Hundreds of popular add‑ons used encrypted, URL‑sized payloads to send search queries, referrers, and timestamps to outside servers, in some cases tied to data brokers and unknown operators.
Google has released an emergency update to patch an actively exploited zero-day—the first Chrome zero-day of the year.