Lowyat.NET: Latest topics in Internet Related

Couldn't create Google account. Stuck at QR,

Skylinestar — Wed, 09 Sep 2026 13:19:42 +0800

on my pc web browser, it shows a qr code.
I scan it with my phone.
it redirects to sms to send a unique code to 018-233xxxx.
I send the sms and nothing happens after that.
anyone else have the same issue? how do you proceed?

the message:
"Send this message without editing. (randomcodehere)"
the recipient number is 018xxx.
I've tried sending just the (randomcodehere) without parentheses but it's still the same.

Firefox and Brave now the last major browser that, still supports uBlock Origin

JLA — Thu, 20 Aug 2026 11:07:48 +0800

Key takeaways:

Microsoft Edge is phasing out Manifest V2, limiting the technology that powers the full version of uBlock Origin.
Manifest V3 restricts extension capabilities, meaning ad blockers have fewer tools to inspect and block web requests.
Firefox is keeping full uBlock Origin support, making it the last major browser to offer the popular ad blocker without the same compromises.
The shift gives Firefox a potential privacy advantage, as users looking for powerful ad and tracker blocking have fewer mainstream alternatives.

Firefox stands firm

Posting on Bluesky, Firefox developer Mozilla said, “Our support for uBlock Origin isn’t going anywhere.”

This means Firefox doesn't have to follow every technical decision made by Google for Chromium.

https://cybernews.com/security/firefox-ublo...mium-adblocker/?

Brave on X: "Unlike Edge, Brave will keep supporting uBlock Origin. We ...

11 Aug 2026 Unlike Edge, Brave will keep supporting uBlock Origin. We host uBlock Origin and other Manifest v2 extensions on our servers so Brave browser users can still use them.

Google fixed more Chrome bugs in June thanks to AI,

BlueLeaflet — Sat, 01 Aug 2026 20:15:28 +0800

blog.google/security/chrome-stronger-with-every-update/

The article is long, I just copy some excerpts

QUOTE

The Chrome Security team has been using LLMs for years. In 2023 we developed ways to use LLMs to increase security fuzzing coverage and performance. In 2024, we worked with Project Zero on Naptime, giving LLMs specialized tools for vulnerability research. And in 2025, we collaborated with DeepMind and Project Zero on Big Sleep, an AI vulnerability discovery agent that successfully found bugs in the V8 JavaScript engine and graphics stack.

In early 2026, we built an agent harness that used Gemini to find vulnerabilities across the broader Chrome codebase with higher efficiency and lower false positives. One of the bugs we found was a sandbox escape that would allow a compromised renderer to trick the browser into reading local files — a bug that quietly survived in our codebase for more than 13 years! For many of us, this moment cemented the potential of AI-powered vulnerability detection.

From there, we improved on our vulnerability finding agent harness by:

Adding support for model interoperability to leverage the unique strengths of both open-weights and proprietary models.
Building a knowledge base of Chrome, including all previously identified CVEs and Chrome’s entire Git history, to extend the LLMs reasoning capacity past its training data.
Encouraging developers to add SECURITY.md files, which help models better understand trust boundaries and develop an accurate view of the threat model.
Adding a “critic” agent with a separate context to consume these SECURITY.md files.
Introducing the ability to run vulnerability finding models over the codebase multiple times to account for model non-determinism and model improvements over time.

We’ve built all of this with safety in mind, and have put in place guardrails to mitigate the risk of AI behaving unexpectedly. Our AI analyzes source code strictly at rest, operating on locked-down machines that lack general internet access. We also utilize a dedicated setup for these internal scans that intercepts all network requests, employing strict allowlists based on the initiating application and destination, blocking any suspicious model activity. Furthermore, we never run models in an unrestricted mode, and we strictly limit our subagents from modifying the local system or accessing files outside of designated source code directories.

AI-powered vulnerability detection complements our existing security testing infrastructure. For example, fuzzing continues to be especially effective at finding bugs that arise from long-range interactions between disparate parts of our codebase, or those requiring a combination of seemingly unrelated operations.

We also want to continue to reward external researchers for their expertise and creativity in finding the most challenging and impactful vulnerabilities via the Chrome Vulnerability Reward Program (VRP). In early 2026, we saw a gradual increase in all categories of bug reports, but by March, the shift was apparent: we received more bug reports than we had in the entirety of 2025. This led us to change our VRP to focus researchers on bug submissions that are additive to what we are finding internally, and easily ingestible by our newly automated processing pipelines.

QUOTE

As we discover more security vulnerabilities with AI-powered tools, we’ve simultaneously used AI to scale and automate validating, triaging, and fixing bugs. Historically, triaging a single security report took anywhere from 5 to 30 or more minutes, and relied primarily on human expertise. We have been increasingly shifting our triage process towards an automated approach that blends rule-based systems with AI to increase throughput and accuracy.

