Megan Ellis / Android Authority

I prefer Brave, but I was tethered to Chrome

Megan Ellis / Android Authority

I’m glad I switched to Brave, but password management on Android kept me tethered to Chrome.

Google Password Manager app makes accessing Android passwords easier

Megan Ellis / Android Authority

Google’s Password Manager app works even if you have Chrome disabled on your smartphone.

I may eventually move to a different password manager

Calvin Wankhede / Android Authority

Google has released an emergency security update to fix the third Chrome zero-day vulnerability exploited in attacks since the start of the year.

“Google is aware that an exploit for CVE-2025-5419 exists in the wild,” the company warned in a security advisory published on Monday.

This high-severity vulnerability is caused by an out-of-bounds read and write weakness in Chrome’s V8 JavaScript engine, reported one week ago by Clement Lecigne and Benoît Sevens of Google’s Threat Analysis Group.

Google says the issue was mitigated one day later by a configuration change the company pushed to the Stable channel across all Chrome platforms.

On Monday, it also fixed the zero-day with the release of 137.0.7151.68/.69 for Windows/Mac and 137.0.7151.68 for Linux, versions that are rolling out to users in the Stable Desktop channel over the coming weeks.

While Chrome will automatically update when new security patches are available, users can speed up the process by going to the Chrome menu > Help > About Google Chrome, letting the update finish, and clicking the ‘Relaunch’ button to install it immediately.

​While Google has already confirmed that CVE-2025-5419 is being exploited in the wild, the company will not share additional information regarding these attacks until more users have patched their browsers.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google said. “We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

This is Google’s third Chrome zero-day vulnerability since the start of the year, with two more patched in March and May.

The first, a high-severity sandbox escape flaw (CVE-2025-2783) discovered by Kaspersky’s Boris Larin and Igor Kuznetsov, was used to deploy malware in espionage attacks targeting Russian government organizations and media outlets.

The company released another set of emergency security updates in May to patch a Chrome zero-day that could let attackers take over accounts following successful exploitation.

Last year, Google patched 10 zero-days that were either demoed during the Pwn2Own hacking competition or exploited in attacks.

Google has released emergency security updates to patch a high-severity vulnerability in the Chrome web browser that could lead to full account takeover following successful exploitation.

While it’s unclear if this security flaw has been used in attacks, the company warned that it has a public exploit, which is how it usually hints at active exploitation.

“Google is aware of reports that an exploit for CVE-2025-4664 exists in the wild,” Google said in a Wednesday security advisory.

The vulnerability was discovered by Solidlab security researcher Vsevolod Kokorin and is described as an insufficient policy enforcement in Google Chrome’s Loader component that lets remote attackers leak cross-origin data via maliciously crafted HTML pages.

“You probably know that unlike other browsers, Chrome resolves the Link header on subresource requests. But what’s the problem? The issue is that the Link header can set a referrer-policy. We can specify unsafe-url and capture the full query parameters,” Kokorin explained.

“Query parameters can contain sensitive data – for example, in OAuth flows, this might lead to an Account Takeover. Developers rarely consider the possibility of stealing query parameters via an image from a 3rd-party resource.”

​Google fixed the flaw for users in the Stable Desktop channel, with patched versions (136.0.7103.113 for Windows/Linux and 136.0.7103.114 for macOS) rolling out to users worldwide.

Although the company says the security updates will roll out over the coming days and weeks, they were immediately available when BleepingComputer checked for updates.

Users who don’t want to update Chrome manually can also let the browser automatically check for new updates and install them after the next launch.

In March, ​Google also fixed a high-severity Chrome zero-day bug (CVE-2025-2783) that was abused to deploy malware in espionage attacks targeting Russian government organizations, media outlets, and educational institutions.

Kaspersky researchers who discovered the actively exploited zero-day said that the attackers use CVE-2025-2783 exploits to bypass Chrome sandbox protections and infect targets with malware.

Last year, Google patched 10 zero-days disclosed during the Pwn2Own hacking competition or exploited in attacks.

What you need to know

• Google is working on a desktop-style Chrome for Android with extension support, something mobile Chrome has been missing.
• This new version is designed for larger Android devices like Chromebooks, and it’s a big step toward closing the gap between mobile and desktop browsing.
• It’s still a bit rough—no easy way to manage extensions, no toolbar button, and installing them isn’t as smooth as on desktop.

Google is apparently working on a unique version of Chrome for Android with a full-fledged desktop-style interface. This version stands out by finally bringing browser extension support, something the current mobile Chrome completely lacks.

Google Chrome might be huge on Android, but it has always lagged behind its desktop version, especially when it comes to extensions. Now, Google is working on changing that with a desktop-class Chrome for Android, finally bringing extension support into the mix, as per Mishaal Rahman over at Android Authority.

Thanks to a recent code tweak, users can now manually install extensions by simply dragging and dropping .crx files into the chrome://extensions page.

Built for big screens

True to its name and the reports from late 2024, the Desktop Android version of Chrome is built to bring the browser’s core features to large-screen Android devices, including Chromebooks and other computers. With Chrome OS on its way out, a solid replacement is more important than ever.

