AI Weekly Malaysia

737 free Chrome VPN and proxy extensions across 40+ developer accounts were found routing users' entire browser sessions through a single SOCKS5 proxy on port 1082, giving the operator adversary-in-the-middle visibility into destinations, source IPs, TLS SNI values, and plaintext HTTP bodies. 274 of these impersonated 66 real VPN brands including NordVPN, Proton VPN, and ExpressVPN; 221 have been removed but 516 remain active on the Chrome Web Store with 75,486 total installs.

Why: If you or your team uses a free Chrome VPN extension, check it against the list of 737 identified extensions — 516 are still live and can intercept all non-loopback browser traffic including API calls and credentials sent over plain HTTP. Builders who use browser-based VPNs for testing geo-restricted APIs or bypassing regional blocks should switch to system-level VPNs or verified provider apps instead of store extensions.

Chrome uses a JPEG decoding optimization where it avoids fully decompressing large JPEGs when rendering them at small sizes, instead leveraging the DCT frequency-domain data directly. This causes tiny JPEGs to look noticeably different in Chrome versus Firefox—often thicker or less faithful to the original—because high-frequency detail is handled differently during downscaling.

Why: If you ship small JPEG icons or logos (e.g., 15-20px), don't assume they render identically across browsers; Chrome's partial-decode optimization can alter appearance at small sizes. Switching to SVG for small icons avoids this entirely, as the author did.

uBlock Origin has reportedly stopped trying to block Facebook ads, conceding that Facebook's ad delivery has become too deeply embedded in its content pipeline to reliably filter. The HN discussion (696 points, 854 comments) reflects broader frustration with the ad-blocker arms race as platforms increasingly interleave ads with organic content.

Why: If you ship browser extensions, content filters, or any tool that relies on DOM-level ad detection, Facebook's approach is a signal that platform-side ad integration is moving toward indistinguishable-from-content delivery — your filtering strategies may need to shift from pattern-matching to heuristic or ML-based approaches. For everyday users in Malaysia where Facebook remains a primary business and community platform, this means ad-blocking on Facebook is effectively over.

Anthropic rebranded the Claude Chrome side panel to 'Claude Cowork,' making browser sessions sync with desktop, web, and mobile apps so multi-step tasks carry across surfaces. Claude can see pages, click links, type text, and fill forms using your existing logins, targeting internal dashboards and vendor portals that lack API integrations. It's available on Max and Team plans now, rolling out to Pro over coming weeks, with an 'automatically approve' mode that lets Claude work without pausing for permission at every step.

Why: If you're evaluating browser-based AI agents for automating work in legacy systems or vendor portals that don't have APIs, this gives you a concrete option with session continuity across devices. The prompt injection risk is real and acknowledged by Anthropic itself—anyone using auto-approve mode should understand that malicious web content can redirect Claude to unintended actions before consequential steps.