Google Chrome Update message keeps popping up

[Arakawa]

Good day everyone, I’m currently experiencing bug in my brave browser, I tried updating it through the settings inside the brave browser and it updated, after that, the “Google Update” keeps popping up.

Here attached is a screenshots of the pop-up. update version of Brave Browser itself.

Additionally I tried downloading (without installing the program from the site (update button))
A digital signature from name signer “Hubei Da’e Zhidao Food Technology” and Digest Algorithm “sha256”.

P.S. This pop-up is present before and after the update of brave browser.

P.P.S. I deleted the program I downloaded, I just looked in the Digital Signature.

[289wk]

@Arakawa

Please EDIT your Original Post (“OP”) above, in order to include:

• Brave Browser version numbers
• OS version numbers

---

Where Brave Browser Profiles Are Located

With Brave Browser running, open a New Window and go to: brave://version

Scroll down to Profile Path: You should see, for

Linux OS - usually but not always:

/home/[username]/.config/BraveSoftware/Brave-Browser/[profile_folder_name]

MacOS: /Users/[username]/Library/Application Support/BraveSoftware/Brave-Browser/[profile_folder_name]

Windows OS: C:\Users\[UserName]\AppData\Local\BraveSoftware\Brave-Browser\User Data\[profile_folder_name]

The actual Profile folder names for [profile_folder_name] would be:

• Default
• Profile 1
• Profile 2
• Profile n [where n is the next increment: 3, 4, . . . etc.]

Upon the original installation and setup of Brave Browser (“BB”):

The 1st BB User Profile is named Profile 1 and its data is maintained within the folder named Default:

• MacOS: /Users/[username]/Library/Application Support/BraveSoftware/Brave-Browser/Default
• Windows OS: C:\Users\[UserName]\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default

When proceeding with the creation of additional BB User Profiles:

The 2nd BB User Profile name will be Profile 2 and its data will be maintained within the folder named Profile 1:

• MacOS: /Users/[username]/Library/Application Support/BraveSoftware/Brave-Browser/Profile 1
• Windows OS: C:\Users\[UserName]\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1

The 3rd BB User Profile name will be Profile 3 and its data will be maintained within the folder named Profile 2:

• MacOS: /Users/[username]/Library/Application Support/BraveSoftware/Brave-Browser/Profile 2
• Windows OS: C:\Users\[UserName]\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 2

Repeating the pattern of BB User Profile creations:

• Actual 1st BB User Profile data is in folder named Default
• Actual 2nd BB User Profile data is in folder named Profile 1
• Actual 3rd BB User Profile data is in folder named Profile 2
• Actual 4th BB User Profile data is in folder named Profile 3

Renaming the BB User Profile name(s) . . . DOES NOT CHANGE the folder names and structure:

• Renaming 1st BB User Profile name, from Profile 1 to Bob8 ← still uses folder named Default
• Renaming 2nd BB User Profile name, from Profile 2 to Hope ← still uses folder named Profile 1
• Renaming 3rd BB User Profile name, from Profile 3 to Emma ← still uses folder named Profile 2
• Renaming 4th BB User Profile name, from Profile 4 to Work ← still uses folder named Profile 3

---

DO NOT CHANGE the names of the folders.

Also, do not swap folders that have unmatched names. For example, do not swap folder Profile 2 for folder Profile 5.

The above notes, are also at:

‘Where Brave Browser Profiles Are Located’

---

64 architecture, system level installation:
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe

x86 architecture, system level installation:
C:\Program Files(x86)\BraveSoftware\Brave-Browser\Application\brave.exe

64 / x86 architecture, user level installation (NOTE: you must substitute your Windows OS user account name for [UserName]):
C:\Users\[UserName]\AppData\Local\BraveSoftware\Brave-Browser\Application\brave.exe

Determine Windows OS PC architecture - try any of:

Settings → System and then About (bottom left corner). It should be listed under Device Specifications ← scroll to that, and look for System type (example: 64‑bit operating system, x64‑based processor)

Command Prompt: wmic os get osarchitecture

‘https://support.microsoft.com/en-us/windows/32-bit-and-64-bit-windows-frequently-asked-questions-c6ca9541-8dce-4d48-0415-94a3faa2e13d’

