A Windows flaw is on the US government's list of vulnerabilities under active attack, researchers catalogued 737 fake VPN add-ons in Chrome's store, and Google's new Pixel phones arrive on August 20
A Windows flaw is on the government's "actively exploited" list — update this week
The US cyber agency keeps a public catalogue of vulnerabilities it has evidence are being used in real attacks, rather than merely reported as possible. A Windows flaw was added to it on August 11. The catalogue entry records CVE-2026-68820 as a use-after-free flaw in the Windows Ancillary Function Driver for WinSock — the component that handles network connections — which "allows an authorized attacker to elevate privileges locally", and sets August 25 as the date by which federal agencies must act, with the required action being to apply the vendor's update. The catalogue records the flaw's use in ransomware campaigns as unknown.
"Elevate privileges locally" is the part worth translating. This is not a flaw that lets someone reach into your computer from the internet. It is one that takes an attacker who has already got something running on the machine — the program that arrived as an email attachment, the installer from a search advert — and promotes them from a limited account to full control of the system.
Why it matters: the government's own deadline for this one is two weeks, and the criterion for a vulnerability appearing on that list at all is that attacks using it have already been observed. It is the second half of an attack rather than the first, which is exactly why it should not be left sitting: it turns a mistake that might have been contained into a compromise of the whole machine. On Windows, open Settings, then Windows Update, and click Check for updates today rather than waiting for the next automatic restart. If someone else looks after your work computers, ask them to confirm the August updates have gone out and by what date.
737 fake VPN add-ons were catalogued in Chrome's store
Security researchers published an inventory of Chrome extensions that advertise themselves as free VPNs and do close to the opposite. Their report describes 737 extensions published through at least 40 developer accounts with more than 75,000 installs between them, of which 274 copied the name or branding of 66 genuine VPN and privacy services — the imitated names include several of the best-known paid VPN brands. Of the extensions the researchers were able to download and inspect, 520 out of 522 configured the browser to send traffic from every tab through one fixed server once the user pressed Connect.
That arrangement puts whoever runs the server in the middle of the browsing. From that position they can see which sites are being visited, from what address, and the full contents of anything not sent over an encrypted connection. Much of the campaign was aimed at people trying to reach services blocked where they live — users with a strong reason to install something quickly and a poor position from which to check it.
Why it matters: an extension is not a small decoration on the browser. It can be granted the ability to watch and redirect everything passing through it, which is why "free VPN" is one of the most reliably abused categories in any add-on store — the product being sold is the traffic. Open your extensions list today (type chrome://extensions in the address bar), remove anything you do not actively use, and treat anything VPN or proxy related that you did not download from the vendor's own website as suspect. If you remove one, check afterwards that your browser's proxy settings have gone back to normal, because that setting can outlive the extension that made it.
Google's new Pixel phones arrive August 20, and cost more
Google announced its 2026 phone line this week. The Pixel 11 starts at $899, the Pixel 11 Pro at $1,099 and the Pixel 11 Pro XL at $1,299, all beginning at 256GB of storage, available to pre-order now and in shops from August 20. The Pro is $100 above last year's equivalent. The hardware changes are modest and the pitch is the assistant: Google says the new chip has 50% more of the processing dedicated to AI and handles on-device AI tasks up to three and a half times faster than the previous generation, and the phone has an indicator light that glows in different patterns to show whether the assistant is listening, thinking or responding.
Why it matters: for most people this is a "not this year" purchase. A $100 increase on the Pro tier alongside a modest hardware step is a reasonable case for keeping the phone you have, and last year's model typically drops in price the week the new one reaches shops — which is the better deal on that date for anyone who does need to replace a handset. If you are buying, the practical detail is the 256GB starting point across the line, since storage was previously where the cheapest configuration hurt.