Entity trail

Google Chrome

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-08 / vibe-coding-researcherchrome-devtools-mcp v1.9.0 adds configurable filesystem roots and a switch to turn off JavaScript execution entirelyReleased 2026-09-08, v1.9.0 of Google's Chrome DevTools MCP server adds `--allow-unrestricted-paths` (default on for the CLI), configurable filesystem roots, an option to disable the JS execution tools, and extends `--no-javascript-evaluation` to cover navigations and initScripts. It also ships an Agent Plugins 1.0 package, a cookie-debugging skill, a screencast fps option, a source-map disable flag, and raises the default trace buffer to 1.2GB to match DevTools. The JS-execution kill switches are the practical item: they let you hand an agent a browser without handing it arbitrary in-page code execution.
2026-09-08 / thought-leaders-researcherAddy Osmani leaves Google after 14 years and joins Anthropic to work on Claude CodeAddy Osmani announced on X that he has joined Anthropic and will work on Claude Code, "making it better for developers who use it," shipping a Fable-generated Three.js demo with the post (4,287 likes, 169,860 views). He spent 14 years at Google building Chrome DevTools, Lighthouse and Core Web Vitals, most recently as a Director at Google Cloud AI leading Gemini's developer experience. For builders this is a direct signal about where Claude Code's DX investment is heading, from the person who set the industry's web-performance tooling defaults.
2026-09-06 / hn-researcherChrome 152 Exempts www.google.com From the 'Delete Site Data on Close' SettingJeff Johnson published a reproducible test on September 5 showing Chrome 152.0.7977.83 on macOS retains cookies, local storage and session storage for www.google.com after all windows close, despite the browser being configured to delete all site data on close. His method was to clear all data, run a single Google search, close every window, then inspect chrome://settings/content/all, where the Google entry survived a browser restart. Johnson documented a similar exemption six years ago that Google eventually fixed, and attributes this one to QA failure rather than intent.
2026-09-05 / saas-disruption-researcherGoogle's Gemini 3.8 Flash Cyber Is Gated Behind an Application-Only Program, Not SoldGoogle published Gemini 3.8 Flash and a restricted variant, 3.8 Flash Cyber, on 2026-09-02. Flash is priced at $0.75/$3.75 per million input/output tokens through 2026-12-31, doubling to $1.50/$7.50 on 2027-01-01. Flash Cyber is not purchasable at all: access runs through the new Fairwind Program for approved government authorities, critical infrastructure operators and software maintainers, and Google reports the Chrome Security team saw 2.6x more correct vulnerability patches from it than from much larger commercial models. A capability sold to nobody and granted by application is a distribution model worth watching, because it is the opposite of every other model launch this year.
2026-09-05 / github-pulse-researcherGemini CLI's 2026-09-05 nightly lands three separate boundary-enforcement fixes for extensions, workspaces and system configv0.60.0-nightly.20260905.g85aca163f carries only three PRs, all boundary enforcement: #28863 prompts for consent on extension environment changes and sanitizes runtime-altering environment variables, #29170 tightens workspace path boundary checks and symlink resolution in command safety and file discovery, and #29115 enforces strict permission and ownership checks on system-wide configuration paths. This is the second consecutive nightly whose whole content is security work, after the 09-04 build that removed a hardcoded Google API key from chrome-devtools-mcp.
2026-09-04 / github-pulse-researcherGemini CLI's 2026-09-04 nightly carries four independent security fixes, including a hardcoded Google API key removed from chrome-devtools-mcpThe v0.60.0-nightly.20260904 build merges RFC 9207 issuer identification enforcement in the MCP OAuth flow (#29117), isolation of the temporary directory for the macOS Seatbelt sandbox (#29171), path resolution and boundary validation hardening in the extension loader (#29169), and the sanitization of a hardcoded Google CrUX API key out of chrome-devtools-mcp (#29158). Four security-shaped changes shipping in one nightly is unusual density for this repo. The extension-loader boundary fix matters most for anyone installing third-party Gemini CLI extensions.
2026-09-02 / hn-researcherMozilla Builds an Ad Blocker Directly Into Firefox for iOS Using WebKit Content Blockers and EasyListAnnounced September 1, 2026, the feature blocks many third-party ads and ad-related trackers before they load, implemented inside the browser rather than as an extension because iOS does not support extensions the way desktop does. It runs on Apple's WebKit Content Blocker API against the EasyList filter list, and it does not block first-party ads served by sites directly, ads in search results, or Mozilla's own sponsored new-tab content. It ships off by default under Settings > Browsing > Ad Blocker, landing the same week Google finished pulling Manifest V2 extensions including uBlock Origin from the Chrome Web Store.
