Chrome 136 is now available: security fixes and APK download checks on Android
Google has just released Chrome 136, a new stable version of its web browser for desktop and mobile. The new version is 136.0.7103.59 on Linux, 136.0.7103.60 on Android, and 136.0.7103.48/49 on Windows and Mac devices.
You can check out our coverage of Chrome 135's release here, in case you missed it or want to look at the major changes again.
Chrome 136: security update
The new version of the browser patches eight security issues. Google lists four of those on the official Chrome Releases blog. The aggregate severity rating is high and Google does not mention active exploits.
Security issues are patched in HTML and the Developer Tools. The four unmentioned security issues were discovered internally.
Other changes
Android APK download checks
The big change in Chrome 136 introduces malicious APK checks in Chrome for Android. The feature submits information about APK file downloads to Google to find out if the files include malicious code.
Chrome 136 is set to collect telemetry about the process only at this time. Google notes, however, that future versions will show warnings and block downloads of malicious APK files in Chrome automatically to "protect users against mobile malware".
Furthermore, checks are currently only performed if users have enabled Enhanced Protection in Google Safe Browsing.
Partitioning against Browser history leaks
Another highlight is the new partitioning of the visited links history. Browser history leaks have been a problem for a long time. In 2018, for instance, researchers found a loophole that allowed them to find out if a particular site was visited by a user.
The :visited anchor element is now restricted. It is only used if it has "been clicked from this top-level site and frame origin before". In other words, sites can only check visited if the link was clicked previously on the site itself.
Google says: "By only styling links that have been clicked on this site and frame before, the many side-channel attacks that have been developed to obtain :visited links styling information are now obsolete, as they no longer provide sites with new information about users".
Closing Words
Google Chrome is already available. Most non-managed installations should be updated automatically. You can speed things up by selecting Menu > Help > About Google Chrome. This should download and install the new update immediately on the system.
Now You: what is your take on the new release? Do you find the new security features useful? Feel free to leave a comment down below.
@ Tachy:
“Perhaps google should put more effort into checking apks in it’s own app store instead.
It appears they don’t want you getting viruses from anyone but them.”
Just stick with Microsoft Windows if you want viruses, trojans, rookits, and more.
At least I still have root access on windows.
Perhaps google should put more effort into checking apks in it’s own app store instead.
It appears they don’t want you getting viruses from anyone but them.
I think google should put more effort into checking the apk’s on it’s own app store instead.
Google is so intent on trying to learn what apps you install outside of the play store. You have to go through several steps just to disable Play Protect file scanning malware, and now this feature in Chrome. Fortunately Chrome is one of the first apps to be disabled. Firefox/IronFox/Brave is the go to browser.
Bro is literally blocking ads on their own website ?
Not his site any more for a while, keep up dude.