louis Cedoz; Hamza Benchekroun; Kai Yuan; Aurélien Lac; Tony Wu; Antonio Loison; Axel Moyal; Emrick Sinitambirivoutin; Aleix Cambray Published: 2026-04-15T09:25:20Z Content type: release Language: en Sources: [Hugging Face - Blog]() Topics: [computer-use](), [Artificial Intelligence](), [Chrome extension](), [Chrome](), [browser](), [Web]() Tags: [ai](), [browser](), [chrome](), [chrome-extension](), [computer-use](), [model](), [web]() ### AI overview HoloTab is a Chrome extension that brings computer-use AI into the browser, allowing users to describe tasks that it carries out across websites. It also records user actions and narration to create reusable routines that can be rerun or scheduled. ### Source excerpt We built one of the most powerful computer-use AIs in the world. And made it directly accessible from your browser. On March 31st, we released Holo3, our most advanced computer-use model to date. Building something powerful is one thing; making it accessible and easy to use is another. We're doing both. HoloTab is a Chrome extension that navigates the web just like a person would. It automates tasks across any website with zero setup or technical skills required. ## Protecting Cookies with Device Bound Session Credentials DevFeed: [Protecting Cookies with Device Bound Session Credentials]() Original publisher: [Read original article]() Author: Guillaume Ehinger Published: 2026-04-09T19:25:00Z Content type: article Language: en Sources: [Security]() Topics: [Security](), [Authentication](), [Chrome](), [trusted-execution-environment](), [Windows](), [macOS](), [browser](), [Hardware](), [Web](), [Availability]() Tags: [authentication](), [availability](), [browser](), [chrome](), [hardware](), [macos](), [none](), [security](), [web](), [windows]() ### AI overview Device Bound Session Credentials (DBSC) is entering public availability for Windows users on Chrome 146 and will expand to macOS. The technology cryptographically binds authentication sessions to hardware-backed device keys, making stolen session cookies expire quickly and preventing their use for account access. ### Source excerpt Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macO... ## Protecting Cookies with Device Bound Session Credentials DevFeed: [Protecting Cookies with Device Bound Session Credentials]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2026-04-09T17:07:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [Security](), [Chrome](), [browsers](), [Malware](), [Windows](), [macOS](), [trusted-execution-environment]() Tags: [browser](), [chrome](), [files](), [macos](), [malware](), [memory](), [none](), [security](), [tokens](), [windows]() ### AI overview Google announces that Device Bound Session Credentials (DBSC) is entering public availability for Windows users on Chrome 146, with macOS support planned for an upcoming Chrome release. DBSC binds authentication sessions to a device-backed key so exfiltrated session cookies cannot be used to access accounts. ### Source excerpt Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape. Session theft typically occurs when a user inadvertently downloads malware onto their device. Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server. Infostealer malware families, such as LummaC2, have become increasingly sophisticated at harvesting these credentials. Because cookies often have extended lifetimes, attackers can use them to gain unauthorized access to a user's accounts without ever needing their passwords; this access is then often bundled, traded, or sold among threat actors. Crucially, once sophisticated malware has gained access to a machine, it can read the local files and memory where browsers store authentication cookies. As a result, there is no reliable way to prevent cookie exfiltration using software alone on any operating system. Historically, mitigating session theft relied on detecting the stolen credentials after the fact using a complex set of abuse heuristics - a reactive approach that persistent attackers could often circumvent. DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users' accounts. How DBSC Works DBSC protects against session theft by cryptographically binding authentication sessions to a specific device. It does this using hardwar ## VRP 2025 Year in Review DevFeed: [VRP 2025 Year in Review]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2026-03-31T16:55:00Z Content type: article Language: en Sources: [Google Online Security]() Topics: [Bug Bounty](), [Google](), [Security](), [Vulnerabilities](), [Artificial Intelligence](), [Chrome](), [Open Source]() Tags: [ai](), [bounty](), [bug-bounty](), [chrome](), [dependencies](), [google](), [none](), [open-source](), [security](), [vulnerabilities]() ### AI overview Google's 2025 Vulnerability Reward Program review marks its 15th anniversary and reports more than $17 million awarded to over 700 security researchers. It also describes a dedicated AI VRP, expanded Chrome rewards for AI-related issues, OSV-SCALIBR patch rewards, and security community events. ### Source excerpt Posted by Dirk Göhmann, Tony Mendez, and the Vulnerability Rewards Program Team 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010, our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearly indicating the value the programs under this umbrella contribute to the safety and security of Google and its users, but also highlighting their acceptance by the external research community, without which such programs cannot function. Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer. This was more evident than ever as we awarded over $17 million (an all-time high and more than 40% increase compared to 2024!) to over 700 researchers based in countries around the globe - across all of our programs. Vulnerability Reward Program 2025 in Numbers Want to learn more about who's reporting to the VRP? Check out our Leaderboard on the Google Bug Hunters site. VRP Highlights in 2025 In 2025 we made a series of changes and improvements to our VRP and related initiatives, and continued to invest in the security research community through a series of focused events: The new, dedicated AI VRP was launched, underscoring the importance of this space to Google and its relevance for external researchers. Previously organized as a part of the Abuse VRP, moving into a dedicated VRP has gone hand in hand with improvements to the rules, offering researchers more clarity on scope and reward amounts. Similarly, the Chrome VRP now also includes