Great hardware let down by software flaws on these pricey machines that combine ChromeOS with Android
Google’s attempt to create a new type of laptop to compete with Windows and macOS machines is finally here, combining the best of ChromeOS and Android into the new Googlebook. With advanced links to Android phones and the best of Google built in, can these Googlebooks really compete with a MacBook Air or Surface Laptop? I took two for a spin to find out.
For years, Chromebooks have been the boss of budget laptops, but Googlebooks take a different, far more premium approach. Made by a range of traditional PC makers, including Acer, Asus, Dell, HP and Lenovo, they start at £999 (€1,099/$899/A$2,299) – a far cry from the £160 Chromebooks.
Laurier, clous de girofle et bâtons de cannelle qui frémissent dans une casserole : la méthode parfume effectivement un logement pendant plusieurs heures, pour quelques centimes. Elle ne purifie en revanche pas l'air et ne neutralise pas les odeurs. Elle en ajoute une autre, plus agréable, ce...
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it.
They chose OpenAI’s GPT-5.6 Sol for the task to demonstrate what’s possible with a publicly available model rather than a specialist security implementation. They used it to search Chrome’s source code, test ideas, and build proofs of concept, while they set the strategy, chose where to look, and checked its work.
They successfully chained together a vulnerability to escape first from the sandbox containing the V8 JavaScript engine and then from Chrome’s operating-system process sandbox, launching a Windows app from within a malicious web page.
Xbow presented its findings to Google, which fixed the flaws. The researchers set out all the details as to how the exploit was developed in a blog.
In a dramatic turn of events, the Chromium team has reversed its Obsolete tag, and has decided to support the format in Blink (the engine behind Chrome/Chromium/Edge). Given Chrome’s position in the browser market share, I predict the format will become a de factor standard for images in the near future.
[…]
I’ve been following JPEG XL since its experimental support in Blink. What started as a promising feature was quickly axed by the team in a bizarre and ridiculous manner. First, they asked the community for feedback on the format. Then, the community responded very positively. And I don’t only mean a couple of guys in their basement. Meta, Intel, Cloudinary, Adobe, ffmpeg, libvips, Krita, and many more. After that came the infamous comment[…]
[…]
To top it off, a couple of weeks ago, the PDF Association announced their intent to adopt JPEG XL as a preferred image format in their PDF specification.
JPEG-XL image support is back in the very latest Google Chrome/Chromium codebase. Back in December they merged jxl-rs as a pure Rust-based JPEG-XL image decoder from the official libjxl organization. At the end of December they did more JPEG-XL plumbing with the enums and build flags for the support.
We’re excited to announce that Chrome is shipping decoding support for the JPEG
XL (.jxl) image format starting from Chrome 155. JPEG XL is a next-generation
image format designed to meet the needs of modern web developers and
photographers. It offers 30-50% better compression than JPEG, lossless
compression, built-in HDR support, lossless JPEG transcoding, and more.
In general, we recommend trying both AVIF and JPEG XL to get the best results.
We expect that JPEG XL is most helpful for high-fidelity or lossless
compression, especially of photographic images or in cases in which fine-grained
progressive decoding is preferred.
The panel looks at macOS 27 ending Time Capsule backup support, then debates Google’s new Android-based laptops and its attempt to build a tighter ecosystem. Other topics include Chrome’s retro-style bookmark launchpad and GM’s geolocation privacy settlement before a deep dive into cloud storage, AWS data loss, redundancy, service agreements, and why cloud storage is […]
International organizations like the Club of Rome are orchestrating a depopulation and neofeudal agenda through engineered crises, including pandemics, wars, and economic manipulation.
A Apple bloqueou recentemente oito certificados vulneráveis que eram utilizados pelo Safari para determinar se uma página da web era legítima ou não — recurso que existe para proteger usuários de cópias baratas de sites feitas para golpes.
De acordo com informações do BleepingComputer, essas chaves privadas foram revogadas pela autoridade certificadora indiana eMudhra após pesquisadores descobrirem que eram tão fracas que qualquer pessoa poderia utilizá-las para forjar um certificado de uma página legítima.
Além do Safari, navegadores populares como o Mozilla Firefox e o Google Chrome também se baseavam nesses certificados para proteger usuários. Em um relatório, inclusive, a Mozilla explicou que todos os oito certificados utilizavam chaves privadas P-384 (geradas em abril de 2025), as quais tinham valores menores que 256 — o que permitia a qualquer pessoa recuperá-las testando apenas 256 possibilidades.
Descoberta primeiro por um pesquisador identificado apenas como Wayne, em 17 de outubro, a vulnerabilidade foi demonstrada no GitHub por outro pesquisador chamado Flüpke, o qual mostrou que uma chave privada para o certificado “EM OV TLS CA – G3C” da eMudhra contava com um valor de apenas 4.
