Google Chrome

Is Google Chrome safe?

Against hackers, yes. Chrome is one of the hardest browsers to break into, and Google fixes the bugs that attackers really use faster than almost anyone. Against tracking, it is a weak choice. Chrome is made by the world's largest advertising company, it keeps third-party cookies on, and Apple's privacy label lists payment info, coarse location, your user ID and advertising data as used for third-party advertising. We score it 59/100: about level with Gmail (62) and far below Brave (80), which uses the same engine.

How secure is Chrome?

Chrome runs each site in a sandbox, checks addresses against Google's Safe Browsing list of phishing and malware sites, and updates itself in the background. Most attacks on browsers need you to run an old version, so the update speed matters more than any single feature.

Because Chrome has billions of users, it is also the browser that state-backed spyware groups target. Google's own release notes flag 8 Chrome flaws as exploited in the wild before a fix in 2025, from CVE-2025-24201 in March to CVE-2025-14174 in December, and a ninth, CVE-2025-4664, as having a public exploit. Google's Threat Analysis Group, which tracks spyware makers, reported several of them. There were 7 more in 2026 up to 8 September. A high count is partly a sign that Google looks hard and says so. It is also a reason to restart Chrome when it shows the update button.

The weaker point is sync. Your passwords, history and bookmarks are encrypted, but with the default setup Google holds the keys. A sync passphrase stops Google from reading them, at the cost of some features: you can no longer view saved passwords on passwords.google.com, and only addresses typed into the address bar sync as history. Payment methods and addresses stored in Google Wallet are not covered by the passphrase.

What does Google learn from your browsing?

More than most people assume. If you sign in and sync, your history goes to your Google account, and with Web & App Activity on it can shape Google services. Chrome also runs Google's "ad topics", which guesses your interests from the sites you visit so sites can show targeted ads.

The bigger story is cookies. Google promised in 2020 to remove third-party cookies, the main tool for tracking people across sites. It delayed the plan several times. In July 2024 it said it would let users choose instead, and in April 2025 it dropped even the choice prompt and said it would not remove the cookies. The UK Competition and Markets Authority, which had supervised the plan because of its effect on rival ad firms, released Google from its commitments on 17 October 2025. Safari and Firefox have blocked third-party cookies by default for years.

What happened with Incognito mode?

In Brown v. Google, a class action filed in 2020, users said Google kept collecting data from Incognito sessions on other sites through its ad and analytics tools. Google settled in April 2024 without paying damages to the class. Under the settlement, Google rewrote its privacy policy and the Incognito start screen to say that Google collects private browsing data, agreed to delete or remediate billions of records from private sessions, and must block third-party cookies in Incognito by default for five years. In April 2026 the Ninth Circuit turned down a late bid by 185 Chrome users to join the case and revive class-wide damages.

Texas brought a separate case covering Incognito searches as well as location and face and voice data. Google agreed in May 2025 to pay $1.375 billion to settle it, signed the deal in October 2025 and did not admit wrongdoing.

Extensions and ad blockers

Chrome's switch to Manifest V3, its new rules for extensions, ended the older and more powerful kind of content blocker. Chrome turned off Manifest V2 extensions by default on 31 March 2025, and from 24 July 2025, with Chrome 138, users could no longer turn them back on. On 31 August 2026 the last Manifest V2 extensions were removed from the Chrome Web Store. That removed uBlock Origin, one of the most widely used privacy tools. Google says Manifest V3 makes extensions safer, and it limits what a malicious extension can do. But it also weakens the best defence against tracking scripts and malvertising.

Chrome for children

Family Link can set a child's Chrome to "Try to block explicit sites" or to approved sites only, and it turns Incognito off. The gap is on computers, iPhones and iPads: Google says a child there can sign out and switch to another profile, which skips the controls. On those devices, also use the system's own parental controls. The App Store rates Chrome 16+.

How to make Chrome safer

1. Restart Chrome when the update button appears. Old versions are how exploits work.
2. In Settings, Privacy and security, Security, switch Safe Browsing to Enhanced protection, which sends more data to Google but catches new phishing pages sooner.
3. In Chrome's ad privacy settings, turn off ad topics, site-suggested ads and ad measurement.
4. In Privacy and security, Third-party cookies, choose Block third-party cookies. A few sites may break; most will not.
5. Set a sync passphrase if you sync passwords and do not want Google to read them.
6. Remove extensions you do not use. Old extensions are a common route for malware after a developer sells them.

How we scored it

Security (77) is Chrome's strongest factor, thanks to fast patching and Safe Browsing. The regulatory record (35) is the weakest, set by the $1.375 billion Texas settlement; the Incognito class action is a private lawsuit, so it counts only as context. Privacy (40) is close behind, because of the advertising data on Apple's label, third-party cookies left on and Google's ad topics. For a browser that blocks trackers by default, see DuckDuckGo.