ByZak Doffman

ByZak Doffman,
Contributor.
Update nbow warning for 2 billion Chrome users
Republished on May 18 with update now deployed to most users and warnings on the critical step all users must take to make sure their browsers are secure.
Google has warned that Chrome is open to attack, and has rushed out a fix for a vulnerability that enables a hacker to steal login credentials and bypass multi-factor authentication. It’s a critical issue, and it’s imperative it’s fixed immediately. The U.S. government has now mandated all federal staff to update by June 5. Whether you’re a home or enterprise user, you should do the same.
America’s cyber defense agency has told all federal agency staff to “apply mitigations per vendor instructions… or discontinue use of the product if mitigations are unavailable.” That means update inside the next 21 days or stop using your browser until you do.
CISA’s formal mandate only applies to federal employees, but its remit extends to all organizations, “to help [them]

better manage vulnerabilities and keep pace with threat activity.” Given the nature of this threat, users should act now. CISA issues plenty of such mandates, but given Chrome’s install base and that this threat is now in the public domain, it really is critical for you to follow suit.
Although the binding operational directive only applies to federal staff, CISA “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management.”
As I warned yesterday, Google’s fix for CVE-2025-4664 came with a warning “of reports that an exploit exists in the wild.” This was flagged on X by @slonser_, after discovering that “a technique that’s probably not widely known in the community” enabled a query parameter takeover that could exploit sensitive data included in the string. “In OAuth flows, this might lead to an Account Takeover” if that query parameter is stolen.
This means stealing the text string from Chrome that includes security session credentials after you’ve logged into a service. It enables an attacker to replicate the secure session on their own device.
Per SC Media, “its inclusion in the KEV catalog indicates the attackers have attempted to misuse the flaw in the wild.” But it’s unclear whether the flagged exploit is the POC raised or there are actual attacks underway with bad actors having identified the vulnerability independently. It doesn’t matter now. This is in the public domain. We’re now in the period of maximum risk as attackers strike before browsers are patched.”
Cybersecurity News warns “the vulnerability stems from an incorrect handle provided under unspecified circumstances in Chrome’s Mojo Inter-Process Communication (IPC) layer, potentially leading to unauthorized code execution or sandbox escape. The vulnerability poses significant risks, including unauthorized data leakage across web origins… Given its classification as a zero-day flaw, it was exploited before Google released the patch, heightening the urgency for mitigation.”
Check your Chrome browser for the notification an update has been downloaded and you need to relaunch to ensure it installs. You’re looking for Chrome version 136.0.7103.113/.114. Do this as soon as you can — don’t let dozens of open tabs hold you back. With this vulnerability, it is imperative to patch now.
The same update warning also applies to Microsoft Edge. “This CVE was assigned by Chrome,” the Windows-maker has confirmed, but given “Microsoft Edge (Chromium-based) ingests Chromium,” that fix also “addresses this vulnerability.”
There’s a good explainer on this vulnerability now available courtesy of Cyber-AppSec on Medium. “This flaw affects Chrome’s Loader component and could allow attackers to steal sensitive data from other websites — all through a crafty little trick involving the Link header.” While “most browsers don’t pay much attention to Link headers on these kinds of requests,” Chrome does, which enables the attacker to trick the browser into sending your session security info included in a full URL to their own server.
That attack is now in the public domain. While Google’s warning advised this urgent update “will roll out over the coming days/weeks,” it should be available to you now — most users have it. It’s not surprising it has been deployed quickly, given the short space of time between the public disclosure and the update, and CISA’s update mandate. But automatically downloading the software is not enough. As the Chrome ecosystem is being warned (1,2), “all Chrome users must 'relaunch’ their browser now."
Why the need to relaunch? As Google explains, “normally updates happen in the background when you close and reopen your computer’s browser. But if you haven’t closed your browser in a while, you might see a pending update.
While Chrome “saves your opened tabs and windows and reopens them automatically when it restarts,” that’s not the case for Incognito tabs which “won’t reopen when Chrome restarts.” Google says “if you don’t want to restart straight away, select Not now,” which means "the update applies the next time that you restart Chrome. But given this is a fix for an active attack, that’s not recommended this time around.