Em uma resposta à Mozilla, desenvolvedora do Firefox, a eMudhra disse que identificou um erro em um script usado para gerar certificados que fazia com que um segundo conjunto de chaves mais fracas fosse gerado — as quais eram, então, selecionadas erroneamente como as chaves definitivas por terem rótulos parecidos com os das chaves corretas.
A autoridade também colocou panos quentes na situação ao afirmar que a maioria dos certificados nunca foi usada em produção e que não encontrou evidências de que o problema tenha afetado usuários finais.
Além do Safari, o Firefox e o Chrome também já revogaram esses certificados.
Macs ainda podem estar vulneráveis
Ainda de acordo com o veículo, Dennis Jackson, engenheiro de criptografia da Mozilla, alertou que o utilitário embutido /usr/bin/curl do macOS poderá continuar confiando nesses certificados vulneráveis, pois o seu bundle de certificados não verifica se os certificados foram revogados.
Isso quer dizer que, caso o Mac já tenha aceitado algum desses certificados, ele continuará confiando nele até que haja uma correção — algo que só poderá ser feito em uma futura atualização de segurança.
O Googleanunciou uma série de novidades envolvendo cibersegurança para o Chrome, incluindo uma nova página de aviso para sites perigosos, proteção contra ataques do tipo ClickFix e uma expansão da detecção de golpes com o Gemini.
Agora, avisos sobre sites maliciosos se dividem entre “sites suspeitos” (quando há uma avaliação com menor grau de confiança, indicando um possível risco de danos ao usuário) e “sites perigosos” (quando há uma avaliação com alto grau de confiança, indicando um risco elevado de danos ao usuário).
Para sites suspeitos, os usuários são apenas notificados, enquanto para sites perigosos o aviso é exibido em um formato de tela inteira com fundo vermelho:
Essa avaliação, feita pelo recurso de Proteção Reforçada, também ganhou novidades, já que o Google migrou a ferramenta para um novo modelo do Gemini, capaz de avaliar o conteúdo das páginas (como a marca representada ou a intenção delas) e, se necessário, enviá-lo à nuvem.
O Google destacou, porém, que o Chrome minimiza a quantidade de dados compartilhados com os servidores, analisando o texto das páginas somente quando um site apresenta indicadores de golpe com alto grau de confiança. Sempre que algo é processado fora do dispositivo, o Google afirma que não registra logs, não armazena essas informações nem treina os modelos de IA da empresa com esses dados.
Além disso, o mesmo recurso passa a oferecer proteção contra golpes do tipo ClickFix (ataques que simulam verificações CAPTCHA para induzir usuários a copiar e colar comandos maliciosos no Terminal do macOS ou no prompt de comando do Windows), detectando automaticamente quando o usuário é induzido a copiar comandos suspeitos, que são “higienizados” antes de serem enviados para a área de transferência da máquina, com a remoção de informações de identificação pessoal (PII), e encaminhados à Navegação Segura para análise adicional. Se o comando for nocivo, um alerta é exibido.
They had crossed most of Persia, climbed snowbound mountains and fought tribes that hurled stones at them from the cliffs. What left them most exposed, only a few days from the sea, was a honeycomb. There was no ambush and no enemy army, just a handful of beehives, some hungry soldiers and a flowering plant […]
Thirty-five thousand spectators. That is the capacity the authors of a new study attribute to the Roman amphitheatre of Itálica, in Santiponce, near Seville in southern Spain. It is roughly the crowd of a mid-sized modern football stadium, and there was not a single loudspeaker in those stands. Whatever happened on the sand had to […]
Brace yourself: The way you get around the web on Android is about to get a whole lot better.
This week, the excellent Vivaldi Android browser is rolling out an update that adds in support for the entire collection of Chrome Web Store browser extensions. That means you can enhance and adjust your mobile web experience with all sorts of interesting — and potentially shape-shifting — new improvements.
Now, with complete Chrome extension support added into the mix on Android, the advantage is growing even greater.
I’ll be honest, though: When I first saw that Vivaldi was adding in Chrome extension support for Android, I wasn’t sure what to make of it. Most of the extensions I use in my desktop browser just wouldn’t make sense on the mobile front and wouldn’t add much of meaningful value in that environment.
But then I put on my thinking cap. I did some deep digging and careful considering. And I found some Chrome extensions that actually work incredibly well in the Android arena and add a lot of interesting value into the mobile web adventure.
This is the first of a two-part collection. Today, we’ll look at five Chrome extensions that you can add into Vivaldi to save yourself steps and bring a welcome efficiency boost to your Android web work. Later this week, we’ll round out the list with another set of extensions that’ll improve the internet itself in some truly intriguing ways.
Ready to reinvent how you experience the web on your phone?