The automated triage process is broken down into four key phases:

Filtering out the noise. The system checks if an incoming bug is spam, ensures it meets intake criteria (e.g. is not a duplicate), and verifies that it clearly describes a Chrome security vulnerability.
Reproducing bugs. Next, the system checks for a proof of concept. Reproducible bugs are tested on the specific operating system and browser versions they affect. Based on this, the system attaches further details such as stack traces to the bug to help inform the fix.
Enriching the report with metadata. The system adds essential metadata to the report, such as when the bug was first introduced and its severity rating. To help this process scale, we’ve made our severity guidelines clearer and easier to apply automatically. We continue to allow developers to modify the severity rating if they believe it is incorrect, and to add context to help models reason about security boundaries using SECURITY.md files.
Automatic assigning. The system automatically routes the issue to the correct component and human owner.

While it's hard to measure precisely, we estimate that this new process is saving hundreds of hours of developer time per month, allowing our team to focus on other security priorities.

QUOTE

Across Google, developers share the responsibility of prioritizing security fixes with the security team, but scaling bug discovery requires an equally scalable bug fixing process.

To achieve this, we rely on multi-agent workflows throughout:

After initial build steps that bring in context from a specific issue, we run a fixing agent that returns multiple candidate fixes.
A critic agent then evaluates which would be the best fit, producing other relevant artifacts for developers to evaluate the fix.
The fixing and critic agents work in a loop that mimics a typical code review process to ensure that code is functional and compliant with Chromium and Google style guidelines, as well as other local code conventions.
Test-writing agents help write tests for fixes. These agents can ensure that tests work across the full array of Chrome supported platforms and configurations before a developer reviews the fix, saving up to weeks of developer time.

Seems like Google is using LLM a lot. Not sure if it will introduce new bug in the process.. I have very mixed feelings about developing / maintaining critical software with LLM.

[PSA] Chrome browser On-device AI Gemini 4gb model, Chrome update installs / On by default

phunkydude — Sun, 26 Jul 2026 00:46:23 +0800

Chrome browser updates and auto-install 4gb of Gemini AI model which turn ON by default.

If you're not using the bloatware or prefer to turn it off / delete it ,

Settings > System > On-device AI > Disable

chrome://flags > Optimization Guide > Enables Optimization Guide on Device > Disable

Delete folder at: \AppData\Local\Google\Chrome\User Data\OptGuideOnDeviceModel

cdn.jsdelivr.net, Error net::ERR_CONNECTION_REFUSED

aeric80 — Wed, 24 Jun 2026 14:31:54 +0800

Hi,

I get the error in console:
net::ERR_CONNECTION_REFUSED

when trying to access
https://cdn.jsdelivr.net/npm/bootstrap@5.3....otstrap.min.css

previously getting error:
net::ERR_CERT_COMMON_NAME_INVALID

Anyone is facing the same issue? I am using CelcomDigi Home Fiber.
I have tried clear cache, flush DNS, restart router and mobile data.

108 Malicious Chrome Extensions target, Google Telegram YouTube TikTok ads

JLA — Mon, 20 Apr 2026 10:11:48 +0800

Socket's Threat Research Team identified 108 malicious Chrome extensions operating as a coordinated campaign under a shared C2 infrastructure at cloudapi[.]stream. The extensions are published under five distinct publisher identities (Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt) and collectively account for approximately 20k Chrome Web Store installs. All 108 route stolen credentials, user identities, and browsing data to servers controlled by the same operator. The extensions remain live at the time of writing. We have submitted takedown requests to the Chrome Web Store security team and Google Safe Browsing.

The campaign spans several threat categories across 108 extensions:

54 extensions steal Google account identity via OAuth2
1 extension actively exfiltrates Telegram Web sessions every 15 seconds
1 extension includes staged infrastructure for Telegram session theft (not yet activated)
2 extensions strip YouTube security headers and inject ads
1 extension strips TikTok security headers and injects ads
2 extensions inject content scripts into every page the user visits
1 extension proxies all translation requests through the threat actor's server
45 extensions contain a universal backdoor that opens arbitrary URLs on browser start

https://socket.dev/blog/108-chrome-ext-link...theft-shared-c2

Cannot login to gmail auto login google chat,

Lamp — Fri, 10 Apr 2026 00:29:59 +0800

Each time I keyin my login info into gmail always either

1) Freeze at loading google workspace refresh auto login to google chat

2) Auto login to google chat

In google chat got gmail icon but when click always login to google chat again in new tab or no function at all.

I login to gmail in windows pc. I cannot acces my inbox mail at all. Clear browser restart computer use a new browser version same thing happen again.

Google for help the ai said must disable meet and chat in gear icon but theres no such gear icon in google chat.

This problem comes out recently I even change password and login again same thing happen again. Really need help here.

<Friend's name> just reposted a video, Tiktok did that? Or was it my friend?

