Andre Espirito Santo

Reproducing a Double Free RCE in Apache CVE-2026-23918 on the most used software on the internet with one prompt that costs like $0.001 via DeepSeek is scary as hell. Now, anyone with zero knowledge can hack the internet. (Not default installs though. You need mod_http2 enabled.)

Google Chrome is quietly downloading a roughly 4 GB AI model to many users’ computers without clear upfront consent. The file, called weights.bin, is part of Google’s Gemini Nano on-device language model and lands in the browser’s user data folder under OptGuideOnDeviceModel. It powers built-in AI tools such as “Help me write,” smarter tab suggestions, on-device scam detection, and page summarization. The download triggers automatically for devices meeting minimum hardware requirements, and Chrome often replaces the files if deleted. While the model processes data locally, installation happens in the background with minimal notification. The scale is noteworthy. Hundreds of millions or billions of installations add up to thousands of tonnes of carbon emissions globally from data transfer, even though each is a one-time event. To prevent or remove it, go to chrome://flags, disable the entries for the optimization guide on-device model and Prompt API, restart the browser, and manually delete the folder.