A quick primer on Android Chrome extension installation
Real quick, before we get into the good stuff: When you’re ready to try out an extension, you’ll need to have the latest version of the Vivaldi Android app on your device (obviously, right?) — then either tap the puzzle-shaped extensions icon in the toolbar at the top of the screen, if you see it, or tap the “V”-shaped main menu icon in the upper-right corner and select “Extensions” from there.
Either way you go, you’ll see an option to “Discover more extensions.” That’ll take you to the Chrome Web Store, where you can search or browse through all the available extensions and install anything with a couple quick taps.
I’ll also provide direct links to each extension I’m recommending below, so you can tap it to open it in Vivaldi on your phone and then install it directly from there.
Note, too, that that same Vivaldi Extensions menu is where you can access and manage any installed extensions moving forward. You’ll see every extension you’ve installed there, and you can deactivate or uninstall anything as well as opt to have its icon pinned into your browser toolbar for easy ongoing access.
Chrome Android extension #1: The cookie request crumbler
Our first Android Chrome extension worth considering is one that you won’t ever open or actively think about once you install it and set it up. It’s a tool that works silently in the background to automatically handle those irksome cookie preference prompts that pop up around the web — so they’ll always get answered in the way you prefer, but you’ll never actually have to see or deal with ’em (and have ’em blocking half your view, in a mobile web scenario!) again.
It’s called Consent-o-Matic, and the way it works is simple: You install it, open its options page once to tell it which cookies you do and don’t want to allow around the web — and that’s pretty much it. From there on out, it’ll just click on all those prompts that pop up for you, based on your preferences, and they won’t interfere with your work or irritate you anymore.
Consent-o-Matic remembers your cookie preferences and then applies them for you automatically all over the web.
JR Raphael, Foundry
One option to look at while you’re in that initial setup area is in the “Display” tab at the top of the screen. By default, Consent-O-Matic will show any pop-ups it’s handling in a small overlay in the corner of the screen — but you can eliminate that entirely and make the process completely out of sight and invisible, if you want.
You can make Consent-o-Matic completely invisible so you never so much as see another cookie prompt again.
JR Raphael, Foundry
Yes, please — and thank you.
Chrome Android extension #2: 404 no more
Next is another quietly useful addition, and that’s the official Chrome extension for the Wayback Machineat the Internet Archive.
With the Wayback Machine extension active in your Android web browser, anytime you land on a page that for whatever reason isn’t online anymore or just isn’t available at that particular moment, you’ll see an offer to go to the page’s most recent cached version.
You can also call the extension up on demand to search for older saved versions of any pages by either pinning its icon to your Vivaldi toolbar or long-pressing a link within any page you’re viewing to reveal its menu of options.
The Wayback Machine Chrome extension integrates seamlessly into Vivaldi’s long-press link menu.
JR Raphael, Foundry
Chrome Android extension #3: A background open shortcut
I don’t know about you, but when I’m wading my way around the web, I find myself opening links a lot — often with the intent to look at ’em later.
Typically, that requires long-pressing on the link and then finding the option to open it in a background tab. But with a handy extension called DoubleClicker, that same action can be easier than ever.
Install DoubleClicker into your Android Vivaldi browser, and that’s it: From that moment forward, you can simply double-tap your finger on any link within any page, and it’ll open instantly as a background tab — waiting and ready for when you want it and without any waiting, poking around, or other interruptions to your workflow.
This might just be my favorite addition of all.
Chrome Android extension #4: Hands-free scrolling
The next time you’re reading something on your phone, keep a little somethin’ called Auto Scroll Extension in mind.
As its name suggests, the extension lets you set any speed you like and then simply tap its icon (which works best if you pin it to your toolbar) to automatically scroll the page for you — so you can keep reading without having to do a thing.
Look, ma: No hands! Auto Scroll in action in Vivaldi on Android.
Yes, it’s redundant with having the standalone app installed and set as your system-wide password management service. But it often ends up being faster and easier to have a sign-in handled directly within the browser instead of having to rely on the system-level integration.
And having the browser-based option present doesn’t prevent you from using the other route, either. You’ve just got options, and you can pick whichever feels fastest and easiest to you at any given moment.
Try it out for yourself and see whatcha think. And stay tuned for the second set of worthwhile Android Chrome extensions soon!
All roads lead to Rome. It’s one of the oldest sayings in the Western world, and according to a new study in Nature Communications, it isn’t quite true. Led by Adam Pažout, a researcher at the Autonomous University of Barcelona, the team found that cities like Antioch, Ancyra (modern Ankara), Byzantium (modern Istanbul), and Corinth […]
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct. 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
Deployed rapidly, widely shared
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
Deployed rapidly, widely shared
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.
Chrome will get new updates every two weeks to minimize real-world attacks
Smaller, incremental changes should also make it easier to track any issues
Other major browsers are also shifting to two-weekly release cycles
Google has confirmed that Chrome has officially moved from a four-week Stable release cycle to a two-week one, with effect from September 8 2026 with the launch of Chrome 153.
