I’ve spent 48 hours with the Google Home Speaker, and Gemini is off to a promising start


2.jpg

pros and cons

Pros

  • Loud, crisp sound
  • Gemini for Home with generative AI
  • Intuitive controls.
Cons

  • The microphone array doesn’t pick up voices when the music is loud
  • More expensive than Nest Mini alternatives.

more buying choices

Follow ZDNET: Add us as a preferred source on Google.


The Google Home Speaker was officially released as the company’s latest take on a smart speaker, its first in six years. I’ve been testing the Google Home Speaker for nearly 48 hours, and I’ve got some interesting first impressions.

Also: This tablet replaced both my iPad and Kindle, and it’s 40% off on Amazon right now

With 360-degree audio, the Google Home Speaker offers a new audio experience compared to the Nest Audio and Nest Mini, both of which feature front-facing sound. The new experience, however, doesn’t necessarily mean it will be obviously better.

Best bluetooth speaker deals of the week

Deals are selected by the CNET Group commerce team, and may be unrelated to this article.

The new audio experience

With the Google Home Speaker, Google did away with the Nest moniker for its smart home speakers and redesigned the audio experience for its newest device. While many customers are looking forward to the new Google Home Speaker, others are concerned that the technology inside may not be enough to justify the upgrade.

Though Google says the new speaker has 2.5 times the bass of the Nest Mini, it uses a single 58mm driver. The $120 Google Nest Audio, released in 2020, has better hardware, with a 75mm mid-woofer and a 19mm tweeter. Considering that the new Google Home Speaker sits squarely in the same $100 price range as the Nest Audio, I’d say the concern is valid.

Also: I’m a smart home expert, and these security camera deals are actually worth considering

However, the specs alone don’t tell the full story. In my, albeit limited, tests, the Google Home Speaker delivers powerful, clear sound comparable to that of the Apple HomePod mini, which also features a two-inch full-range driver. It certainly surpasses the audio experience from the Nest Mini and the older Echo Dot.

Surprisingly easy controls

Google Home Speaker

Maria Diaz/ZDNET

Unlike its biggest competitors, the Google Home Speaker doesn’t have a physical control panel along the top: There are no buttons or display to control volume or play or pause. I was convinced that this would make it hard to navigate or to learn to control it without using my voice or the Google Home app, yet I was surprised that this wasn’t the case.

Google keeps it pretty simple with the Google Home Speaker: Tap the top to play or pause, and tap the lights on the sides to increase or decrease the volume. The lights turn on as soon as you tap the speaker, so you can easily see them without having to figure out what you’re doing.

The new Gemini vs. Google Assistant

Google has been committed to delivering an improved Gemini for Home experience for months, and the Google Home Speaker succeeds in this endeavor. Compared to Alexa+, its most similar competitor, Gemini in the new smart speaker is a less jarring experience right off the bat. As someone who’s used Alexa+ for months, I still haven’t gotten used to its happy-go-lucky, overly excited tone.

Also: I tried Gmail’s new Gemini Flows feature, and it’s a huge filter improvement (with one big catch)

Like the Gemini experience in Google Home, the Gemini app, and Android devices, Gemini in the Google Home Speaker is conversational without being too cheery, though it still has some quirks. Most AI companies have done away with certain quirks like the “as an AI…” responses, but not Gemini. 

This doesn’t make Gemini obsolete or mean the assistant is falling behind; it’s just something to point out.

Google Home Speaker

Maria Diaz/ZDNET

Gemini in Google Home Assistant works as well as it does elsewhere. It’s responsive without being overeager, its responses are informative and mostly accurate (which is what you can expect from any generative AI bot), and it reliably generates content. Conversations in general with the Google speaker feel more natural than any other smart device I’ve tested in my home.

These features put it leaps and bounds ahead of Siri’s performance on the HomePod and HomePod mini, which still don’t have generative AI. Plus, with Alexa+’s gratingly Pollyannaish tone, Gemini for Home has been my preferred home assistant over the past couple of days.

The letdown: microphone array

Far-field microphone arrays tend to be problematic for smart speakers, as they must balance voice input collection with the playback of music or other audio content. Every company wants the best-sounding, most powerful speaker with a smart, AI-powered voice assistant at the lowest price, and it’s no easy feat.

As a result, speakers need a strong microphone array that allows them to hear voices even with the volume turned up. The Google Home Speaker features three far-field microphones with a neural processing unit (NPU) for local sound isolation. Unfortunately, I struggled to get the Google Home Speaker to listen to me when I played music, even when I turned it down to two-thirds of the way up.

Also: I got a 50% off Fire TV Stick this Prime Day, and I’m watching these top streaming deals

This means I have to go up to the speaker and pause the music by tapping the top, which isn’t a terrible inconvenience, but it defeats the purpose of having a voice-activated smart speaker.

ZDNET’s buying advice (for now)

Google Home Speaker

Amazon Echo Dot (left), Google Home Speaker (center), Apple HomePod mini (right).

Maria Diaz/ZDNET

Compared to its direct competitors, the Google Home Speaker is a strong contender that outperforms the fourth-generation Amazon Echo Dot and, in some cases, can beat the newer Echo Dot Max

Compared to the Apple HomePod Mini, Google’s latest speaker falls a bit flat on audio and can’t beat Apple’s microphone performance and quality. However, Google’s speaker has Gemini, a hands-free generative AI assistant, while the HomePod mini is, for now, still stuck with the older version of Siri. That alone may sell the Google speaker for many of you.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link