A vulnerability has been found that can be exploited through every browser as long as its running on a Windows system

Researchers found a vulnerability in Chrome that was abused in the wild against organizations in Russia.

Google has released an update for its Chrome browser which includes patches for this vulnerability.

The update brings the Stable channel to versions 134.0.6998.178 for Windows. Other operatings sytems are not vulnerable.

The easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser.

To manually get the update, click **Settings > About Chrome**. If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is restart the browser in order for the update to complete, and for you to be safe from those vulnerabilities.

Chrome up to date

The vulnerability exists in Windows for all Chromium based browsers, including Edge, Brave, Vivaldi, and Opera. These browsers can all be updated in more or less the same way.

But it doesn’t stop there. After studying the vulnerability, Mozilla concluded that Firefox and the Tor browser are also vulnerable. So, it released updates to patch them.

**Technical details**

The vulnerability, tracked as CVE-2025-2783 lies in Mojo for Windows. Mojo is a collection of runtime libraries that provide a platform-agnostic mechanism for inter-process communication (IPC).

An incorrect handle provided under certain circumstances allows an attacker to escape the browser sandbox. Which means that due to a logical error on the level where the sandbox and the Windows operating system meet it allows an attacker to execute code on the actual operating system just by getting the target to visit a malicious site. This is something that the sandbox is supposed to prevent.

According to the researchers:

> “Without doing anything obviously malicious or forbidden, it allowed the attackers to bypass Google Chrome’s sandbox protection as if it didn’t even exist.”

The researchers did mention that there has to be an additional vulnerability to allow the attacker to enable remote code execution, which they have been unable to find.

All in all, it seems imperative that you update your browser(s) at your earliest convenience.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Vulnerability in most browsers abused in targeted attacks 

A man didn't just have his ID stolen, identity theft ruined his life and robbed him of a promising future.

This is a sad story that illustrates how losing your ID can effectively ruin your life and reputation.

19-year-old dual German Tunisian national Rami Battikh travelled to the UK in 2019, bringing both his passport and his German national ID. When he returned to Germany, Rami noticed that his German ID card was missing. He figured he either lost it or someone stole it.

Without giving it much thought, he applied for a new one. This was issued without any problem since he could prove his identity.

Fast forward a few years, and Rami applied for a job after finishing school and a vocational apprenticeship. A routine employer check showed that Rami had a criminal record. In London.

The criminal record contains crimes he allegedly committed in the UK while he was in Tunisia.

> “I couldn’t believe it. I told my employers that it was not true that for sure it was not me, that I had proof I wasn’t in the UK at that time as I was in Tunisia at the time and had stamps on my passport to prove it.”

But his would-be employers who were eager to hire him said they couldn’t just take his word over a police record.

Back in London in 2021, a man was jailed by a court in London for 18 months for a series of offences including driving without a license or insurance, fraud by false representation, and possession of a false, improperly obtained identity document belonging to another person. Can you guess whose identity document that was?

Unfortunately, the crimes were actually recorded against Rami’s stolen ID. So, he hired a solicitor to get things sorted.

A judge tried to get London’s Metropolitan Police to rectify the error in 2022, describing it as a “mess” that had stained the German national’s record.

But the false database entry persisted and to make things worse, additional crimes were recorded against his stolen ID in London including possession of a knife in a public place.

Despite having confirmation from a judge, the Metropolitan Police haven’t managed to purge the false record, which has left Rami devastated.

He wrote to the court:

> “This fraud destroys my life. I can’t get any jobs. Please if you need I will give you my fingerprints, a hair strand … I can’t live like this any more. I am innocent and I never did any of those criminal acts I beg for help.”

At 24 he has no prospect of a job, has had to sell his car to cover bills, and is now sharing his story because he is desperate and doesn’t know what to do.

The Metropolitan Police said:

> “We are aware of this case and we continue to work with other agencies to progress this with a view to having the situation rectified. We understand that the length of time this has taken has added to the concern and upset, but aim to provide an update to the applicant in the near future.”

Sadly, this doesn’t sound too reassuring three years after the judge’s decision.

Not every identity theft story is as life-altering as this. But having your data stolen can still have an impact on your life, your family, and your finances.

