chrome.security

The multi-layered defenses that harden Chrome against abusive notifications

2026-08-11T00:00:00+00:00

Push notifications are a longstanding part of the open web, allowing developers to engage with users in real-time. However, bad actors have increasingly abused this system, bombarding people with deceptive and unwanted notifications. To combat this, Chrome Security has been on a multi-year journey, in collaboration with Firebase Cloud Messaging (FCM) and Safe Browsing, to significantly reduce notification abuse and improve the security and quality of the web ecosystem for everyone. After achieving a significant reduction in unwanted notification volume, reducing notifications on Android by over 7 billion a day in 2026 alone, today we’re pulling back the curtain on the multi-layered toolkit that secured this critical feature for billions of users.

Stronger with every update: How we’re making Chrome and the web safer in the AI Era

2026-07-30T00:00:00+00:00

We’re living through a massive shift in the software security industry. Large Language Models (LLMs) are unlocking unprecedented capabilities for automated vulnerability discovery, scaling far beyond the limits of human security expertise, and requiring new approaches for staying ahead of attackers. This means deploying AI models at scale to find and fix hundreds of security bugs, faster than ever, with the goal of achieving greater resilience and comprehensive remediation. Here’s how we’re doing it.

Agent security considerations for WebMCP

2026-06-09T00:00:00+00:00

With WebMCP, web developers can build and expose structured tools to AI agents instrumenting the browser, including agents powered by extensions. Agents in the browser can operate within a user’s authenticated session, so it’s critical that agent developers design protections against malicious input from untrusted content. While this threat exists without WebMCP, we’ve identified some of the security techniques that are especially relevant for agents that use WebMCP.

Evolving the Android & Chrome VRPs for the AI Era

2026-04-30T00:00:00+00:00

As the security research landscape evolves with AI, we're making changes in our programs to ensure we're rewarding the most challenging and impactful vulnerabilities in our products. This focus provides the most value to our security teams and helps keep users safe today, all while making sure security researchers continue to be rewarded for their efforts.

Protecting Cookies with Device Bound Session Credentials

2026-04-09T00:00:00+00:00

Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upcoming Chrome release. This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Cultivating a robust and efficient quantum-safe HTTPS

2026-02-27T00:00:00+00:00

Today we’re announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size of quantum-resistant cryptography introduces into TLS connections requiring Certificate Transparency (CT). We recently shared our call to action to secure quantum computing and have written about challenges introduced by quantum-resistant cryptography and some of the steps we’ve taken to address them in earlier blog posts.

Fixing two ITW bugs in Chrome (Kawaiicon 2025)

2025-12-23T00:00:00+00:00

HTTPS certificate industry phasing out less secure domain validation methods

2025-12-10T00:00:00+00:00

Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.

Architecting Security for Agentic Capabilities in Chrome

2025-12-08T00:00:00+00:00

Chrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the preview of agentic capabilities, we want to share our approach and some new innovations to improve the safety of agentic browsing.

HTTPS by default

2025-10-28T00:00:00+00:00

One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Chrome will ask for the user’s permission before the first access to any public site without HTTPS.