source

Google I/O, the search giant’s annual developer conference, kicks off on Tuesday, May 20. The event is arguably the most important on the company’s annual calendar, offering the opportunity for the company to share a glimpse at everything it has been working on over the past year — and contextualize its biggest priorities for the next twelve months.
The dance card for Google I/O was apparently so packed that the company spun off a dedicated Android showcase a whole week earlier. (See everything that was announced at the Android Show or go to our liveblog to get a feel for how things played out.) With that event now behind us, Google can stay focused on its most important core competency: AI.
Google’s presentation will come on the heels of announcements from three big rivals in recent days. Further up the Pacific coast, Microsoft is hosting its Build developer conference, where it’s already unveiled an updated Copilot AI app. Meanwhile, at the Computex show in Taiwan, NVIDIA CEO Jensen Huang highlighted a partnership with Foxconn to develop an “AI factory supercomputer” powered by 10,000 Blackwell AI chips. And Meta held its debut LlamaCon AI conference last month, but CEO Mark Zuckerberg’s plans for AI dominance have reportedly since hit some snags. (Apple will share its updated AI roadmap on June 9 when its WWDC developers conference kicks off.)
If you’d like to tune in from home and follow along as Google makes its announcements, check out our article on how to watch the Google I/O 2025 keynote. We’ll also be liveblogging the event, so you can just come to Engadget for the breaking news.
The presentation featured Android Ecosystem President Sameer Samat, who took over for Burke in 2024. We saw Samat and his colleagues show off years, Android hasn’t had much of a spotlight at Google’s annual developer conference. Thankfully, last week’s Android Show breakout let Google’s mobile operating system take the spotlight for at least a day.
The presentation featured Android Ecosystem President Sameer Samat, who took over for Burke in 2024. We saw Samat and his colleagues show off the new Material 3 Expressive design, and what we learned confirmed some of the features that were previously leaked, like the “Ongoing notifications” bar. Material 3 Expressive is also coming to Wear OS 6, and the company is expanding the reach of Gemini by bringing it to its smartwatch platform, Android Auto and Google TV. Android is also amping up its scam-detection features and a refined Find Hub that will see support for satellite connectivity later in the year.
Speaking of timing, Google has already confirmed the new operating system will arrive sometime before the second half of the year. Though it did not release a stable build of Android 16 today, Samat shared during the show that Android 16 (or at least part of it) is coming next month to Pixel devices. And though the company did cover some new features coming to Android XR, senior director for Android Product and UX Guemmy Kim said during the presentation that “we’ll share more on Android XR at I/O next week.”
It clearly seems like more is still to come, and not just for Android XR. We didn’t get confirmation on the Android Authority report that Google could add a more robust photo picker, with support for cloud storage solutions. That doesn’t mean it won’t be in Android 16, it might just be something the company didn’t get to mention in its 30-minute showcase. Plus, Google has been releasing new Android features in a quarterly cadence lately, rather than wait till an annual update window to make updates available. It’s possible we see more added to Android 16 as the year progresses.
One of the best places to get an idea for what’s to come in Android 16 is in its beta version, which has already been available to developers and is currently in its fourth iteration. For example, we learned in March that Android 16 will bring Auracast support, which could make it easier to listen to and switch between multiple Bluetooth devices. This could also enable people to receive Bluetooth audio on hearing aids they have paired with their phones or tablets.
Remember Google Glass? No? How about Daydream? Maybe Cardboard? After sending (at least) three XR projects to the graveyard, you would think even Google would say enough is enough. Instead, the company is preparing to release Android XR after previewing the platform at the end of last year. This time around, the company says the power of its Gemini AI models will make things different. We know Google is working with Samsung on a headset codenamed Project Moohan. Last fall, Samsung hinted that the device could arrive sometime this year.
Whether Google and Samsung demo Project Moohan at I/O, I imagine the search giant will have more to say about Android XR and the ecosystem partners it has worked to bring to its side for the initiative. This falls in line with what Kim said about more on Android XR being shared at I/O.