**We don’t just report on threats – we help safeguard your entire digital identity**

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 &#8220;This fraud destroyed my life.&#8221; Man ends up with criminal record after ID was stolen 

Is moving from WhatApp to Signal a good idea? We look at the pros and cons, and which settings can make Signal even more private.

This week we learned that the US Government uses Signal for communication, after a journalist was accidentally added to a Signal chat.

Accidental additions of people aside, the news has got regular folks asking if they should, too, be using Signal for private communications.

Probably the largest alternative to Signal, WhatsApp is owned by Meta, and has faced criticism for its data-sharing practices. But is switching to Signal truly an improvement? Let’s explore the differences between these apps and whether the move would be justified.

Both WhatsApp and Signal offer end-to-end encryption, ensuring that only the sender and recipient can read messages. But the difference is that Signal employs “Sealed Sender,” a feature that hides metadata even from itself, whereas WhatsApp collects metadata such as phone numbers, IP addresses, and device information, which it shares with Meta and third parties.

As president of Signal Meredith Whittaker said in a statement to Dutch website Security.nl:

> “WhatsApp collects and shares, when required, large amounts of private information that is not encrypted, like your profile picture, your location, your contacts, when you send a message, when you stop, who’s in your group chats, and so on.”

Signal collects minimal data, but it’s run by the non-profit Signal Foundation, which operates free from commercial interests. Signal’s open-source code allows for public scrutiny of its security claims, which is a transparency WhatsApp lacks.

Where Signal adds privacy-focused features such as call relay (to hide IP addresses), self-destructing messages, and customizable notification settings, WhatsApp provides more social features like status updates.

Switching to Signal is justified if privacy is your top priority. Its minimal data collection, transparency, and advanced security features make it superior to WhatsApp in protecting user information. However, for those who rely on WhatsApp’s massive user base or social features, the transition might be less convenient.

There is no inter-compatibility, so all participants in a conversation need to use the same app. Meaning that one of the few things holding many users back from switching from WhatsApp to Signal is leaving contacts behind that are not willing to move over.

Obviously, the decision is yours and depends on your personal priorities: privacy versus convenience.

To fully benefit from Signal’s privacy capabilities, users should enable the following features:

*   **Disappearing messages**:
    *   Open a chat in Signal.
    *   Tap the three dots or profile icon to enter chat settings.
    *   Select “Disappearing Messages” and set a timer (e.g., five minutes or one week). This ensures messages are automatically deleted after the specified time.
*   **Screen lock**:
    *   Go to Signal settings by tapping your profile avatar.
    *   Navigate to “Privacy.”
    *   Enable “Screen Lock” to require biometric authentication or a PIN to access the app.
*   **Relay calls**:
    *   Under “Privacy” settings, activate “Always Relay Calls.” This routes calls through Signal servers to hide your IP address from contacts.
*   **Incognito keyboard** (Android only):
    *   In “Privacy” settings, enable “Incognito Keyboard” to prevent your keyboard from sending typing data to third-party servers.
*   **Screen security**:
    *   For Android: Enable “Screen Security” to block screenshots within the app.
    *   For iPhone: Turn on “Enable Screen Security” to prevent app previews in multitasking mode.
*   **Registration lock**:
    *   Activate this feature in “Privacy” settings to require a PIN for re-registering your account on new devices.

By enabling these features, users can ensure their conversations remain private and secure.

Another important tip is to check **Group chat members**. Before you send messages to a group, check who can read them: Open your group chat and tap on the group name to view chat settings. Scroll to the Members list and tap “View all members” to see the full list of group members.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 Moving from WhatsApp to Signal: A good idea? 

Tory Hunt, security expert and Have I Been Pwned owner, disclosed a phishing attack against him in a commendable display of transparency.

Internet security expert and educator Troy Hunt disclosed this week that he had been hit by one of the oldest—and most proven—scams in the online world: A phishing attack.

Through an automated attack disguised as a notice from Hunt’s chosen newsletter provider Mailchimp, scammers stole roughly 16,000 records belonging to current and past subscribers of Hunt’s blog. As such, readers should be the lookout for any scams or phishing attempts in the coming weeks.

“I’m enormously frustrated with myself for having fallen for this, and I apologise to anyone on that list,” Hunt wrote.

