Parisa Tabriz: Google's Security Princess Takes on Chrome

Google's org chart lists Parisa Tabriz as a vice president. Her business card, for more than a decade, has said something else: Security Princess.

The title started as a joke before a business trip to Japan. The job it described was no joke at all: leading the hackers Google pays to break Google, then the team that protects the billions of people who use Chrome.

She got there without touching a computer until college, which may be why she believes security should be something nobody has to think about.

Parisa Tabriz at a Glance

• Raised in the Chicago suburbs by an Iranian immigrant doctor and a Polish-American nurse, Tabriz grew up on art, sports and outthinking her two brothers.
• She only learned to program at the University of Illinois, where a hacked personal website led her to a Friday-night security club and two computer science degrees.
• She joined Google in 2007 as the tenth member of its hired-hacker security team and, needing business cards for a Japan trip, named herself Security Princess.
• Her team caught the 2011 DigiNotar certificate breach, and by 2014 she was running Chrome's security team of thirty hackers.
• In 2018 she helped organize OURSA, a pop-up conference built in five days to protest an all-male RSA keynote lineup, and gave the keynote at Black Hat.
• Running Chrome and Project Zero as a director of engineering, she pushed the web to HTTPS by default and oversaw the team that helped find Meltdown and Spectre.
• Promoted to vice president and general manager of Chrome, she testified in 2025 in the government's antitrust case that the browser couldn't be pried loose from Google. The judge let Google keep it.
• In 2026 she's steering Chrome into the AI era, with Gemini built into the browser and an agent that can browse for you.

The Life of Parisa Tabriz

Tabriz's Early Years

Parisa Tabriz grew up in the suburbs of Chicago, the daughter of an Iranian immigrant father who was a doctor and a Polish-American mother who was a nurse.

Technology wasn't part of the picture. "I didn't touch computers up until college," she told Elle. She made art, played sports and competed hard with her two brothers.

"When I couldn't outmuscle them," she said, "I had to outthink them."

Friday Nights in the Basement

At the University of Illinois at Urbana-Champaign she enrolled in engineering and found computer science. Then somebody hacked her website. "My website had gotten hacked, so I wanted to figure out why."

She found a student group called SIGMil that met on Friday nights in the basement of the computer science building, with hacking challenges guarding the door. There she picked up web attacks like cross-site scripting and taught them to the others.

She'd already been hacking in a smaller way. Building sites on the free service Angelfire, she couldn't afford the ad-free tier, so she found ways to strip out the banner ads.

"It gave me control of my canvas," she said. "That's how I got into computer security."

She graduated with a bachelor's in computer science in 2005 and a master's in 2007, doing security research under adviser Nikita Borisov.

Hired Hacker

Tabriz spent a summer as an intern on Google's security team and, in 2007, joined full time as the tenth member of a small group of hired hackers responsible for the company's software security.

Then came a trip to Japan, where business cards are exchanged with ceremony. Her official title, Information Security Engineer, struck her as "completely dry and boring and horrible." Some colleagues had cards reading "hired hacker."

"But I like to one-up people," she said. "I thought it was cute." The cards said Security Princess, and so has every profile of her since.

By 2014 the team of ten had grown to more than 250 security engineers.

DigiNotar and Chrome

The team's work was mostly invisible: finding and fixing holes before anyone else did. Occasionally it made headlines. In 2011 her team discovered that DigiNotar, a Dutch certificate authority, had been hacked, putting hundreds of thousands of Iranian Gmail users at risk.

By 2014 she was leading Chrome's security team, and by 2015 managing thirty hackers paid to think like criminals about the world's most-used browser. "A majority of the people working in information security are guys," she told CBS, "but I'm hoping to change that."

At the 2013 Chrome Dev Summit she'd given a talk called "Got SSL?", an early shot in a campaign to move the entire web onto encrypted connections.

Princess at DEF CON

In August 2014 the 31-year-old Tabriz stood under a disco ball in a Las Vegas theater normally used by Penn and Teller, teaching children at r00tz, the kids' conference attached to DEF CON. She explained Diffie-Hellman key exchange with water and food coloring and arranged for 300 Chromebooks to be given away.

She rock climbs before work, and told Wired that climbing and hacking have more in common than people think. Both are about finding a route up something built to keep you out, and both are fields where women are rare.

Not Secure

2018 was the year she became an industry figure. In February the RSA Conference announced a keynote lineup in which every speaker but Monica Lewinsky was a man. Within five days Tabriz and a handful of others had organized OURSA, a one-day alternative conference in San Francisco that sold out in under twelve hours.

"We're tired of the same old pieces," she said.

In July Chrome began labeling every unencrypted website "Not Secure." In August she gave the keynote at Black Hat as Google's director of engineering and explained the thinking: security should be the default, so the green "Secure" badge had to go, and the warning had to land on the laggards.

"The end of the journey is for people creating content on the web, the vast majority of them don't even have to think about it," she said. "It's just by default."

Running Project Zero

By 2020 she was running two of Google's most consequential teams at once: Chrome, and Project Zero, the bug-hunting unit whose researchers helped uncover the Meltdown and Spectre processor flaws in 2018.

The job kept growing. In 2022 she was a vice president; by 2023 she was vice president and general manager of Chrome, responsible for engineering, product and design for a browser used by billions, while still overseeing Project Zero.

On the Witness Stand

In April 2025 Tabriz took the stand in Washington in the Justice Department's antitrust case against Google, which had already been found to hold an illegal monopoly in search. The government's proposed remedy was to make Google sell Chrome.

She argued that Chrome and Google were too entangled to separate. "Trying to disentangle that is unprecedented," she testified, and of the browser's success in anyone else's hands: "I don't think it could be recreated." Google, she said, pours "hundreds of millions of dollars" into the open-source Chromium project that rivals also build on.

In September 2025 Judge Amit Mehta ruled that Google could keep Chrome, while ordering it to share search data with competitors.

Tabriz Today

Chrome's next fight is with the AI era, and Tabriz is leading it. In September 2025 Google built its Gemini assistant into Chrome for US users, and in January 2026 she announced Gemini 3 in the browser along with "auto browse," an agent that can carry out multi-step tasks on the web by itself.

She's careful about what that means. "Auto browse is designed to pause and explicitly ask for your confirmation or prompt you to complete some tasks like making a purchase or posting on social media," she wrote.

The student who once stripped banner ads from her Angelfire page now decides what happens by default for a sizable fraction of humanity.

Parisa Tabriz: Security by Default

Tabriz's career is an argument that the best security is the kind you never notice. The padlock that disappeared from Chrome, the "Not Secure" label that shamed half the web into encrypting, the bugs fixed before anyone knew they existed: that's the work.

She did it while refusing the industry's default of being the only woman in the room, and while keeping a title that still makes executives blink.

Security Princess was a joke on a business card. The woman who chose it now runs Chrome.