Besides adding new features, the main objective is for Google to give us performance and security fixes more promptly in an era of increased complexity and heightened vulnerabilities.
And it's exactly those security concerns that pushed Google to want to double Chrome's update frequency in the first lace, with the company now having to deal with a higher volume of patches than ever before.
Chrome will get updates every two weeks
Together with a higher volume of attacks in general, Google has also benefitted from AI-powered vulnerability discovery tools, giving developers more work to do than before. "With automated AI discovery tools and community bug reports generating higher patch volume, shorter release cycles make managing security fixes significantly simpler," the company wrote.
Crucially, the faster cycle reduces the time between a fix landing in Chrome's public codebase and it actually reaching end users, making it less likely for a bug to be exploited in the wild.
Chrome has been adhering to a four-week cycle since 2021, but the world is a very different place in the space of just half a decade.
With the higher pace of releases, Google also anticipates a smaller scope of changes, which could actually be a good thing because it could be easier for developers to identify what went wrong in the event of any issues.
Desktop, Android and iOS versions of Chrome will all be impacted by the change, with Chrome 154 already slated for a September 22 release.
More broadly, Google says Chrome isn't the only browser getting more frequent updates. Microsoft, Mozilla and Brave are also making similar changes, and they're all undergoing those changes right now.
An unexpected discovery by archaeologists has revealed an ancient cult object in the suddenly shallow waters of one of Europe’s longest rivers.
The discovery involves a portion of a limestone altar found near Dunaújváros in Hungary, uncovered during surveys of a riverbed located near Szalki Island.
Taking advantage of unusually low water levels in Europe this summer, archaeologists with the Intercisa Museum and Attila J. Tóth, a diver who specializes in underwater archaeology, had initially been searching for the possible remains of a medieval Pentelic Monastery in a portion of the Danube River.
The current drought conditions in Europe have revealed portions of the riverbed that are normally inaccessible. In recent days, the falling waters of the Danube and other waterways have also revealed several examples of archaeological features left over from the ancient Roman world.
Instead of the Pentelic Monastery they had hoped to find, Intercisa Museum archaeologists uncovered a fragmentary portion of a Roman altar dedicated to Jupiter, whose worship comprised the supreme public religion of ancient Rome.
Additional discoveries included fragments of tablets also made from limestone, adding to the surprises low water levels in the region have helped reveal this summer.
Ancient Intercisa’s Mysteries Emerge
Approximately 1,800 years ago, the Roman settlement of Intercisa was located where Dunaújváros stands today. This ancient military complex formed a significant part of the military infrastructure that connected parts of ancient Europe, and at such sites, it was common for Roman military personnel to establish altars devoted to Jupiter.
In past discoveries, many of these altars display explicit links to the military sites where they were found, including names of personnel, units, or other information linking them to sites like Intercisa, offering a look at the religious devotion undertaken as part of daily life at Roman frontier military outposts.
Discoveries—and Dangers—of Field Archaeology in Europe
Complicating archaeological work in the area had been the additional discovery of what was suspected of being an unexploded World War II munition, although the object was removed so that it could be disarmed.
According to some estimates, there are as many as millions of tons of unexploded ordnance leftover from World War II that are still buried across Europe. Around 10% of all the explosives dropped by Allied and Axis forces reportedly failed to detonate upon impact.
The discovery of these long-dormant explosives is a fairly common occurrence in Europe at construction sites, archaeological digs, and river dredging. The discovery of these objects sometimes also results in emergency evacuations and transit shutdowns.
A View of the Ancient Roman World at Intercisa
Right now, the discoveries are revealing new insights into the known activities that were undertaken at Intercisa.
In the days ahead, archaeologists with the Intercisa Museum hope that additional discoveries can be made while the Danube’s waters remain so low, although they warn that anyone who discovers artifacts in such newly exposed areas of the riverbed must report archaeological discoveries and also be wary of the possible discovery of remnant World War II explosives.
The limestone altar is only one of many archaeological features from the ancient Roman world that drought conditions in Europe have revealed recently in the Danube. Previously, The Debrief also reported that portions of Constantine’s bridge have recently resurfaced from the famous river’s waters.
Archaeologists with the Intercisa Museum also report recent discoveries that include a fragment of a Roman tombstone that still features traces of paint, as well as a large and nearly intact statue that they have retrieved from the Danube’s shallow or empty riverbeds—all of which add to the archaeological heritage that has long been preserved beneath Europe’s waterways.
Micah Hanks is the Editor-in-Chief and Co-Founder of The Debrief. A longtime reporter on science, defense, and technology with a focus on space and astronomy, he can be reached atmicah@thedebrief.org. Follow him on X @MicahHanks, and at micahhanks.com.
Login