But Hunt’s immediate disclosure of the attack should be commended. By publishing a transparent blog that detailed the phish just _34 minutes_ after falling for it, Hunt used himself as the strongest example yet that online scams can hit anyone, and that, while shame and embarrassment are common, no one should ever feel alone in their experience.

****What happened?****

On March 25, Hunt received a malicious email disguised as a legitimate notice from the company Mailchimp, which he uses to email his blog entries to subscribed readers. The email claimed that Mailchimp was temporarily cutting service to Hunt because his blog had allegedly received a spam complaint.

“Your account has been flagged due to a spam complaint, and as a result, you are temporarily unable to send emails until this issue is resolved,” the email read. To fix the issue, Hunt was asked to sign into his Mailchimp account.

The phishing email was convincingly designed, and it threatened consequences if its recipient failed to act. But, as Hunt said, “I’ve received a gazillion similar phishes before that I’ve identified early,” so another simple factor was at play: Timing.

“You know when you’re really jet lagged and really tired and the cogs in your head are just moving that little bit too slow?” Hunt wrote. “That’s me right now, and the penny has just dropped that a Mailchimp phish has grabbed my credentials, logged into my account and exported the mailing list for this blog.”

Hunt also noticed that, when he tried to log into his Mailchimp account by following the phishing email’s link, his password manager did **not** auto-fill his account details.

While a password manager’s refusal to auto-fill credentials on a website can indicate that the website itself might be illegitimate, it’s far from a guaranteed red flag. As Hunt said, “there are so many services where you’ve registered on one domain (and that address is stored in 1Password), then you _legitimately_ log on to a different domain.”

In the phishing attack, the scammers stole about 16,000 records belonging to people who had both subscribed and _unsubscribed_ to Hunt’s blog. This is because Mailchimp preserves data of users who unsubscribe, a storage practice that Hunt is currently investigating with the company. Of the 16,000 records, 7,535 email addresses were of readers who unsubscribed. All breach victims are being notified over time, Hunt said.

The stolen records included email addresses, subscription statuses, and IP addresses, along with latitude and longitude data, which, as Hunt later learned, “_do not_ pinpoint the location of the subscriber.”

After recognizing his mistake, Hunt changed his password, reached out to Mailchimp to help delete the scammer’s API key, and then verified that the website he was directed to in the phishing attack had been taken offline.

And, importantly, as the owner of the website Have I Been Pwned (HIBP), which helps people search whether they’ve been involved in a data breach, Hunt had one more data breach to add to the website’s collection: His own.

“When I have conversations with breached companies, my messaging is crystal clear: be transparent and expeditious in your reporting of the incident and prioritise communicating with your customers,” Hunt said. “Me doing anything less than that would be hypocritical, including how I then handle the data from the breach, namely adding it to HIBP.”

**Best practice**

Responsible data breach disclosures are so rare that they deserve some news coverage, and Malwarebytes is happy to see that Hunt used himself as an example during a stressful and difficult incident. Phishing attacks are common because they’re effective, and that includes against new device owners users, longtime web users, and literal security experts.

For readers impacted in the attack, stay mindful for any phishing attempts that might hit your inbox, using your Have I Been Pwned subscription as a lure. There is no shame in falling for a scam, but it’s better to avoid one before it even happens.

 Security expert Troy Hunt hit by phishing attack 

Fake Booking.com emails sent to hotels lead to fake Captcha sites that trick the staff into infecting their own systems

A new phishing campaign that uses the fake CAPTCHA websites we reported about recently is targeting hotel staff in a likely attempt to access customer data, according to research from ThreatDown.

Here’s how it works: Cybercriminals send a fake Booking.com email to a hotel’s email address, asking them to confirm a booking.

> “Dear Team,
> 
> You have received a new booking. Please find the details below:
> 
> Reservation number: 5124588434141
> 
> Guest Name: Margit Kainz
> 
> Check-in Date: 2025-03-25
> 
> Check-out Date: 2025-04-01
> 
> Room Type: Deluxe Double Room
> 
> Guests: 2 Adults
> 
> Special Requests:Early check-in requested (before 2 PM)
> 
> Payment Status: Payment at property
> 
> {link to landing page}
> 
> (Copy and paste this link in your browser to confirm booking)
> 
> Please ensure the room is prepared according to the guest’s requests.
> 
> If you have any questions or need more information, please contact the guest directly or through our platform.
> 
> Thank you for your cooperation,
> 
> The Booking.com Team”

The email is sent only a few days before the check-in-date, which is very likely to create a sense of urgency—a common tactic of scammers.

