Loading story…
Google released Chrome 152 to the stable channel for Android, ChromeOS, Linux, macOS, and Windows, adding Connection Allowlists, the CPU Performance API, and a bypassable suspicious-site warning for Safe Browsing Enhanced Protection users. The warning appears when Chrome detects signals that a visited site may be malicious, while the release also expands support for CSSPseudoElement APIs and introduces web-platform, PWA, networking, media, and WebGPU changes.
Connection Allowlists let sites use the Connection-Allowlist HTTP response header to restrict the URL patterns that documents and web workers can contact. Chrome blocks non-allowlisted subresource requests, redirects, WebSocket connections, and other covered network activity at the network layer, limiting data-exfiltration opportunities from compromised third-party scripts, vulnerable dependencies, and untrusted generated code. The control complements, rather than replaces, Content Security Policy; it follows an origin trial that initially covered document contexts and did not support dedicated, shared, or service workers.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Google released Chrome 152 to the stable channel for Android, ChromeOS, Linux, macOS, and Windows. The release shipped Connection Allowlists for restricting document and worker network endpoints, introduced the CPU Performance API, and added bypassable suspicious-site warnings for Safe Browsing Enhanced Protection users.
Chrome announced an origin trial for Connection Allowlists, a deny-by-default HTTP-header mechanism that blocks network connections not matching a site's permitted URL patterns. The trial was scheduled for Chrome 148 through 151, initially supporting document contexts only.
Google Chrome published an early, unapproved proposal for a CPU Performance API exposing a coarse static CPU-performance tier through navigator.cpuPerformance. The proposal defines broad performance buckets and HTTPS-only access to limit fingerprinting, while positioning Compute Pressure as the complementary dynamic-load API.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
developer.chrome.com
Open sourcedeveloper.chrome.com
Open sourcegithub.com
Open sourcedeveloper.mozilla.org
Open sourcedeveloper.chrome.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome 154 for Windows, macOS, and Linux, fixing **108 vulnerabilities**, including 11 critical memory-safety defects that malicious web content could potentially exploit for crashes, information disclosure, or attacker-controlled code execution. The critical issues include buffer overflows, out-of-bounds writes, and use-after-free conditions in ANGLE, WebGL, GPU components, ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Updated builds are rolling out as `154.0.8037.57` for Linux and `154.0.8037.57/.58` for Windows and macOS. The release also addresses browser-boundary and data-exposure weaknesses affecting V8, WebGPU, CORS, credential previews, extensions, DevTools, WebView, WebNFC, DRM capture controls, Android WebAPKs, and the macOS updater. Notable fixes prevent cross-origin GPU shader and framebuffer-memory disclosure, a CORS preflight-cache bypass that could enable blind CSRF-style state changes, cross-domain username leakage from grouped credentials, extension isolated-world boundary breaches, DevTools privilege escalation, and a Qualcomm GPU-driver-triggered write crash. Organizations should expedite Chrome updates across managed endpoints and ensure separately deployed Google Updater components are current on macOS.
Sep 29, 2026
Google announced that starting with Chrome version 154, the browser will default to using secure HTTPS connections for all public websites, warning users before they access any site that does not support HTTPS. This change is part of the new 'Always Use Secure Connections' feature, which aims to make secure browsing the standard and will require user approval before opening insecure HTTP sites. Internal addresses such as routers, intranets, and servers will be exempt from these warnings due to their lower risk profile. The rollout will begin in April 2026 with Chrome 147 for Enhanced Safe Browsing users and expand globally in October 2026. Google cited the significant increase in HTTPS adoption, from 30-45% of Chrome traffic in 2015 to 95-99% by 2020, as a key factor enabling this shift. Early testing indicated that fewer than 3% of visits triggered warnings, suggesting most sites are already compliant. Google plans to further reduce barriers to HTTPS adoption, especially for local network sites, to enhance user security against potential attackers exploiting insecure connections.
Jun 29, 2026
Google has released **Chrome 151** to the stable channel, delivering a mix of user-facing, enterprise, and developer changes in the Chromium-based browser. The update adds new **Gemini** AI integrations, expands **Safe Browsing** protections, and improves PDF handling, while Google continues to distinguish Chrome from upstream Chromium through bundled components such as Google API integration, DRM support, and other Chrome-specific services. The release also keeps the **Extended Stable** channel available and indicates that **Chrome 152** is planned as the next major version. Chrome 151 also advances Google's transition away from legacy extensions by further restricting **Manifest V2** add-ons, though enterprises retain a temporary policy option to allow older MV2 extensions during migration. On the platform side, the browser drops support for **macOS 12** and now targets **macOS 13+**, while additional legacy browser features and APIs are being removed or deprecated, including older XML/XSLT-related functionality. The release further introduces web-platform updates for developers, including new HTML and `PerformanceObserver` capabilities, alongside broader changes affecting Windows, Linux, and macOS deployments.
Jul 30, 2026