Chrome is being bombarded with new features and headlines: AI-powered shortcuts, in-browser assistant trials , mobile interface changes, and, incidentally, a serious security warning for a very popular extension . All this at a time when competitors and regulators are scrutinizing Google's browser's dominance.
In the last few hours, we've seen Gemini launched from the address bar , Claude tested as a sidebar browser, and Chrome for Android finally launching a long-awaited feature. Meanwhile, an independent investigation has revealed that a free VPN in Chrome was acting as spyware, taking screenshots without warning, and the debate is growing over the amount of data the browser collects.
AI integrated into everyday life: Gemini and Claude sneak into Chrome
Google has enabled a shortcut to consult its AI: simply type @gemini in the omnibox , press space, and ask your question. The request is sent, and the Gemini website automatically opens with the answer already in progress—a quick way to avoid intermediate steps when you need help at a specific time.
It's important to understand that, for now, this shortcut isn't a full integration : it doesn't leverage the context of the tab you're viewing, nor does it proactively affect the current page. It's literally a shortcut to the assistant, while the rest of the AI features are being rolled out gradually.
- In the address bar, type @gemini and press space.
- Introduce your question or prompt; then confirm with Enter.
- A tab will open with Gemini and the response will begin to be generated without extra steps.
Meanwhile, Anthropic is testing Claude for Chrome as an extension . The agent adds a side panel for conversation, requesting searches, or delegating tasks such as summarizing articles, filling out forms, or navigating between related tabs. Currently, access is limited to a thousand users on the Max plan, which has a high monthly fee, while others can join a waiting list.
This approach offers advantages, but also well-known risks within the security community: injections of hidden instructions into web pages when an agent monitors tabs and forms. Anthropic claims to have added defenses, default blocking of sensitive sites (finance, adult, or pirated content), and requests explicit permissions before taking any high-impact actions.
For its part, Google is continuing to test Chrome AI Mode in some countries (Spain is not among them for now), as part of a race to integrate conversational capabilities into the browser itself without requiring users to open external tools.
Security under the spotlight: A VPN extension was capturing your screen
Researchers at Koi Security have identified FreeVPN.One , a popular Chrome Web Store extension, as taking automatic screenshots and sending them to remote servers without clear user notification. The mechanism was as silent as it was effective: it injected scripts, waited a mere 1,1 seconds after loading, and then triggered a screenshot using a Chrome API.
The analysis revealed that the plugin's evolution was gradual: first, it requested broad permissions to view all pages ; then it added script execution; and finally, it activated persistent captures. All of this was accompanied by messages aimed at "improving compatibility" or "strengthening security."
- April: permission to access all open pages.
- June: capacity for inject and execute scripts anywhere.
- July: function of automatic captures per tab and remote shipping.
To provide cover, the extension displayed a toggle called “ AI Threat Detection ” that normalized sending screenshots “for security purposes.” Researchers found that even without enabling this option, outbound traffic existed and affected legitimate services like Google Photos and Google Sheets.
In addition to concerns about its behavior, it was surprising that the add-on displayed a prominent badge in the store, which may have created a false sense of trust. The advice is clear: if you have FreeVPN.One installed on Chrome or Chromium-based browsers, uninstall it as soon as possible.
- Catches could include forms with sensitive data.
- Open documents in spreadsheets corporations.
- Private images hosted in the cloud.
- Visible conversations in chat windows.
To complicate detection, the traffic was encrypted with AES-256-GCM and RSA wrapping , which doesn't protect the user but makes exfiltration harder to identify. The requests for read permissions on all URLs, tab control, and script execution were, taken together, disproportionate for a simple VPN.
Usage and privacy updates: Android bottom bar and data
In terms of usability, Chrome 139 for Android finally adds the option to move the address bar to the bottom . To activate it, go to Settings > Address bar and choose position. On large screens, reaching the top with one hand can be awkward; with the bar at the bottom, switching tabs and accessing the menu is much more convenient.
The change, simple but welcome, brings the Chrome experience closer to what Safari on iOS or Firefox already offered, and several Chromium-based browsers, such as Brave , are adopting it as well. It's surprising that this option arrived on iOS before Android itself, where it's most sorely missed due to the size of current phones.
Meanwhile, an analysis by the cybersecurity firm Surfshark points out that Chrome collects up to 20 types of data , from browsing history and location to payment methods and contact lists, surpassing other popular browsers. Some of this information is used for third-party advertising, reigniting the debate about the balance between functionality and privacy.
This amount of concentrated information means that, in the event of a breach, the impact could be greater. Therefore, it's advisable to review your account's data preferences , reduce unnecessary permissions, and consider alternatives if minimizing tracking is your top priority.
Context: An impossible purchase attempt and the race for the browser
At the height of the AI frenzy, Perplexity even considered acquiring Chrome for $34.500 billion , a move far exceeding its valuation and hardly feasible. Google closed ranks: Sundar Pichai argued that forcing a sale would jeopardize the product's security and innovative capabilities, while the debate over market power in search continues in US courts.
The interest is not accidental: browsers with agents that read the screen, summarize, and automate tasks promise to change how we interact with the web. Perplexity launched its own Chromium-based browser, OpenAI is preparing its own, and Google is accelerating with Gemini and AI testing in Chrome. The issue is no longer just accessing pages, but turning the browser into a useful, fast, and secure assistant.
Today, Chrome is advancing AI-powered features, fine-tuning details to improve mobile usability, and addressing security and privacy challenges that cannot be ignored. The key will be maintaining a balance between the convenience of having everything integrated, responsiveness, and clear guarantees for user data.
