Loading story…
Google Chrome is reportedly downloading a roughly 4GB file, weights.bin, onto some users’ devices as part of its on-device Gemini Nano AI features, prompting complaints that the transfer can occur without clear notice. Reports said the file appears in Chrome user data directories on eligible systems and may be fetched in the background during normal browsing, with one researcher citing a controlled macOS test and filesystem logs that showed Chrome creating the model directory and downloading the payload automatically.
The file is described as part of Chrome’s local AI stack rather than malware, enabling faster processing, offline capabilities, and reduced reliance on cloud services, but critics said users may not realize it has been installed and that deleting it alone may not stop it from returning. Coverage said the download is tied to Chrome’s On-device AI setting, and users seeking to remove it more permanently must delete the file and disable that feature; the practice has also triggered claims that silent multi-gigabyte downloads could raise transparency, privacy, bandwidth, cost, and environmental concerns, including possible scrutiny under EU privacy rules.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
In Chrome 148, Google removed wording from the On-device AI settings toggle that had said the model would not send data to Google servers, triggering new privacy concerns. Google said the text change did not reflect any change in how Chrome's on-device AI works and maintained that model processing remains local to the device.
Coverage on May 6, 2026 said users who remove the weights.bin file may see Chrome download it again unless they disable the relevant On-device AI setting or experimental flags. The reports also highlighted concerns about bandwidth use, transparency, and possible regulatory implications.
Security researcher Alexander Hanff reported that Chrome can create the model directory and download the weights.bin payload in the background without clear user notice or consent. He said a controlled macOS test with a fresh Chrome profile and filesystem event logs supported the claim.
Google made a roughly 4GB on-device AI model file, weights.bin, part of Chrome's Gemini Nano feature set for some users. The file is associated with Chrome's On-device AI capability and may be stored in Chrome user data directories on eligible systems.
Google began rolling out a Chrome Settings > System > On-device AI toggle in February 2026 that lets users disable and remove the Gemini Nano model. Google said that once the feature is disabled, the model will no longer download or update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcearstechnica.com
Open sourcehackread.com
Open sourcewired.com
Open sourceboingboing.net
Open sourcepivot-to-ai.com
Open sourcetomshardware.com
Open sourcezdnet.com
Open sourcethatprivacyguy.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google is testing deeper **Gemini** integration in Chrome via a new internal feature called **“Skills,”** which appears to let users define named, instruction-based automations that Gemini can execute inside the browser. The feature is surfaced through a new `chrome://skills` page and aligns with Google’s stated direction of turning Gemini into a more agent-like assistant capable of acting across tabs and, over time, integrating more tightly with Google services. Separately, Google has added user controls to manage the **on-device GenAI model** used by Chrome’s *Enhanced Protection* (Safe Browsing) capabilities, which were previously upgraded with AI for “real-time” detection of dangerous sites, downloads, and potentially malicious extensions. In Chrome Canary, users can disable *On-device GenAI* under **Chrome → Settings → System**, which also enables deletion of the local model; Google indicated the local model may support additional security and browser features beyond scam detection as it rolls out more broadly.
Jun 29, 2026
Google has acknowledged the significant risk of prompt injection attacks targeting its Gemini-powered Chrome browsing agent, which can be manipulated to perform unauthorized actions such as initiating financial transactions or exfiltrating sensitive data. In response, Google has introduced a second AI model, termed the 'user alignment critic,' designed to independently vet the agent's proposed actions before execution. This model operates in isolation from untrusted web content, providing an additional layer of defense against both goal hijacking and data leakage. The move comes as prompt injection has been identified as a leading vulnerability in AI systems, with industry bodies like OWASP and the UK's National Cyber Security Centre highlighting its prevalence and difficulty to mitigate due to the structural limitations of large language models. The Gemini-powered browsing agent, currently in preview, is capable of navigating websites, clicking buttons, and filling forms while users are logged into sensitive accounts, increasing the potential impact of successful attacks. Security experts and analysts have emphasized the need for robust safeguards, as malicious instructions can be hidden in web pages, iframes, or user-generated content. Google's dual-model approach aims to address these concerns by ensuring that any action not aligned with the user's intent is blocked, thereby reducing the risk of exploitation through prompt injection. The development reflects a broader industry trend of reassessing the security of AI-driven browsers and the need for advanced countermeasures to protect users and organizations from emerging threats.
Jun 29, 2026
A Chrome extension marketed as **"Prompt Optimizer - SecondBrain"** was reported to capture users’ prompts and AI responses across at least nine generative AI platforms, including ChatGPT, Claude, and Gemini, without requiring users to open or interact with the add-on. Researchers said the extension executed at `document_start`, pulled remote configuration from infrastructure tied to `secondbrain.is`, stored a local `userId` and credentials, and transmitted captured conversation data to a vendor ingestion endpoint; the extension was reportedly installed by roughly 100,000 users. Technical artifacts linked to the extension include a Chrome-style extension ID, browser event handling such as `tabs.onUpdated`, and network activity through `window.fetch` and `XMLHttpRequest` to SecondBrain domains associated with ingestion and optimization services. The reported behavior appeared to conflict with the Chrome Web Store privacy declaration that the developer did not collect or use user data, and the presence of `ExtensionInstallBlocklist` in related telemetry suggests some enterprise environments may move to block or monitor the extension while its data-collection practices are scrutinized.
Jul 28, 2026