CyberWatch Newsroom Live Intel

Moderate Google Online Security

2026-04-02 Google Online Security

Google Workspace’s continuous approach to mitigating indirect prompt injections

Posted by Adam Gavish, Google GenAI Security Team Indirect prompt injection (IPI) is an evolving threat vector targeting users of complex AI applications with multiple data sources, such as Workspace with Gemini. This technique enables the attacker to influence the behavior of an LLM by injecting malicious instructions into the data or tools used by the LLM …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-03-31 Google Online Security

VRP 2025 Year in Review

Posted by Dirk G ö hmann, Tony Mendez, and the Vulnerability Rewards Program Team 2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉! Originally started in 2010 , our vulnerability reward program (VRP) has seen constant additions and expansions over the past decade and a half, clearl…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-03-25 Google Online Security

Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android

Posted by Eric Lynch, Product Manager, Android and Dom Elliott, Group Product Manager, Google Play Modern digital security is at a turning point. We are on the threshold of using quantum computers to solve "impossible" problems in drug discovery, materials science, and energy—tasks that even the most powerful classical supercomputers cannot handle. However, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-02-27 Google Online Security

Cultivating a robust and efficient quantum-safe HTTPS

Posted by Chrome Secure Web and Networking Team Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers. The Internet Engineering Task Force (IETF) recently created a working group, PKI, Logs, And Tree Signatures (“PLANTS”), aiming to address the performance and bandwidth challenges that the increased size o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-02-25 Google Online Security

Staying One Step Ahead: Strengthening Android’s Lead in Scam Protection

Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse We’ve shared how Android’s proactive, multi-layered scam defenses utilize Google AI to protect users around the world from over 10 billion suspected malicious calls and messages every month 1 . While that scale is si…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-02-19 Google Online Security

Keeping Google Play & Android app ecosystems safe in 2025

Posted by Vijaya Kaza, VP and GM, App & Ecosystem Trust The Android ecosystem is a thriving global community built on trust, giving billions of users the confidence to download the latest apps. In order to maintain that trust, we’re focused on ensuring that apps do not cause real-world harm, such as malware, financial fraud, hidden subscriptions, and privacy…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2026-01-27 Google Online Security

New Android Theft Protection Feature Updates: Smarter, Stronger

Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That’s why we're committed to providing multi-layered defenses that help protect you before, durin…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-10 Google Online Security

HTTPS certificate industry phasing out less secure domain validation methods

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certif…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-09 Google Online Security

Further Hardening Android GPUs

Posted by Liz Prucka, Hamzeh Zawawy, Rishika Hooda, Android Security and Privacy Team Last year, Google's Android Red Team partnered with Arm to conduct an in-depth security analysis of the Mali GPU, a component used in billions of Android devices worldwide. This collaboration was a significant step in proactively identifying and fixing vulnerabilities in th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-08 Google Online Security

Architecting Security for Agentic Capabilities in Chrome

Posted by Nathan Parker, Chrome security team Chrome has been advancing the web’s security for well over 15 years, and we’re committed to meeting new challenges and opportunities with AI. Billions of people trust Chrome to keep them safe by default, and this is a responsibility we take seriously. Following the recent launch of Gemini in Chrome and the previe…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-12-03 Google Online Security

Android expands pilot for in-call scam protection for financial apps

Posted by Aden Haussmann, Associate Product Manager and Sumeet Sharma, Play Partnerships Trust & Safety Lead Android uses the best of Google AI and our advanced security expertise to tackle mobile scams from every angle. Over the last few years, we’ve launched industry-leading features to detect scams and protect users across phone calls, text messages and m…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Important Google Online Security

2025-11-20 Google Online Security

Android Quick Share Support for AirDrop: A Secure Approach to Cross-Platform File Sharing

Posted by Dave Kleidermacher, VP, Platforms Security & Privacy, Google Technology should bring people closer together, not create walls. Being able to communicate and connect with friends and family should be easy regardless of the phone they use. That’s why Android has been building experiences that help you stay connected across platforms. As part of our e…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Critical CVE-2025-48530 Google Online Security

2025-11-13 Google Online Security

Rust in Android: move fast and fix things

Posted by Jeff Vander Stoep, Android Last year, we wrote about why a memory safety strategy that focuses on vulnerability prevention in new code quickly yields durable and compounding gains. This year we look at how this approach isn’t just fixing things, but helping us move faster . The 2025 data continues to validate the approach, with memory safety vulner…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-10-30 Google Online Security

How Android provides the most effective protection to keep you safe from mobile scams

Posted by Lyubov Farafonova, Product Manager, Phone by Google; Alberto Pastor Nieto, Sr. Product Manager Google Messages and RCS Spam and Abuse; Vijay Pareek, Manager, Android Messaging Trust and Safety As Cybersecurity Awareness Month wraps up, we’re focusing on one of today's most pervasive digital threats: mobile scams. In the last 12 months, fraudsters h…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Critical Google Online Security

2025-10-28 Google Online Security

HTTPS by default

One year from now, with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable “Always Use Secure Connections”. This means Chrome will ask for the user's permission before the first access to any public site without HTTPS. The “Always Use Secure Connections” setting warns users before accessing a site without HTTPS…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-09-24 Google Online Security

Accelerating adoption of AI for cybersecurity at DEF CON 33

Posted by Elie Bursztein and Marianna Tishchenko, Google Privacy, Safety and Security Team Empowering cyber defenders with AI is critical to tilting the cybersecurity balance back in their favor as they battle cybercriminals and keep users safe. To help accelerate adoption of AI for cybersecurity workflows, we partnered with Airbus at DEF CON 33 to host the …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Important Google Online Security

2025-09-15 Google Online Security

Supporting Rowhammer research to protect the DRAM ecosystem

Posted by Daniel Moghimi Rowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of servic…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-09-10 Google Online Security

How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials

Posted by Eric Lynch, Senior Product Manager, Android Security, and Sherif Hanna, Group Product Manager, Google C2PA Core At Made by Google 2025, we announced that the new Google Pixel 10 phones will support C2PA Content Credentials in Pixel Camera and Google Photos . This announcement represents a series of steps towards greater digital media transparency: …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-08-12 Google Online Security

Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification

Posted by Dave Kleidermacher, VP Engineering, Android Security & Privacy Today marks a watershed moment and new benchmark for open-source security and the future of consumer electronics. Google is proud to announce that protected KVM (pKVM), the hypervisor that powers the Android Virtualization Framework, has officially achieved SESIP Level 5 certification .…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Critical Google Online Security

2025-07-21 Google Online Security

Introducing OSS Rebuild: Open Source, Rebuilt to Last

Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without b…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory

Moderate Google Online Security

2025-07-08 Google Online Security

Advancing Protection in Chrome on Android

Posted by David Adrian, Javier Castro & Peter Kotwicz, Chrome Security Team Android recently announced Advanced Protection , which extends Google’s Advanced Protection Program to a device-level security setting for Android users that need heightened security—such as journalists, elected officials, and public figures. Advanced Protection gives you the ability…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Project Zero & Cloud Security

Advisory