---

Installation and Un-installation of Brave Browser

Install Brave Browser (Desktop)

Brave Browser Beta
‘https://brave.com/download-beta/’
‘https://github.com/brave/brave-browser/releases?q=beta&expanded=true’

Brave Browser Nightly
‘https://brave.com/download-nightly/’
‘https://github.com/brave/brave-browser/releases?q=nightly&expanded=true’

Brave Browser Stable Release
‘https://brave.com/download/’
‘https://github.com/brave/brave-browser/blob/master/CHANGELOG_DESKTOP.md’

Brave Browser for Linux OS - How to install
‘https://brave.com/linux/’

Brave Browser Release Schedule at Brave GitHub:
‘https://github.com/brave/brave-browser/wiki/Brave-Release-Schedule’

---

At GitHub, typical example of Brave Browser installers for Windows OS (64-bit machine) users:

ARM: ‘https://github.com/brave/brave-browser/releases/download/v1.85.118/brave-v1.85.118-win32-arm64.zip’

INTEL: ‘https://github.com/brave/brave-browser/releases/download/v1.85.118/brave-v1.85.118-win32-x64.zip’

Uninstall Brave Browser (Desktop)

The Brave Browser application brave.exe etc.:
‘Every time I open the browser it closes again directly - #20 by clifton’

The Brave Browser updater, BraveUpdate.exe:
‘Have to re-install Brave multiple times per day on Windows11 - #24 by mherrmann’

A note from Brave Support, if all you want, is: How do I delete my data in Brave?
'https://support.brave.app/hc/en-us/articles/4413256282765-How-do-I-delete-my-data-in-Brave

---

IF still struggling to uninstall, try:
https://crystalidea.com/uninstall-tool

[Arakawa]

Hi! I edited it with few additions.

Thank you so much for replying!

[289wk]

@Arakawa

Please look at my previous reply, where I have added a lot of details re Brave Browser installation.

I presently believe, that you should map out on paper, EVERYWHERE you have the:

• Google Chrome installation
• Brave Browser installation

I would back up your data as best you can.

Do you know, or do you believe, that your Windows OS machine is somehow managed by an organization - and therefore an organization’s Group Policy may have some control over your Windows OS machine?

---

[Arakawa]

I personally bought this laptop from a dealer, so there would be no connection to any organization besides the brand itself.

As of now I’m scanning my entire O.S and Drives to check if there are virus, after that, I’ll try reinstalling Brave Browser and update here again.

Thank you again for your time.

[Saoiray]

@Arakawa the popup you’re sharing is more of a malware. It’s not from Brave but would be an extension you added or, as said, some malware you’ve downloaded.

Uninstalling and reinstalling Brave wouldn’t get rid of that. You would need to remove the origin

[289wk]

@Saoiray

So the looks-like-a-Google update alert is a fake? I thought it might be a typical update notice, like the Adobe prompt or Winzip prompt that occur on a public library computer that I can sometimes use.

[289wk]

@Arakawa

May be handy in your search for malware:

Command Prompt tool: dir /p /o:-d ← This Command Prompt entry, will find the recent items in a directory / folder. To see only files: dir /a:-d /p /o:-d To see only directories: dir /ad /p /o:-d

IF you include the /X then filename extensions will show for a shortened filename convention (8.3 something) where the file name is 8 characters: dir /p /o:-d /X

DATE	TIME	SIZE	8 CHARS	FULL NAME
04/19/2017	09:50 PM	7,606,728	ASPOSE~4.DLL	Aspose.Cells.dll

---

[Saoiray]

@289wk

So the looks-like-a-Google update alert is a fake?

Yeah. We’re on Brave. Why would it be telling us Chrome is out of date and to update it? This appears just because Brave reports the User Agent as Chrome. So this is a giveaway that it’s not anything legitimate. But there are many variations of the same which is just virus, malware, or complete scam.

Someone else shared a similar from Vivaldi: https://www.reddit.com/r/ArcBrowser/comments/1r8wxep/whats_that/

Can see discussion of this from 2024/2025 at https://www.reddit.com/r/chrome/comments/1fh2m5v/is_this_chrome_malware_attempt/ even where some talked about how it resulted in them losing money.