But if the hotel staff were to copy and paste the URL into the browser address bar they will be greeted by this fake CAPTCHA website.

When they check the box, they’ll then see “verification” instructions that will effectively infect their system.

> “Verification steps
> 
> Press Windows Key + R.
> 
> Press Ctrl + V.
> 
> Press Enter”

As we explained in more detail here, these instructions will infect their Windows system with an information stealer or Trojan.

What the hotel staff would actually be doing is copy and pasting a mshta command into the Run prompt and then executing the command, which then fetches a remote file and then runs it on their system.

We don’t know the exact plans of the criminals once they have gained control over the system, but it’s highly likely they’re after customer payment details and other personal data: Data that is very valuable to them and can be traded on the dark web.

There isn’t much you can do to protect your own data in situations like these, when cybercriminals are attacking the companies that hold your personal information. However, there are a few things you can do to lower your risk.

**How to protect your data online**

*   **Don’t store your card details**. Not in your browser, not on websites. Sure, it’s more convenient to get sites to remember your card details for you, but we highly recommend not storing that information.
*   **Find out what information is already out there**. Our free Digital Footprint scan searches the dark web, social media, and other online sources, to tell you where your data has been exposed.
*   **Remove as much of that information as you can.** You can do this manually by cleaning things up yourself, or if you’re in the US then you can use Malwarebytes Personal Data Remover to do it for you.
*   **Monitor your accounts.** Check your accounts periodically for unexpected changes and notifications of suspicious login attempts.
*   **Use a different password for every online account.** Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

 Fake Booking.com phish uses fake CAPTCHAs to trick hotel staff into downloading malware 

With its growing popularity, sponsored Google search ads have started impersonating DeepSeek AI.

_The threat intel research used in this post was provided by Malwarebytes Senior Director of Research, Jérôme Segura._

DeepSeek’s rising popularity has not only raised concerns and questions about privacy implications, but cybercriminals are also using it as a lure to trap unsuspecting Google searchers.

Unfortunately, we are getting so used to sponsored Google search results being abused by criminals that we advise people not to click on them. So, it was to be expected that DeepSeek would show up in our monitoring of fake Google ads.

Here’s the fake ad:

If you put it side by side with the real DeepSeek ads, the difference is relatively easy to spot:

But as an unsuspecting searcher, you aren’t likely to make that comparison, and as you may know from previous posts about fake Google sponsored ads, the criminals behind these campaigns can be a lot more convincing.

In this case, they certainly put a lot more effort into creating the fake website which the advertisement linked to:

It’s different from the real website, but it looks convincing, nonetheless.

Should you happen to click the download button, you will receive a Trojan programmed in Microsoft Intermediate Language (MSIL), which the Artificial Intelligence (AI) module in Malwarebytes/ThreatDown products detects as Malware.AI.1323738514.

**How to avoid these traps**

As we mentioned earlier, Google has demonstrated that it can’t keep fake ads out of its sponsored search results. And apparently the success rate of these fake ads is high enough to allow the criminals to pay Google enough to outrank legitimate brands.

So, our first tip is not to click on sponsored search results. Ever.

The second tip is to look at the advertiser by clicking the three dots behind the URL in the search result and look whether he advertiser listed is the legitimate owner of the brand or not.

Here is one example of another DeepSeek impersonator we found. The advertiser’s name is not in Chinese characters by the way. The language in which the advertiser’s name is written is Hebrew: תמיר כץ.

If you don’t want to see sponsored ads at all then it’s worth considering installing an ad-blocker that will make sure you go straight to the regular search results.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 DeepSeek users targeted with fake sponsored Google ads that deliver malware 

With 23andMe filing for bankruptcy, here's how to remove your data from the company and protect yourself from the 2023 breach.

The genetic testing company 23andMe filed for bankruptcy on Sunday, announcing that, in searching for financial stability through its sale to a new owner, the business will continue operating as normal, including in how customer data is handled.