If Google felt the need to split off Android into its own showcase, we’re likely to get more AI-related announcements at I/O than ever before. The company hasn’t provided many hints about what we can expect on that front, but if I had to guess, features like AI Overviews and AI Mode are likely to get substantive updates. I suspect Google will also have something to say about Project Mariner, the web-surfing agent it demoed at I/O 2024. Either way, Google is an AI company now, and every I/O moving forward will reflect that.
Speaking of AI, Project Astra was one of the more impressive demos Google showed off at I/O 2024. The technology made the most of the latest multi-modal capabilities of Google’s Gemini models to offer something we hadn’t seen before from the company. It’s a voice assistant with advanced image recognition features that allows it to converse about the things it sees. Google envisions Project Astra one day providing a truly useful artificial assistant.
However, after seeing an in-person demo of Astra, the Engadget crew felt the tech needed a lot more work. Given the splash Project Astra made last year, there’s a good chance we could get an update on it at I/O 2025.
According to a report from The Information, Google might be planning to unveil its own take on Pinterest at I/O. That characterization is courtesy ofThe Information, but based on the features described in the article, Engadget team members found it more reminiscent of Cosmos instead. Cosmos is a pared-down version of Pinterest, letting people save and curate anything they see on the internet. It also allows you to share your saved pages with others.
Google’s version, meanwhile, will reportedly show image results based on your queries, and you can save the pictures in different folders based on your own preferences. So say you’re putting together a lookbook based on Jennie from Blackpink. You can search for her outfits and save your favorites in a folder you can title “Lewks,” perhaps.
Whether this is simply built into Search or exists as a standalone product is unclear, and we’ll have to wait till I/O to see whether the report was accurate and what the feature really is like.
Last year, Wear OS didn’t get a mention during the company’s main keynote, but Google did preview Wear OS 5 during the developer sessions that followed. The company only began rolling out Wear OS 5.1 to Pixel devices in March. This year, we’ve already learned at the Android Show that Wear OS 6 is coming, with Material 3 Expressive gracing its interface. Will we learn more at I/O? It’s unclear, but it wouldn’t be a shock if that was all the air time Wear OS gets this year.
Google has jumped the gun and already launched a standalone NotebookLM app ahead of I/O. The machine-learning note-taking app, available in desktop browsers since 2023, can summarize documents and even synthesize full-on NPR-style podcast summaries to boot.
Google has a terrible track record when it comes to preventing leaks within its internal ranks, so the likelihood the company could surprise us is low. Still, Google could announce something we don’t expect. As always, your best bet is to visit Engadget on May 20 and 21. We’ll have all the latest from Google then along with our liveblog and analysis.
Update, May 5 2025, 7:08PM ET: This story has been updated to include details on a leaked blog post discussing “Material 3 Expressive.”
Expand
Update, May 6 2025, 5:29PM ET: This story has been updated to include details on the Android 16 beta, as well as Auracast support.
Update, May 8 2025, 3:20PM ET: This story has been updated to include details on how to watch the Android Show and the Google I/O keynote, as well as tweak the intro for freshness.
Update, May 13 2025, 3:22PM ET: This story has been updated to include all the announcements from the Android Show and a new report from The Information about a possible image search feature debuting at I/O. The intro was also edited to accurately reflect what has happened since the last time this article was updated.
Update, May 14 2025, 4:32PM ET: This story has been updated to include details about other events happening at the same time as Google I/O, including Microsoft Build 2025 and Computex 2025.
Update, May 19 2025, 5:13PM ET: Updated competing AI news from Microsoft, Meta and NVIDIA, and contextualized final rumors and reports ahead of I/O.
Google's annual I/O developer conference kicked off on Tuesday, May 20. See everything Google has announced at I/O 2025 so far, including an AI-powered movie creation tool called Flow, real-time translation in Google Meet, virtual clothing try-ons based on uploaded photos, AI enhancements to Project Astra computer vision and more. Follow Engadget's Google I/O liveblog for recap of the event as it unfolded in real-time. Google previewed some key pre-I/O Android 16 news during its Android Show video stream last week.
Subscribe to our newsletter:
– A twice-weekly dose of the news you need
Please enter a valid email address
Please select a newsletter
By subscribing, you are agreeing to Engadget's Terms and Privacy Policy.

