OpenAI updated its ChatGPT Chrome extension so Chat can read open tabs and the Work agent can send messages and fill out forms. The Verge compares Work's tab control to Gemini's auto browse, and Engadget says OpenAI retired its own browser on August 9.
Perspective Coverage
4 publishers
- Builder
- Builder 35%
- Operator
- Operator 44%
- Investor
- Investor 21%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence68
Chrome CVE disclosures rose 563% by May in a surge VulnCheck partly credits to AI bug hunting
VulnCheck counted Chrome CVEs up 563% and GitHub-issued CVEs up 476% year to date in a May 14, 2026 post. It calls the rise consistent with AI-assisted bug finding, but whether the volume lasts is unknown, so exploitation data still sets patch order.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence50
XBOW chained three unknown Chrome bugs into a Windows exploit that runs on page load, built in six days with a public OpenAI model, it said. Google fixed all three and paid its $250,000 top reward; the fixes apply only after Chrome restarts.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 41%
- Investor
- Investor 34%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+30
- Incentives70
- Confidence72
Apple has launched a "Switch to Safari" campaign urging Mac users to drop Chrome, with a web page listing more than 10 reasons. Its speed and battery figures are Apple's own "up to" claims, and the coverage shows no change in Mac browser share.
Perspective Coverage
3 publishers
- Builder
- Builder 17%
- Operator
- Operator 65%
- Investor
- Investor 18%
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+30
- Incentives85
- Confidence60
Chrome 155 stable update closes 37 security flaws, seven rated Critical
Google's Chrome 155 stable update, versions 155.0.8059.79/.80, fixes 37 security flaws, seven of them rated Critical. Malwarebytes says auto-update can stall on a browser that never closes or one with a blocking extension, so the installed build number is the thing to verify.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher CSS sibling-index() staggers a whole list from a single animation-delay rule
CSS sibling-index() and sibling-count() became Baseline Newly available in August 2026, according to a dev.to post that tested them in Chrome 155. One calc() line now staggers a list, but hidden items still count.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence58
Attackers chain V8 Maglev bugs with sandbox escapes against Edge and Chrome builds missing the fix
Microsoft says attackers chained V8 Maglev code-execution bugs with V8 sandbox escapes against Edge and Chrome users who lacked the fixes. Chrome Stable's matching update arrived four days after Edge's, on 8 September.
Publishers:microsoftedge.github.io
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence55
Google quadrupled the Chrome VRP base reward for memory corruption bugs to $2,000, up from the $500 it set in April. SecurityWeek reports the new rates are still well below those paid before April, so the change restores part of a cut.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence68
buildOne report1 publisher Portrait MP4 frames decoded with WebCodecs come out sideways in all four tested browsers
Portrait MP4 clips decoded with mp4box.js and VideoDecoder came out 1920x1080 and sideways in Chromium, Chrome, Firefox and WebKit, a dev.to post reports. The rotation lives in the track header matrix that the demuxer exposes, so the app has to read it and turn the canvas itself.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence58
Google's Gemini quiz builder in Chrome reaches only English desktop users in the US and India
Google is rolling out a Gemini quiz builder in Chrome for English desktop users in the US and India. Availability also varies by device, account type and browser configuration, TechRepublic reports, so one class can see uneven access.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence60
Two Googlebooks needed repeated restarts to stay linked to phones, The Verge found
The Verge spent a week with Asus and HP Googlebooks and found the phone link unreliable for app casting and file sharing. Limits in native Android apps add to the problem on a $1,000 laptop, according to the reviewer's first-week account.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence55
Researchers at haveibeensquatted.com found three Cyrillic letters that still break Chromium's whole-script lookalike check in current Chrome. A name built on one can display close to a real brand, so the address bar is a weaker check than users are taught.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher Chrome's Local Network Access prompt makes running localhost helpers look uninstalled
Since Chrome 142, a public website needs the user's permission before it can reach a helper service on 127.0.0.1. Scanner and printer agents with short health-check timeouts mistake the pending prompt for a missing install, a developer found and documented on dev.to.
