chrome

On November 9, 2026, Google released an emergency stable channel update for the desktop Chrome browser, fixing nine security vulnerabilities, including a zero-day vulnerability that was already being exploited in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.8103.5/.51, and to 157.8103.5 on the Linux platform, and will be gradually rolled out over the next few days to weeks. The core focus of this update is the high-risk vulnerability numbered CVE-2026-125350, which is a use-after-free issue in an XML component. Google explicitly stated in the announcement that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, the scale of victims, or attribution of the attack activities.The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the fix. Among the nine fixes, seven are classified as "high risk" and two as "medium risk." In addition to CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also pertains to a use-after-free issue in an XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an actively exploited vulnerability. The other high-risk vulnerabilities include uninitialized resources in WebGL, improper FileSystem authorization, synthesizer buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.Google also confirmed that the Android version of Chrome (157.8103.5) released on the same day includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the update released separately on November 9, with Windows and Mac versions being 156.8078.96, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Security Incident Coordination Centre (GovCERT.HK) issued a security alert on the same day, defining affected systems as versions prior to Chrome 157.8103.5, and pointed out that successful exploitation of the related vulnerabilities could lead to remote code execution, denial of service, tampering, or bypassing security restrictions. The Hong Kong Computer Security Incident Coordination Centre (HKCERT) rated the risk level of this update as "extremely high risk." Google explained in the announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check and trigger the update via "Settings → About Chrome," and restart the browser after completing the update for the patch to take effect. For users still running versions prior to Chrome 157.8103.5, the current priority action is to confirm the version number and restart immediately to complete the upgrade.

On Wednesday, Google announced that the Chrome browser has launched the "Enhanced Autofill" feature, which can call Personal Intelligence through Gemini to retrieve order numbers, logistics tracking information, and flight booking information from users' Gmail, providing autofill suggestions when needed in web forms. This feature is available to U.S. users who have enabled Personal Intelligence, covering desktop, Android, and iOS; Google has not announced the launch time for other countries and regions.In the announcement, Google only listed the three types of data from Gmail mentioned above. Credit card numbers and addresses still fall under Chrome's standard autofill, sourced from information already saved by users in the browser; the announcement did not specify whether the new feature would extract this content from the inbox. Chrome Product Manager Amanda Lim stated that users can manage whether to enable Enhanced Autofill and the data it can access in Chrome settings, with sensitive data being encrypted, allowing users to maintain control.Regarding privacy, Google previously stated that Gemini and AI Mode will not directly use users' Gmail inbox or Google Photos library for training. Users can choose whether to connect the application and can turn it off at any time, but Google will use limited information such as specific prompts and model responses for training. Google also revised its privacy policy on October 16, adding an exception clause: if users choose to provide Gmail, Drive, and Photos content to other Google services that support personalized advertising, the relevant data may be used for personalized ads; Google claims this data is not used for ad targeting by default, and advertisers cannot access this content. Chrome holds about 65% of the browser market share.

The self-custody wallet Kraken Wallet under the cryptocurrency trading platform Kraken announced on X that the Kraken Wallet browser extension is now live. The official source then provided the download link to the Chrome Web Store, allowing users to install and use it in their browsers.Washington Sanchez, the product lead for Kraken Wallet, introduced that the extension supports multiple networks including Bitcoin, Ethereum, Solana, Ink, Base, and Robinhood Chain. Users can create and import wallets using mnemonic phrases or private keys, with private key support including BIP39. Users can also utilize a watch-only wallet or log in using email, Google, Apple, and passkeys. The extension supports single-chain and cross-chain exchanges as well as cross-chain bridging, with a fee of 10 basis points.