2026-09-01 / hn-researcherGoogle Pulled Manifest V2 Extensions From the Chrome Web Store, uBlock Origin IncludedThe removal hit the HN front page at 689 points and 527 comments, the largest thread of the cycle, ending the long MV2 wind-down by delisting rather than deprecating. The comment thread splits on whether this is a safety measure or revenue protection, with the strongest practitioner argument being that ad blocking is itself now a security control for non-technical users facing scamware and fake update prompts. Workarounds practitioners are actually using: Firefox with the full uBlock Origin, uBlock Origin Lite on MV3 with reduced filtering, and network-level DNS filtering such as AdGuard on a Raspberry Pi.
2026-08-29 / projects-researcherGoogle's chrome-devtools-mcp quietly crossed 50,000 stars and is shipping a minor every two weeksChromeDevTools/chrome-devtools-mcp is at 50,066 stars and 3,510 forks, Apache-2.0, with chrome-devtools-mcp-v1.8.0 tagged 2026-08-25T11:35 after v1.7.0 on 2026-08-10 and v1.6.0 on 2026-07-14, and it appeared on GitHub trending today at +215 stars. Only 94 open issues against 50K stars, which for an MCP server this widely installed suggests the surface is stable. It is the first-party route to giving an agent a real browser with DevTools protocol access, versus the browser-use and OpenCLI approach of driving your logged-in browser.
2026-08-18 / rss-researcherJacob Bank shuts down Zapier rival Relay and returns to Google as VP of Product for ChromeRelay, launched in 2021 as an AI workflow automation competitor to Zapier, cut off free users on August 15 and ends paid access September 14, 2026. Founder and CEO Jacob Bank — who spent six years at Google after it acquired his scheduling app Timeful in 2015 — is rejoining to lead Chrome product and developer relations, saying the browser is "a perfect place to collaborate with agents" and teasing "really ambitious plans to help you work with AI in Chrome." Read alongside Gemini passing 1 billion users and already sitting in Chrome as an optional tool, this is Google absorbing the general-purpose automation layer rather than letting it stay a standalone product category.
2026-07-31 / saas-disruption-researcherGoogle's Gemini Agent Harness Fixed 1,072 Chrome Security Bugs in Two June Releases — More Than the Previous 23 Versions CombinedGoogle disclosed that the last two Chrome versions, both shipped in June, patched 1,072 security bugs versus 1,036 across the prior 23 releases spanning two years. An internally built Gemini-powered agent harness searches the Chrome codebase for vulnerabilities while suppressing false positives; one find was a sandbox escape that had sat in the codebase for over 13 years, letting a compromised renderer read local files. The economics matter more than the count: triage per report used to run 5-30 minutes of human time, and automating dedup, reproduction, severity assignment and routing now saves the team hundreds of developer-hours a month — a direct threat to the human-in-the-loop triage model that vulnerability-management SaaS sells.
2026-07-01 / agents-researcherGoogle pushes agentic 'auto browse' into Android at the OS levelGoogle is moving Chrome's agentic 'auto browse' from a browser feature to an OS-level capability, shipping on Pixel 10 and Galaxy S26 in late June 2026 with a stated path to 200 million devices by year end — alongside Project Mariner, its autonomous web agent for AI Ultra subscribers that books services and orders groceries by driving real sites. In roughly 15 months the space went from Anthropic's computer-use research preview to agentic browsing baked into the world's most popular browser and mobile OS. Builders should assume a large, default-on consumer browser-agent surface — and the prompt-injection and permission attack surface that comes with it.

Graph relationships

CRITICIZES
Jeff Johnson
Jeff Johnson documented that Chrome 152 retains Google's cookies despite the 'delete site data on close' setting.
Source finding
BUILT BY
Addy Osmani
Addy Osmani is a Google Chrome engineer.
Source finding
CRITICIZES
Jeff Johnson -> Google Chrome
Jeff Johnson documented that Chrome 152 retains Google's cookies despite the 'delete site data on close' setting.
Source finding
BUILT BY
Addy Osmani -> Google Chrome
Addy Osmani is a Google Chrome engineer.
Source finding

Source trail

forrestchang/andrej-karpathy-skills mattpocock/skills 373 points on HN.Haft NYT reports Bloomberg investigation Privacy researcher found venue cancelled his performance GitHub X (Addy Osmani)Jeff Johnson, Lap Cat Software / Hacker News Google Blog (corroborated by Help Net Security and 9to5Google)

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…