reward categories for problems found in AI features. We launched a patch rewards program for OSV-SCALIBR, Google's open source tool for finding vulnerabilities in software dependencies. Contributors are rewarded for providing novel OSV-SCALIBR plugins for inventory, vulne ## Github Copilot vs Google Antigravity DevFeed: [Github Copilot vs Google Antigravity]() Original publisher: [Read original article]() Author: Alex Ewerlöf Published: 2026-03-22T23:19:06Z Content type: comparison Language: en Sources: [Alex Ewerlof Notes]() Topics: [GitHub Copilot](), [google-antigravity](), [GitHub Copilot CLI](), [Google](), [Chrome]() Tags: [browser](), [gemini-cli](), [github-copilot](), [google](), [google-antigravity]() ### AI overview A firsthand comparison of GitHub Copilot and Google Antigravity based on the author's experience using both tools. The article describes Antigravity's browser integration and Plan mode, while noting that its newer product maturity is visible compared with Copilot. ### Source excerpt Why Github gets developers and why it's hard to tell who Antigravity is for ## Bringing Chrome to ARM64 Linux Devices DevFeed: [Bringing Chrome to ARM64 Linux Devices]() Original publisher: [Read original article]() Author: Chromium Blog (noreply@blogger.com) Published: 2026-03-12T20:01:00Z Content type: release Language: en Sources: [Chromium Blog]() Topics: [Chrome](), [Linux](), [Google](), [Extension](), [Chromium](), [Security](), [Artificial Intelligence](), [Malware](), [passwords](), [DGX Spark](), [data](), [real-time]() Tags: [ai](), [arm](), [chrome](), [chromium](), [data](), [dgx-spark](), [extensions](), [google](), [linux](), [malware](), [none](), [passwords](), [real-time](), [security]() ### AI overview Google announces the launch of Chrome for ARM64 Linux devices in Q2 2026, extending Chrome's availability across Arm-powered platforms. The release brings Google ecosystem integration, cross-device synchronization, extensions, translation, security protections, password management, and support for DGX Spark users. ### Source excerpt We're excited to announce that Google will launch Chrome for ARM64 Linux devices in Q2 2026, following the successful expansion of Chrome to Arm-powered macOS devices in 2020 and Arm-powered Windows devices in 2024. Launching Chrome for ARM64 Linux devices allows more users to enjoy the seamless integration of Google's most helpful services into their browser. This move addresses the growing demand for a browsing experience that combines the benefits of the open-source Chromium project with the Google ecosystem of apps and features. This release represents a significant undertaking to ensure that ARM64 Linux users receive the same secure, stable, and rich Chrome experience found on other platforms. Get the best of the Google ecosystem With Chrome, you are able to leverage the full power of the Google ecosystem, providing a more cohesive and feature-rich environment designed for convenience and cross-device continuity. By signing into a Google Account, your bookmarks, browsing history, and open tabs follow you across devices. You can easily access the best extensions the Chrome Web Store has to offer, without needing to use specialized tools or alter developer settings. And you can effortlessly translate webpages with a single click. Use the browser that is secure by design Chrome also offers the added benefit of Google's strongest security protections. Enabling Enhanced Protection in Safe Browsing offers real-time protection against phishing and malware by leveraging AI alongside Google's list of known threats. With the Google Pay integration you can easily and securely manage your payments, using Chrome autofill for an added level of convenience. And the Google Password Manager lets you securely store, generate, and sync complex passwords across all your devices, eliminating the need to memorize multiple logins. It goes beyond simple storage by actively monitoring your credentials for data breaches and providing "Password Checkup" alerts if any of your accounts are ## Chrome develops Merkle Tree Certificates for quantum-resistant HTTPS DevFeed: [Chrome develops Merkle Tree Certificates for quantum-resistant HTTPS]() Original publisher: [Read original article]() Author: Google (noreply@blogger.com) Published: 2026-02-27T17:01:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [Chrome](), [Post-quantum cryptography](), [Certificate Transparency](), [Internet Engineering Task Force (IETF)](), [TLS (Transport Layer Security)](), [Scalability](), [Security](), [Cryptography]() Tags: [certificate-transparency](), [chrome](), [ietf](), [none](), [post-quantum-cryptography](), [scalability](), [security](), [tls](), [web]() ### AI overview Chrome is developing Merkle Tree Certificates with partners through the IETF PLANTS working group to support quantum-resistant HTTPS while reducing the bandwidth and performance costs of larger post-quantum certificate chains. Chrome says it has no immediate plan to add traditional post-quantum X.509 certificates to the Chrome Root Store and is experimenting with MTCs using real internet traffic. ### Source excerpt Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures ("PLANTS"), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we've taken to address them in earlier blog posts. To ensure the scalability and efficiency of the ecosystem, Chrome has no immediate plan to add traditional X.509 certificates containing post-quantum cryptography to the Chrome Root Store. Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group. MTCs replace the heavy, serialized chain of signatures found in traditional PKI with compact Merkle Tree proofs. In this model, a Certification Authority (CA) signs a single "Tree Head" representing potentially millions of certificates, and the "certificate" sent to the browser is merely a lightweight proof of inclusion in that tree. Why MTCs? MTCs enable the adoption of robust post-quantum algorithms without incurring the massive bandwidth penalty of classical X.509 certificate chains. They also decouple the security strength of the corresponding cryptographic algorithm from the size of the data transmitted to the user. By shrinking the authentication data in a TLS handshake to the absolute minimum, MTCs aim to keep the post-quantum web as fast and seamless as today's internet, maintaining high performance even as we adopt stronger security. Finally, with MTCs, transparency is a fundamental property of issuance: [Next page]()