According to monitoring by Lookonchain, Monochrome Exchange, an Australian digital asset management company founded by Jeff Yew, former co-founder and CEO of Binance Australia, has launched the MCR token IEO, raising over 5.5 million USDT to date.The total supply of MCR is 210 million tokens, of which 5%, or 10.5 million tokens, are allocated for this public IEO. The IEO tokens will be locked for 1 month after the TGE, followed by a 3-month linear release. MCR holders can enjoy discounts on spot and derivatives trading fees, priority subscription rights for Digital IPOs and token issuances, and can earn rewards through staking, enhance Launchpad quota weight, and participate in node programs, while also engaging in platform governance through Monochrome DAO.20% of the platform's net profit will be used for open market repurchases of MCR and destruction each quarter, while 25% of the Digital IPO fee income will be included in the quarterly repurchase and destruction fund, aiming to continuously reduce the circulating supply of MCR through platform business growth.On September 13, 2021, Monochrome announced the completion of a $1.8 million Series A financing round, co-led by Litecoin founder Charlie Lee, Blockstream Chief Strategy Officer Samson Mow, former Binance Chief Financial Officer Wei Zhou, and founders of Blueshyft and DeFi protocol Synthetix, Kain Warwick, with a post-investment valuation of approximately $15 million.On August 18, 2022, Monochrome Asset Management obtained the country's first financial services license (AFSL), which will be used to issue cryptocurrency-related exchange-traded funds (ETFs).

According to Decrypt, Google has fixed a high-severity vulnerability CVE-2026-85046 in the Chrome browser that was exploited by hackers. This vulnerability exists in the V8 engine, which is used to run JavaScript and WebAssembly.Google confirmed that the vulnerability has been exploited in the wild but did not disclose the identity of the attackers, the targets, or the specific method of exploitation. The patch has been included in Chrome versions 152.7977.82/83 and will be pushed out in the coming days or weeks.The vulnerability was reported by security researcher Salvatore Gulizia on August 4, and Google awarded him a $1,000 bug bounty. This update includes a total of 12 security fixes, of which 9 are high-severity and 2 are medium-severity. Google has not yet linked this vulnerability to cryptocurrency asset theft incidents, but browser wallets, exchange accounts, and trading extensions have previously been targeted in other ways.

According to the latest official announcement from the Chrome Web Store, the platform will officially implement the updated Developer Program Policy starting August 1, 2026. This update clearly delineates boundaries for regulated goods and services, listing "prediction markets" as a prohibited product category, strictly prohibiting any extensions from offering, facilitating, or supporting real-money trading based on prediction results.In addition, the new regulations further tighten data privacy and AI safety standards. The policy requires that user data collected by extensions must be strictly and exclusively used for the single purpose disclosed; if there is a change in data processing methods, users must be proactively notified. At the same time, extensions designed to circumvent AI-driven service safety protections, usage restrictions, and other protective mechanisms are explicitly prohibited. After August 1, if any extensions are found to be non-compliant with the above policies, the Chrome Web Store will take enforcement actions.

SlowMist has issued a security warning stating that a high-risk phishing activity targeting TRON wallet users has been discovered. Attackers created a fake Chrome extension for the TronLink wallet, using Unicode bidirectional control characters and Cyrillic homographs to disguise the brand name. After installation, the extension loads a complete phishing page through a remote iframe, forming a "shell-core separation" credential theft chain.The malicious extension name uses homographs for disguise, and its Chrome Store page inherits the high user count and positive reviews of the real extension, lowering the review threshold. There is very little local code, only loading remote pages, making static analysis nearly impossible to detect malicious behavior. The remote phishing page perfectly replicates the official TronLink web wallet interface, stealing mnemonic phrases, private keys, Keystore files, and passwords, and relaying them in real-time via a Telegram Bot.Built-in anti-analysis features disable right-click, developer tools, drag-and-drop, and printing, and redirect based on the geographic and language settings of Russian users to evade detection. SlowMist recommends immediately uninstalling suspicious extensions, clearing local storage, checking for abnormal traffic, and if credentials have been entered, creating a new wallet and transferring assets immediately.

According to GoPlus citing a Koi report, the Claude Chrome extension under Anthropic has a high-risk prompt injection vulnerability, affecting all versions of the extension below 1.41.Attackers can construct malicious web pages that silently load an iframe containing a cross-site scripting (XSS) vulnerability in the background, executing malicious payloads within the a-cdn.claude.ai subdomain. Since this subdomain is on the extension's trust whitelist, attackers can directly send malicious prompts to the Claude extension and execute them automatically, without requiring user authorization or any clicks, leaving the victim unaware.This vulnerability can allow attackers to manipulate the Claude extension to read users' Google Drive documents, steal business access tokens, or export chat logs, and can take over the current browser session to perform sensitive operations like sending emails as the victim. GoPlus recommends that users immediately update the Claude extension to version 1.41 or above and remain vigilant against phishing links.