source

Google I/O 2025 recap: Pichai unveils Google Beam, Android XR glasses, Gemini AI advances, deep search  NBC News
source

May 20, 2025
Our new AI Mode experience is built for every part of shopping — from finding inspiration to buying at the right moment. Plus, our virtual try-on tool now works with your own photos.
Shopping comes with lots of questions: How do I choose a pair of hiking boots? Will these pants look good on me? If I buy this today, will the price just drop tomorrow?
Today we introduced our new shopping experience in AI Mode with inspiring visuals, smart guidance and reliable product data. We’re even giving shoppers a virtual dressing room and a new agentic checkout experience, so you can act quickly to make a purchase when the price is right for you.
Our new AI Mode shopping experience brings together Gemini capabilities with our Shopping Graph to help you browse for inspiration, think through considerations and narrow down products. The Shopping Graph now has more than 50 billion product listings, from global retailers to local mom and pop shops, each with details like reviews, prices, color options and availability. And you know you’re getting fresh and accurate information you can trust, because every hour more than 2 billion of those product listings are refreshed on Google.
Say you tell AI Mode you’re looking for a cute travel bag. It understands that you’re looking for visual inspiration and so it will show you a beautiful, browsable panel of images and product listings personalized to your tastes. If you want to narrow your options down to bags suitable for a trip to Portland, Oregon in May, AI Mode will start a query fan-out, which means it runs several simultaneous searches to figure out what makes a bag good for rainy weather and long journeys, and then use those criteria to suggest waterproof options with easy access to pockets. The new righthand panel dynamically updates with relevant products and images as you go, helping you pinpoint exactly what you’re looking for and discover new brands. These shopping features are coming to AI Mode in the U.S. in the coming months.
When you’ve made up your mind, our new agentic checkout will help you easily buy at a price that fits your budget. Just tap “track price” on any product listing and set the right size, color (or whatever options you prefer) and the amount you want to spend. Keep an eye out for a price drop notification and, if you’re ready to buy, just confirm the purchase details and tap “buy for me”. Behind the scenes, we’ll add the item to your cart on the merchant’s site and securely complete the checkout on your behalf with Google Pay. This agentic checkout feature will be rolling out in the coming months to product listings in the U.S.
It’s hard to envision how you’ll look in new styles and trends when shopping online — especially if you want to step outside your comfort zone. Our virtual try-on technology has led the way in helping shoppers imagine how clothes look on different body types. Now you can virtually try billions of apparel listings on yourself, just by uploading a photo.
This state-of-the-art technology is the first of its kind working at this scale, allowing shoppers to try on billions of items of clothing from our Shopping Graph. It’s powered by a new custom image generation model for fashion, which understands the human body and nuances of clothing — like how different materials fold, stretch and drape on different bodies. It preserves these subtleties when applied to poses in your photos. The result is a try-on experience that works with photos of you.
The “try on” experiment is rolling out in Search Labs in the U.S. today. When you’re shopping for shirts, pants, skirts and dresses on Google, simply tap the “try it on” icon on product listings. From there you can upload a full-length photo of yourself — and within moments, you’ll see how that wedding-season maxi dress or playful shirt for your next vacation looks on you. Not quite ready to commit and need a second opinion? You can easily save the looks or share with friends.
It’s been incredible to see how AI is taking us into a new phase of shopping in Search, where you can truly ask — and shop for — anything.
Your information will be used in accordance with Google’s privacy policy.
Done. Just one step more.
Check your inbox to confirm your subscription.
You are already subscribed to our newsletter.
You can also subscribe with a different email address .
Let’s stay in touch. Get the latest news from Google in your inbox.
Follow Us

source