Bank warning people about similar at https://midpennbank.com/fake-web-browser-update-dont-get-tricked-by-this-ghoul/

Old post about it here on Brave Community via Being warned to update Chrome (using the latest Brave) with link to trojan - #2 by BA76 though the link in that message is no longer valid

Other one is like ChromeActions which is fake. It gets crazy how much stuff is out there.

[MasterLink]

Not to mention common sense dictates that Google nor Brave would be using FOOD TECHNOLOGY as a digital signature.

[Arakawa]

Hello everyone thank you Saoiray & 289wk, there seems to be a trojan in my laptop, currently removed it and pop-up is gone, as of now observing my laptop and scanning again the entire system especially the part of users folder in C: and Program Files folders.

And to MasterLink, yes as soon as I downloaded it thinking it was an authentic update, instinct rushed since all the browsers I used, updates were through the settings. That’s why I downloaded it and checked the details especially the signatures.

[Arakawa]

It seems that I have to format my entire system.

[HeisDeisk]

I got the same pop up,but i didn’t download anything,i also have Ublock origin,after deleting 2 extensions the pop up disappeared but im a bit concerned if my system have a trojan or something

[Saoiray]

@HeisDeisk

after deleting 2 extensions the pop up disappeared

It would be nice to know which extensions. But it could be that the extensions themselves were advertising it and might have been trying to get you to click on and add things.

@HeisDeisk

a bit concerned if my system have a trojan or something

It’s possible. Extensions or any file downloads always carry risk. This is part of why we see some of the warnings we do when we go to add extensions. For example:

When we add extensions, we’re often telling the browser we are aware of the risks and we fully trust whatever we’re adding with any of the data on our browser or device. It then is out of the browser’s hands in terms of what is done.

This is the same for files or torrents we download and all. It can only do so much. They do try to have some baseline protections by giving warnings, especially if it’s a domain known to have bad stuff, but still is on us to know what we’re visiting and doing.

My assumption is this was more just the superficial level area. It was serving as scareware or adware in hopes to get you to download something else, give it extra permissions, or to provide something like payment information. But it can still be good to run scans with things like Malwarebytes or virus scanners to be safe.

[HeisDeisk]

I think the extension was this one: https://chromewebstore.google.com/detail/quicklens-search-screen-w/kdenlnncndfnhkognokgfpabgkgehodd

I found a Reddit post where some other guy also had the same extension,and after deleting it the pop up disapeared,i restarted my pc and everything seems fine

[Arakawa]

Hhhmmm that seems to be it (?), I used to use that extension before formatting my entire system.

[Arakawa]

It’s probably why Windows Defender wasn’t able to flag it because this is just an extension. Although I’m quite disappointed that Brave Browser (customer installed software) wasn’t able to scan it.

[Arakawa]

I hope that Brave (community (?) or Brave Devs) will be able to flag this extension as threat/risk for the community. Thank you so much HeisDeisk.

[MasterLink]

@Arakawa

It’s probably why Windows Defender wasn’t able to flag it because this is just an extension. Although I’m quite disappointed that Brave Browser (customer installed software) wasn’t able to scan it.

It appears it was legit at one point. From what I can gather, the malware isn’t in the extension itself, the extension is merely pulling it’s “assets” from a web server, so the extension itself has nothing to be scanned. It’s when it goes to a server to download it’s assets, that the malware comes in. Odd, but that’s how it avoids being scanned. Also, the compromise is on the developers on web server where they are hosting where the extension “phones home”, and it seems it targets Mac OS users as well, not just Windows so it’s actively reading the user agent to determine the host platform.

@Arakawa

Although I’m quite disappointed that Brave Browser (customer installed software) wasn’t able to scan it.

ahem

@Saoiray

This is part of why we see some of the warnings we do when we go to add extensions.

With extensions does come some user responsibility, and again, in this case it seems like an extension that may have been legit at one point, because compromised and the way it was compromised isn’t something that can be scanned, it’s remote not local. It only becomes local once the payload is downloaded.

Welcome to how delivery of malware works, and why they usually evade software until it’s too late. We literally cannot cover eveyrthing, we can only do our best.