GoKawiil
Tech News
In a sponsored Apple @ Work column, IT admin Bradley Chambers argues that while companies have largely solved visibility into which AI applications are installed on managed Macs, browser-based AI tools remain an unmonitored channel for data exposure. He notes device management vendors can already detect and remove unapproved AI apps, but says web-based AI interactions inside Safari or Chrome fall outside that oversight.
Extended Validation (EV) certificates once displayed a green company name in browser address bars to signal verified business identity, but major browsers including Chrome and Firefox have removed that prominent UI, burying certificate details several clicks deep. The piece traces this decline to a mix of factors: users failing to notice or understand the trust indicator, a push by a security-focused nonprofit, and shifts by companies including Stripe, alongside the broader move toward universal encryption via Domain Validation certificates.
The Browser Company has announced it will officially discontinue its Arc browser on December 22, giving users roughly two months to migrate. The company is directing users to its newer browser, Dia, which it says will inherit passwords, bookmarks, extensions, history, Spaces, Folders and Tab Groups from Arc.
The Browser Company announced it will sunset its Arc browser on December 22, 2026, shifting engineering and security resources to its newer browser, Dia. The company says Arc users' passwords, bookmarks, extensions, history, Spaces, Folders and Tab Groups will transfer automatically to Dia, which it claims now exceeds Arc in stability, speed and security.
Google announced new Chrome features that warn users when they land on suspicious or dangerous websites, available through the browser's Enhanced Protection mode. The update targets fake antivirus and browser-update scams with a likelihood score, and counters 'ClickFix' attacks by clearing the clipboard and showing a warning when a site tries to trick users into pasting malicious code.
The real-time auction that places ads is an automated pipeline for running code and targeting individuals. Both properties have been used deliberately.
NordLayer, citing its Browser Security Report 2026, says attackers increasingly compromise SaaS accounts via browser sessions—OAuth token theft, adversary-in-the-middle phishing, malicious extensions—without triggering endpoint detection and response (EDR) alerts because no malicious process or executable touches the host. It cites the 2025 Salesloft Drift breach, where group UNC6395 used stolen OAuth tokens to pull data from Salesforce via API calls, and a 2026 Microsoft-tracked campaign by Storm-2755 using search ads to phish Canadian employees. NordLayer's report found browser access present in all 504 reviewed applications, with 79% accessible only via browser.
A visitor to robertmay.photography encounters an automated browser security verification screen before being redirected to the site. The page states this check runs once every 24 hours to protect the site's cluster services from scrapers and bots.
Security researchers have identified a novel attack technique, dubbed BragJack, that exploits agentic AI assistants embedded directly in web browsers. The attack allows malicious actors to manipulate these assistants into accessing sensitive user information, performing unauthorized actions, and exfiltrating data without the user's knowledge.
Google has shifted Chrome from a four-week to a two-week release schedule, beginning with Chrome 153 rolling out on desktop, iOS, and Android. The company says the change helps it manage a growing volume of security patches driven by AI-assisted bug discovery and faster-moving threats.