The Chief Information Security Officer of Slow Fog Technology, 23pds, issued a reminder to be wary of fake imToken Chrome extensions. A fake imToken Chrome extension in the Chrome Web Store is phishing for seed phrases and private keys.

GoPlus has released a security alert that a vulnerability in the Chrome browser allows malicious extensions to escalate privileges through the Gemini panel. Please upgrade your Chrome browser to version 143.7499.192 or above immediately.This vulnerability allows malicious extensions to control the Gemini Live panel in the Chrome browser, thereby escalating privileges to access the camera and microphone, take screenshots, access local files, and more without user consent. The vulnerability is identified as CVE-2026-0628, and Google has fixed it in the Windows/Mac versions 143.7499.192/.193 and the Linux version 143.7499.192 at the beginning of January 2026. Please check and upgrade your Chrome version immediately.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) has disclosed that its holdings have reached 1,248 Bitcoins, with a total market value exceeding 120 million AUD.

According to a report from the security agency Socket's Threat Research Team, a malicious Chrome extension named "MEXC API Automator" has been available in the Chrome Web Store since September 1, 2025, capable of stealing users' newly created API keys from the cryptocurrency exchange MEXC and sending them to a Telegram bot controlled by the attacker.The extension lures users with the promise of trading automation, automatically generating MEXC API keys with withdrawal permissions without the user's knowledge, while hiding the display of these permissions in the interface, subsequently leaking the keys along with their ciphertext. This allows attackers to gain complete control over the victim's MEXC account, executing trades, initiating automatic withdrawal operations, and transferring assets within the account. As of the report's publication, the extension is still available for download in the Chrome Web Store, and the research team has reported and flagged this extension to Google.

Trust Wallet posted on X platform that the browser extension is now back on the Chrome Web Store. Additionally, version 2.71.0 has been released, which includes support for customer service verification codes to assist with the claims process.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) has disclosed a holding of 1,203 bitcoins, with a holding market value exceeding 170 million Australian dollars.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) has disclosed a reduction of 29 bitcoins in its holdings, now reporting a total of 1,133 bitcoins, with a holding market value of approximately 155 million AUD.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) disclosed that as of November 28, the holdings have reached 1,161 Bitcoins, with a market value exceeding 162 million Australian dollars.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) disclosed that as of November 28, its holdings have reached 1,161 Bitcoins, with a total market value exceeding 162 million AUD.

According to the official announcement, Australia's Monochrome spot Bitcoin ETF (IBTC) has disclosed that its holdings have reached 1,158 bitcoins, with a total market value exceeding 161 million AUD.

According to Cointelegraph, cybersecurity company Socket has discovered a malicious Chrome extension called "Crypto Copilot" that is secretly stealing funds from users' Solana transactions.The extension allows users to conduct Solana transactions directly from the X social media platform, but it injects additional instructions into each transaction, siphoning off at least 0.0013 SOL or 0.05% of the transaction amount. Unlike typical wallet-draining malware, Crypto Copilot executes transactions using the Raydium decentralized exchange while adding a second instruction to transfer SOL to the attacker's wallet, with the user interface only displaying a transaction summary, hiding the separate operational instructions. Since its release on June 18, 2024, the extension currently has only 15 users. Socket has submitted a takedown request to the Chrome Web Store security team. Security experts warn users that the Chrome extension ecosystem has long been a popular target for cryptocurrency scams due to its large user base and scalable design.

According to the GoPlus Chinese community, a malicious Chrome extension named "Safery: Ethereum Wallet" has been discovered, which is stealing user assets. This extension was released on November 12, 2024, disguised as a simple and secure Ethereum wallet, but it contains a built-in backdoor.The attack method is highly covert: the malicious extension encodes the user's mnemonic phrase into a Sui address and broadcasts microtransactions through a Sui wallet controlled by the attacker to steal the mnemonic phrase. The attacker's email is kifagusertyna@gmail[.]com. Currently, this malicious extension has not been removed from the Chrome Web Store.