“The company intends to continue operating its business in the ordinary course throughout the sale process,” 23andMe wrote in a news statement. “There are no changes to the way the company stores, manages, or protects customer data.”

For some customers, that’s exactly the problem.

In 2023, not only did the company suffer a major data breach, it also placed some of the blame on the victims who, according to 23andMe, “negligently recycled and failed to update their passwords.”  With concerns now swirling about exactly who will become the new steward of 23andMe’s data following its bankruptcy, customers are asking how they can secure their most private genetic information, if at all.

Here are two big steps that 23andMe customers can take right now:

1.  Request that the company delete your data.
2.  Discover whether your data was included in the 2023 breach.

These are two, separate actions that will not impact one another and should be both taken for separate reasons—the first, to ask that the company remove your data from its possession; the second, to know how to protect yourself if your data was leaked in the past.

****What is happening?****

Over the weekend, 23andMe announced that it would file for bankruptcy after months of financial decline. Though the company was valued at a reported $6 billion in 2021, its genetic testing business—in which customers can have their saliva tested for insights into their genealogy and potential health risks—has faltered. Just last week, the company was reportedly valued at $50 million.

To save the company and its operations, 23andMe’s leadership is now on the hunt for a new owner (and that new owner’s cash infusion). One potential bidder has already made their intent abundantly clear: Former CEO Anne Wojcicki, who resigned the same day that the company announced its bankruptcy.

“I have resigned as CEO of the company so I can be in the best position to pursue the company as an independent bidder,” Wojcicki wrote on LinkedIn.

Wojcicki faces an uphill battle, though—her earlier proposal to take the company private was rejected last year.

Whoever becomes the new owner of 23andMe, however, could also become the new owner of 23andMe customer data. According to the company’s own privacy statement:

> “If we are involved in a bankruptcy, merger, acquisition, reorganization, or sale of assets, your Personal Information may be accessed, sold or transferred as part of that transaction.”

That has worried some experts who have pointed out that a new owner could, for instance, hand over customer data to insurance companies to hike up monthly premiums, or to data brokers to power increasingly invasive, targeted advertising.

For 23andMe customers who want to delete their data from 23andMe:

*   Log into your account and navigate to **Settings**.
*   Under **Settings**, scroll to the section titled **23andMe data**. Select **View**.
*   You will be asked to enter your date of birth for extra security. 
*   In the next section, you’ll be asked which, if there is any, personal data you’d like to download from the company (onto a personal, not public, computer). Once you’re finished, scroll to the bottom and select **Permanently delete data**.
*   You should then receive an email from 23andMe detailing its account deletion policy and requesting that you confirm your request. Once you confirm you’d like your data to be deleted, the deletion will begin automatically, and you’ll immediately lose access to your account. 

****How to find your 23andMe data in the 2023 breac**h**

In 2023, 23andMe suffered a data breach that impacted up to seven million people. Found being sold on the dark web, the data reportedly included “profile and account ID numbers, names, gender, birth year, maternal and paternal genetic markers, ancestral heritage results, and data on whether or not each user has opted into 23AndMe’s health data.”

With the data, cybercriminals could learn about a person’s genealogy and potentially use some of the information to aid them in committing identity fraud.

There is no meaningful way to _remove_ this data from the dark web. Instead, we recommend that you run a scan using our free Digital Footprint Portal to see if your data was exposed in the 2023 breach, and then to take additional steps to protect yourself.

If your data was exposed in the 23andMe breach, here is what you can do:

*   **Change your password.** You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
*   **Enable two-factor authentication (2FA).** If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
*   **Watch out for fake vendors.** The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
*   **Take your time.** Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
*   **Consider not storing your card details**. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
*   **Set up identity monitoring.** Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

 23andMe bankruptcy: How to delete your data and stay safe from the 2023 breach 

Google has admitted it accidentally deleted some Maps Timeline user data after what it calls a "technical issue".

Google has admitted it accidentally deleted some users’ Google Maps Timeline data after a “technical issue”.

As reported by Forbes on March 11, users started noticing that their Google Maps Timelines had completely disappeared. At the time, we didn’t know anything about the cause of this issue.

However, now we do, after some of the impacted users received a email from Google on March 21. Not with an apology, mind you, but with an explanation.