Reality
- Evidence55
- Adoption65
- Hype gap+5
- Incentives25
- Confidence55
Google gives ChromeOS a 2034 end date in favor of Android Googlebooks
Google will end ChromeOS support by 2034 and convert many existing Chromebooks into Googlebooks, its new Android-based laptops. For schools running Chromebook fleets, the next refresh becomes a move onto Google's Android and Gemini platform before that deadline.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives55
- Confidence40
Attackers who hijacked the operators of three country-code domains obtained HTTPS certificates for Google domains, Google disclosed. The company says the issuing CAs did nothing wrong, so its defence came after issuance, and it cannot promise it found every affected domain.
Perspective Coverage
8 publishers
- Builder
- Builder 24%
- Operator
- Operator 69%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence68
Google's October 6 Chrome desktop update fixes 247 security flaws, four of them rated Critical. The fixes apply when Chrome relaunches, so a browser nobody closes keeps running the vulnerable build until someone restarts it.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence70
buildOne report1 publisher Chrome 155 decodes JPEG XL natively through jxl-rs, a decoder rewritten in Rust
Google's Chrome 155 decodes JPEG XL natively with jxl-rs, the browser's first complete image decoder written in a memory-safe language. Any site can now serve .jxl images to Chrome without plugins or experimental flags, so the format is a production option for Chrome traffic.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence55
buildConfirmed2 publishers Lightpanda shipped 1.0 of its open-source browser on October 2nd, passing 1,739,845 web-platform subtests without rendering pages. One encoding suite makes up about two-thirds of that count, so teams should judge it by whether their jobs need to see the page.
Reality
- Evidence55
- Adoption35
- Hype gap+25
- Incentives70
- Confidence60
buildOne report1 publisher Google Search Console folds Lens and Circle to Search visits into one Multimodal filter
Google Search Console's new Multimodal filter, rolling out since September 24, 2026, counts four image-search entry points as one traffic channel. Site owners can now count visual-search visits directly, but proving that image work pays off still takes a page-level test.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence40
Cloudflare plans to become a public certificate authority and start production issuance of post-quantum Merkle Tree Certificates in the first quarter of 2027. Teams planning a post-quantum migration now have an issuer-side date to test web PKI against.
Perspective Coverage
4 publishers
- Builder
- Builder 45%
- Operator
- Operator 45%
- Investor
- Investor 10%
Reality
- Evidence50
- Adoption8
- Hype gap+30
- Incentives
- Not scored
- Confidence60
Earlier coverage
- GPT-5.6 Sol Ultra turned public V8 patch commits into a working Chrome exploit for $1,597
Build · October 3, 2026 · Confirmed2 publishers
- Android 17 copies forensic logs to Google's servers, where no one can delete them for 12 months
Security · October 1, 2026 · Confirmed2 publishers
- Cloudflare agrees to buy a GlobalSign root so its new certificate authority works on old devices
Build · September 29, 2026 · Confirmed2 publishers
- Attackers are exploiting a medium-rated V8 write in Chrome's 230-fix release
Security · September 10, 2026 · Confirmed5 publishers
- Four espionage crews, most China-linked, ran the same Chrome exploit kit through a four-week patch gap
Security · September 10, 2026 · Confirmed9 publishers
- A reflected XSS on a US university site launched a three-CVE Chrome chain at NGOs
Security · September 14, 2026 · Confirmed2 publishers
- Weizman's BragJack hijacks five Chromium AI assistants from a single installed extension
Security · September 20, 2026 · Confirmed3 publishers
- Chrome 154's 11 critical fixes: seven in webpage-reachable graphics code, four use-after-free bugs elsewhere
Security · September 24, 2026 · Confirmed2 publishers
- pdfium's text page drops the 0 Tz line that pypdf still returns
Build · September 23, 2026 · One report1 publisher
- A third Chinese APT ran the same Chrome and Windows zero-day chain from spoofed news sites
Security · September 21, 2026 · Confirmed3 publishers
- Google opens the Googlebook line at $900 across five laptop makers
Product · September 21, 2026 · One report1 publisher
- Google shipped Gmail on Googlebook OS as a Play Store web wrapper
Product · September 21, 2026 · One report1 publisher