Rahman has been putting these test Chrome builds through their paces, and the results speak for themselves. He’s already got extensions like Dark Reader, Keepa, and uBlock Origin up and running, proving that an Android-based Chrome can fully support extensions.

Despite the progress, there are still a few hiccups. For one, users can’t access extension settings yet, and there’s no toolbar button to easily toggle extensions. Additionally, without a Chrome Web Store equivalent for Android, installing extensions still feels a bit basic. It works, but it’s definitely not polished.

It appears that Google is currently putting all its energy into just making extensions work at all. So, to check on or manage your extensions, you’ll need to head straight to the chrome://extensions page.

Regular phones? Don’t hold your breath

Adding extension support to Chrome for Android is a big step toward matching the desktop browsing experience. Sure, it’s still a bit rough around the edges, but make no mistake: this is the foundation for something huge.

That said, these changes probably won’t lead to extensions being available on Chrome for regular Android phones. Google has purposely stayed away from adding extension support on Android, unlike Firefox and Microsoft Edge, signaling a clear strategy behind the decision.

Microsoft researchers have identified a new remote access trojan (RAT) named StilachiRAT, designed to steal cryptocurrency wallet data, credentials, and system information while maintaining persistent access to compromised devices, the company disclosed on March 17.

The malware, first detected in November 2024, employs stealth techniques and anti-forensic measures to evade detection.

While Microsoft has not yet attributed StilachiRAT to a known threat actor, security experts warn that its capabilities could pose a significant cybersecurity risk, particularly to users handling crypto.

Sophisticated threat

StilachiRAT is capable of scanning for and extracting data from 20 different cryptocurrency wallet extensions in Google Chrome, including MetaMask, Trust Wallet, and Coinbase Wallet, allowing attackers to access stored funds.

Additionally, the malware decrypts saved Chrome passwords, monitors clipboard activity for sensitive financial data, and establishes remote command-and-control (C2) connections via TCP ports 53, 443, and 16000 to execute commands on infected machines.

The RAT also monitors active Remote Desktop Protocol (RDP) sessions, impersonates users by duplicating security tokens, and enables lateral movement across networks — an especially dangerous feature for enterprise environments.

Persistence mechanisms include modifying Windows service settings and launching watchdog threads to reinstate itself if removed.

To further evade detection, StilachiRAT clears system event logs, disguises API calls, and delays its initial connection to C2 servers by two hours. It also searches for analysis tools such as tcpview.exe and halts execution if they are present, making forensic analysis more difficult.

Mitigation strategies and response

Microsoft advised users to download software only from official sources, as malware like StilachiRAT can masquerade as legitimate applications.

The company also recommended enabling network protection in Microsoft Defender for Endpoint and activating Safe Links and Safe Attachments in Microsoft 365 to guard against phishing-based malware distribution.

Microsoft Defender XDR has been updated to detect StilachiRAT activity. Security professionals are urged to monitor network traffic for unusual connections, inspect system modifications, and track unauthorized service installations that could indicate an infection.

While Microsoft has not observed widespread distribution of StilachiRAT, the company warned that threat actors frequently evolve their malware to bypass security measures. Microsoft said it is continuing to monitor the threat and will provide further updates through its Threat Intelligence Blog.

Mentioned in this article

Google continues its rollout of gradually disabling uBlock Origin and other Manifest V2-based extensions in the Chrome web browser as part of its efforts to push users to Manifest V3-based extensions.

For those unaware, Manifest V3 is Chrome’s latest extension specification and is designed to limit extension access to user network requests, block developers from utilizing remote content, and improve overall performance.

While Manifest V3 is supposed to benefit end users, it comes at the cost of functionality, as it imposes stricter limitations on browser extensions, particularly ad blockers and privacy-focused tools.

Due to this, some immensely popular Google Chrome extensions, like uBlock Origin, are now gradually being automatically turned off in users’ browsers worldwide.

Just today, some of BleepingComputer’s devices found that uBlock Origin was automatically disabled, stating it was no longer supported. Our only options were to remove the extension or manage it. 

While the first option removes the extension from Chrome, the second simply redirects you to the extensions page.

In a Reddit thread from yesterday, other Google Chrome users also pointed out that uBlock Origin and other unsupported extensions are now automatically being turned off.

However, this does not appear to be the case for everyone, as some devices used by BleepingComputer continue to use uBlock without any issues.

Google is gradually killing off Manifest V2 extensions

Google has previously told BleepingComputer that the disabling of Manifest V2 extensions is a gradual rollout process, which is why the extensions may still work for some users. 

For those who need more time, Google will let the enterprise and certain users continue using Manifest V2 extensions until June 2025 through a special group policy. For everyone else, the rollout of Manifest V3 is already in progress, and Chrome will keep encouraging users to move away from older extensions.

If you’re affected by Google’s Manifest V2 deprecation, you can switch to Manifest V3-supported extensions, such as the uBlock Origin Lite (uBOL), which the uBlock Origin developer has created.

However, if you prefer uBlock Origin’s advanced filtering, you may find the Lite version too limited.

BleepingComputer emailed Google with questions about this gradual rollout, why it was done this way, and when the rollout will be completed. We will update the story if we receive a response.