Chastain — Tue, 16 Sep 2025 23:50:08 +0800

Hi

I always view and give a like to my friend's videos/story on Tiktok
Each time I get a notification from tiktok

Lately I am busy.
So I did not open the app for 2 days

But kept getting notifications

» Click to show Spoiler - click again to hide... «

The thing is...the video that tiktok allegedly claimed was reposted by my friend...was actually reposted by my friend weeks ago.
Tiktok glitch?

Tiktok kept sending similar noti

My question is...
The system did that?
Or it was actually my friend undreposted and then reposted again.
If yes, i wonder why she did that.

Add 2nd GMAIL Account Error,

AhMoon — Fri, 11 Jul 2025 12:41:13 +0800

I'm trying to add GMAIL account A into GMAIL account B, using Chrome Browser, but I am getting this error

User ID and Password already confirmed correct, POP and IMAP setting all already enabled, and I have even enabled "Allow Less Secure" option in Google Security Settings, but still getting the same above error.

Does anyone encounter this before and perhaps have a solution for it?

malaysia.indeed.com site error,

Chastain — Tue, 17 Jun 2025 12:29:33 +0800

Hi

Each time I clicked on 'Apply Now'

QUOTE

This site can’t be reached
Check if there is a typo in malaysia.smartapply.indeed.com.

If spelling is correct, try running Windows Network Diagnostics.
DNS_PROBE_FINISHED_NXDOMAIN

It was fine before.

Thank you

Floorp Web Browser,

JLA — Mon, 05 May 2025 16:44:33 +0800

Floorp is an open-source browser derived from Firefox. The Floorp software is made available under the terms of various open source licenses, including the Mozilla Public License. This means you may use, copy, modify, and distribute Floorp to others, as long as you follow the open source licenses and the Floorp Project's trademark guidelines.

Firefox ESR 128.x based
with extended browser settings
Made In Japan

https://github.com/Floorp-Projects/Floorp?tab=readme-ov-file

New PC Cannot Open Certain Website, Websites

tkyong1 — Thu, 21 Nov 2024 08:27:22 +0800

Hi guys,

I have just bought a new PC, I have tried Edge and Chrome, I could not open certain webistes (such as crypto exchange, movie site, japan av site). I can open all of these in my old PC no issue.

May I know what would be the problem? Security Setting?

Any solution?

The error message = hmmm......can't reach this page

how to stop email going to Promotions tab?,

Azran1979 — Fri, 03 May 2024 12:45:34 +0800

Notifications from my Strava subscriptions ended up in Promotions folder in gmail.

This caused me to miss many previous notification.

How do i teach them to go to Inbox instead ?

Solved,

Chastain — Sat, 20 Apr 2024 08:45:55 +0800

- -

YT view, Can we fix this?

Chastain — Sat, 13 Apr 2024 18:49:48 +0800

Suddenly happened.

Chrome browser

Comments were at the bottom.

Now it's on the side.

Can we fix it?

Or it's a YT new feature?

Firefox still use old feature though.

Thank you

Anybody using Tor Browser?,

ally77 — Sat, 03 Feb 2024 23:17:30 +0800

Anyone here using Tor browser? Is it safe to use this browser?

Cheap android app maker to earn money, What company provides this service

zumaidi — Thu, 01 Feb 2024 09:23:11 +0800

Cqn anyone revommend a cheap service privider where ww can build Android apps with no coding and them earn money thru advertising within the app?
I tried Appsgeyser but found out their apps always flagged off by Play Store.
Appreciate for any recommendation.
Thanks.

DNS Leak Test,

JLA — Fri, 26 Jan 2024 12:10:53 +0800

suddenly dns hijack transparent proxy become hot topic

i just said 'welcome to the club'

it been there for month if not years

https://browserleaks.com/dns

https://whoer.net/dns-leak-test

CelcomDigi Fiber last mile connection,

munchoong — Wed, 06 Sep 2023 14:42:24 +0800

Are there any CelcomDigi users here?

I have the following questions.

1) Does CelcomDigi share last mile connection with Unifi (like Maxis) or is it their own cable (like Time Broadband)?
2) Does CelcomDigi allocates everyone their own external IP address? Not talking about static IP. Do they employ CGNAT to assign one public external IP shared amongst multiple users?
3) Does CelcomDigi have any bandwidth throttling or is it bantai je?

Thanks!

Google Drive for Yahoo email account, How to access?

Chastain — Sat, 19 Aug 2023 07:40:19 +0800

Hi

This might sound strange to some of you.
I have a yahoo email account created years ago.
Believe it or not it has Google Drive
Probably back then got some kind of merge between Yahoo and Google.
I have no idea.

15GB
I do not recall how I uploaded the files into it.

Now I wish to access them but don't know how.

QUOTE

Your storage is 98% full
14.78 GB used