Google wrote that it had:

> “Briefly experienced a technical issue that caused the deletion of Timeline data for some people. If you have encrypted backups enabled, you may be able to restore your data.”

If you’re among those affected and you did have backups enabled, here’s how you can attempt to restore your data:

*   Make sure you have the latest version of the Google Maps app installed on your device.
*   Open Google Maps, tap on your profile picture in the top right corner, and select **Your Timeline**.
*   Look for a cloud icon at the top of the Timeline screen and tap it. Choose a backup to import your data.

This doesn’t seem to work for everyone though, with some users commenting that this method didn’t work for them.

If you didn’t have backups enabled, it might not be possible to recover your lost Timeline data.

**Planned deletion**

For those interested in keeping their Timeline, bear in mind that if you don’t take action soon, your visits and routes might be erased, and your Timeline settings disabled. Earlier this month, Google announced that it will begin deleting the last three months of Timeline data unless you take action to back it up, as part of a roll out of significant changes to Maps Timeline.

After you receive the notification from Google, you have about six months to save or transfer your Timeline data before deletion takes place. The sender of the email is “Google Location History,” with the subject line: “Keep your Timeline? Decide by \[date\].”

When you get the prompt, follow the instructions on how to adjust your settings on your device. If you don’t, your visits and routes will be erased, and your Timeline settings will be disabled.

**How to back up your Google Maps Timeline data**

Here’s how back up your Timeline data to prevent any future losses, and help preserve your data during the planned deletion:

*   Open the Google Maps app.
*   Tap your profile picture, then **Your Timeline**.
*   At the top right, tap the cloud icon.
*   If auto-delete is turned on, turn it off.
*   On the Backup screen, turn on **Backup**.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 Oops! Google accidentally deletes some users&#8217; Maps Timeline data 

A list of topics we covered in the week of March 17 to March 23 of 2025

March 21, 2025 - The release of the JFK assassination records also resulted in the leak of hundreds of Social Security Numbers

March 20, 2025 - The phishing campaign for valuable Google accounts continues with a new twist, going after the customers of a SasS platform.

March 20, 2025 - Experts are warning about the proliferating market for targeted spyware and espionage. Why should we be concerned?

March 19, 2025 - With financial stress at an all-time high, people are desperately seeking relief. Sadly, scammers know this all too well.

March 19, 2025 - Sperm donor giant California Cryobank has announced it has suffered a data breach that exposed customers' personal information.

 A week in security (March 17 &#8211; March 23) 

This week on the Lock and Code podcast, we speak with Carey Parker about what Google Chrome knows about you.

_This week on the Lock and Code podcast…_

Google Chrome is, by far, the most popular web browser in the world.

According to several metrics, Chrome accounts for anywhere between 52% and 66% of the current global market share for web browser use. At that higher estimate, that means that, if the 5.5 billion internet users around the world were to open up a web browser right now, 3.6 billion of them would open up Google Chrome.

And because the browser is the most common portal to our daily universe of online activity—searching for answers to questions, looking up recipes, applying for jobs, posting on forums, accessing cloud applications, reading the news, comparing prices, recording Lock and Code, buying concert tickets, signing up for newsletters—then the company that controls that browser likely knows a lot about its users.

In the case of Google Chrome, that’s entirely true.

Google Chrome knows the websites you visit, the searches you make (through Google), the links you click, and the device model you use, along with the version of Chrome you run. That may sound benign, but when collected over long periods of time, and when coupled with the mountains of data that other Google products collect about you, this wealth of data can paint a deeply intimate portrait of your life.

Today, on the Lock and Code podcast with host David Ruiz, we speak with author, podcast host, and privacy advocate Carey Parker about what Google Chrome knows about you, why that data is sensitive, what “Incognito mode” really does, and what you can do in response.

We also explain exactly why Google would want this money, and that’s to help it run as an ad company.

> “That’s what \[Google is\]. Full stop. Google is an ad company who just happens to make a web browser, and a search engine, and an email app, and a whole lot more than that.”

Tune in today to listen to the full conversation.

_Show notes and credits:_

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)  
Licensed under Creative Commons: By Attribution 4.0 License  
http://creativecommons.org/licenses/by/4.0/  
Outro Music: “Good God” by Wowa (unminus.com)

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

Source

Malwarebytes