This week in browsers: hijacked searches, Gmail autofill and security updates

A Chrome 156 update fixes 52 security bugs. About a week after Chrome 156 itself, Google pushed the 156.0.8078.73/.74 update to the stable channel on 27 October with 52 security fixes, four of them rated Critical, in components including FileSystem, Skia and Layout. Google's release notes don't flag any of them as exploited in the wild. Even so, Malwarebytes recommends installing the update promptly. Google Chrome updates itself, but the fix only applies after a restart.

Firefox 159 closes 167 vulnerabilities. Mozilla's advisory for Firefox 159, also released on 27 October, lists 167 CVEs: 108 rated high, 52 moderate and 7 low. That number looks alarming partly because Mozilla now publishes a separate advisory entry for each memory-safety bug it finds internally, instead of grouping them. Either way, Mozilla Firefox users should update.

Firefox's Smart Window learns to fill forms and watch pages. Mozilla's opt-in AI window for Mozilla Firefox, still in beta, can now fill forms using information from tabs you choose, and it never submits the form for you. You can also type /watch to have it check up to five pages daily or weekly for a change you describe. According to Mozilla, it's available in English in the US and Canada, and page watching is listed among the Firefox 159 changes.

Banks are pushing back on AI agents that log in for you. Large US banks, including JPMorgan and Bank of America, are blocking third-party AI agents that customers let into their accounts by sharing their logins, a story that first surfaced on 22 October and gathered pace this week. American Banker reports that Wells Fargo's online access agreement treats anything an agent does as "initiated and authorized directly by you" (American Banker, Malwarebytes). If you use an AI browser's agent mode for errands, expect banking to be one of the first places it gets turned away. Never hand an agent your bank password. See our guide to the best AI browsers for how the agent features compare.

An Edge 156 update broke attachments in the new Outlook. According to German reports of Microsoft's service notice, the Edge 156 update accidentally switched on an unneeded configuration, and attachments in the new Outlook for Windows stopped opening. The new Outlook renders its content with WebView2, Edge's engine, which is how a browser update reached an email app. A targeted fix began rolling out on 29 October, and you need to fully close and reopen Outlook for it to apply (BornCity, PC Games Hardware). It is a reminder that a Microsoft Edge update can affect apps that never look like a browser.

Opera GX gets per-tab volume and EQ. Opera GX's Browser Booster update adds a volume booster that takes any tab up to 500%, and an audio equalizer with eight presets. Both are set per tab and remember each tab's settings. The update also brings a search that finds tabs across all windows, Workspaces and Tab Islands, and Opera says GX is the first browser to combine a volume booster with an equalizer. The booster, equalizer and tab search are out now on Windows, Mac and Linux, while four-tab split screen is rolling out first in the Early Bird build (Opera).

Opera wants websites to run AI on your device. Opera announced WebAI, which it presents as a proposed web standard. It gives websites and extensions APIs to generate text, classify content and understand how pieces of information relate, using open-weight models such as Google's Gemma, running on your own hardware rather than in the cloud. It's off by default, sites must ask before using your GPU or memory, and it starts as an early preview in Opera One on Windows and Apple Silicon Macs (Opera, Android Headlines, Thurrott). Opera doesn't name a standards body for the proposal, and we found no other browser shipping it yet. That makes it one to watch rather than one to build on.