Google Bad News for Chrome Users: What’s Actually Going On

If you’ve seen that headline floating around and wondered what you missed, you’re not alone. It’s not one story. It’s three, and they’ve been landing on top of each other throughout 2026.

The security patches keep coming

Chrome has 3.5 billion users, which makes it the biggest target on the internet by a wide margin. Google has shipped several emergency updates this year for zero-day flaws already being exploited in the wild, including CVE-2026-5281, a use-after-free bug in Chrome’s Dawn WebGPU component. Zero-day means attackers found the hole before Google did, so there was no head start on a fix.

By early April, Google had also patched a batch of 60 additional vulnerabilities, two of them rated critical. Then came a separate rollout addressing 30 more flaws, four of them critical, mostly in the same “use-after-free” family, where Chrome loses track of memory it already released and a malicious site sneaks back in to run its own code.

Here’s the part that actually matters for you: Google has said it can take days or even weeks for a patch to reach every device. That’s not because the fix isn’t ready. It’s staged rollouts, restricted bug details until adoption is high enough, and plain old update fatigue on the user end.

What to do: Open Chrome’s menu, go to Settings > About Chrome, and let it check for updates. Restart the browser when it asks. That last step is easy to skip, and it’s the one that actually applies the fix.

Ad blockers and old extensions are losing ground

Separately, Google has been rolling out Manifest V3, a new framework for how Chrome extensions work. It limits some of the deeper page-blocking capabilities that older ad blockers relied on, and it’s been phasing out extensions built on the older Manifest V2 standard. Privacy advocates and ad-blocker developers have pushed back, arguing it weakens content filtering even as Google frames it as a security and performance improvement.

If your ad blocker suddenly stopped working as well as it used to, this is probably why. Most major ad blockers have released Manifest V3-compatible versions, so checking the extension store for an update is worth doing before assuming you’re stuck.

HTTPS becomes the default, but not until October 2026

The one piece of “bad news” that isn’t really bad: starting with Chrome 154 in October 2026, Google will turn on “Always Use Secure Connections” by default for everyone. Right now it’s opt-in. Once it’s the default, Chrome will warn you before loading a plain HTTP page instead of loading it silently.

It’s a genuine security upgrade. The catch is timing, since anyone reading about it now still has a year to wait, and in the meantime HTTPS alone doesn’t guarantee a site is safe. Attackers can and do use encrypted connections too.

The bottom line

None of this means Chrome is falling apart. It means Chrome is big enough that its patch cycle, its extension policy changes, and its default security settings all become news the moment they shift. The practical response is the same one that’s applied for years: keep the browser updated, don’t assume a padlock icon means a site is trustworthy, and check your extensions if something you rely on stops working right.

FAQ

Q: Is Chrome unsafe to use right now? A: No. The patches exist and are rolling out. The risk window is mainly for people who delay restarting their browser after an update.

Q: Why did my ad blocker stop working as well? A: Most likely Manifest V3. Update the extension or check if the developer released a compatible version.

Q: Do I need to do anything before October 2026 for the HTTPS change? A: No action needed. It’ll become the default automatically when Chrome 154 ships.

Q: How do I check if my Chrome is updated? A: Menu > Settings > About Chrome. It’ll show your version and prompt an update if one’s available.