Security fix release for Coolify 4.3. Apply it with: curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash

• Milestone

This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).

Note that our rolling-release channel (edge) is recommended for faster security patches.

Bug fixes highlights 🐛:

• PHP CVE-2026-109618, CVE-2026-109619 php#2026-10-21-5

This release has been made by @Alkarex, @Inverle and newcomer @Ricardo-Simoes

Full changelog:

• Deployment
  • Docker default image updated to Debian 13 Trixie with PHP 8.4.27-1~deb13u1 and Apache 2.4.69
• Extensions
  • New hook: Minz_HookType::AutofillField for auth views #9362
• I18n
  • Improve Brazilian Portuguese #9473
• Misc.
  • Translate non-English code comments and identifiers #9383

Security

• Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
• Updated Node.js to 24.22.1 for the terminal server and the asset build.
• Updated cloudflared to 2026.10.3
• Updated Sentinel to 1.1.2.

5.59.0 (2026-10-21)

🚀 New feature

• make CLI post-install commands more visible (855871757d)
• changing the upgrade link (9a4bc48729)

🔥 Bug fix

• correcting linting after Codex review (13c317ddbd)
• updating the spacing beween the lines (f6aa6e3b96)
• trying the space in a different way (d6450b12ad)
• admin: reject role name and description longer than 255 characters (#28002)
• admin: apply boolean false filters in list view (#27938)
• admin: custom RBAC conditions in a custom category are discarded (#28020)
• admin: derive the auth cookie path from admin.url (#27619)
• admin: reject token name and description longer than 255 characters (#28004)
• cli: remove the expiration date check (#28076)
• content-manager: keep list columns when an attribute is renamed (#28036)
• content-releases: deleting a non-localized entry leaves it in its releases (#28023)
• content-releases: await release cleanup inside its try/catch (#27893)
• content-releases: bootstrap fails when the core store has no saved schemas (#28121)
• core: close remaining clone relation edge cases (#26970)
• core: fetch requests setting their own content-length fail after loading undici 8 (8b5dea865d)
• core: https requests through a proxy fail after loading undici 8 (29c762cd0d)
• core: unhandled rejection when an entry event fails to emit after commit (#28017)
• core/core: event hub off() and once() remove the wrong listener (#28051)
• create-strapi-app: next-step cd command misreads folder names that start with - or ~ (31e16d56df)
• create-strapi-app: bump better-sqlite3 pin to 12.11.1 for Node 26 support (#27759)
• database: populate relations sequentially inside a transaction (#27644)
• database: connection function holds a pool connection forever on postgres and mysql (#27979)
• document-service: publishing an entry linked from a widely reused component takes minutes (#27942)
• email-nodemailer: decodeRfc2047 ignores the charset of encoded words (#27822)
• i18n: restore ICU arguments in 68 admin locale strings (#27908)
• review-workflows: weekly telemetry sends metrics object as numberOfActiveWorkflows (#27866)
• review-workflows: hide review workflow panel on published tab (#28009)
• review-workflows: weekly metrics sendMetrics regression tests never run (#28063)
• upload: honor sharp limitInputPixels config in image manipulation (#27161)
• upload: rebuild the content manager media field (#27848)
• upload: add an Add asset menu to the media field (#27856)

📚 Documentation Changes

• fix three dead relative links (#27719)

⚙️ Chore

• format files with prettier 3.9.9 (#28043)
• ai: add create-issue skill (#27992)
• database: upgrade knex from 3.0.1 to 3.3.0 (#27982)
• deps: bump prettier from 3.6.2 to 3.9.9 (f8ce51ac65)
• deps: upgrade undici from 6.29.0 to 8.11.2 (bff2ccfc7f)
• deps: upgrade undici from 8.11.2 to 8.12.1 (a78ad0d6de)
• deps: bump browserslist from 4.28.8 to 4.28.9 (#27851)
• deps: bump markdown-it (#28074)
• docs: contributor docs are excluded from prettier checks (#28062)
• lint: eslint fails to parse vitest.config.ts in admin/server packages (#28064)
• lint: extra-policy oxlint perf on the blocking gate (#27671)
• review-workflows: migrate unit tests from jest to vitest (#27388)
• review-workflows: stop passing ignored populate to workflow create and update (#27865)
• types: centralise the window.strapi type in @strapi/types (#26213)
• upload: enforce the media MCP ambient guard by construction (#27617)

💅 Enhancement

• database: describe connection pool timeouts (#28000)
• utils: avoid rebuilding curried traversal wrappers on every call (#27947)
• utils: remove per-key allocations from the query traversal (#27233)

⚠️ Changes to be aware of

Database driver update (knex 3.3.0)

Custom code that uses strapi.db.connection and calls delete() with limit or having, or truncate() with where, having or limit, now throws on PostgreSQL and SQLite. MySQL now applies the LIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as [database] knex: ….

(#27982)

Token and role names are limited to 255 characters

The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.

(#28004) (#28002)

Node.js 22.19 or later is required

Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The engines field still says >=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.

(#27934)

limitInputPixels must be a number or a boolean

The upload plugin now applies sharp.limitInputPixels. Strapi refuses to start if the value is not true, false or an integer of 0 or more. A value read straight from an environment variable is a string, so use env.int().

(#27161)

Known issue: deleting an entry changes past releases

When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.

(#28023)

Known issue: editing webhook headers

In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example X-CX-D instead of X-D). Check the header names before you save.

(#27671)

❤️ Thank You

• Adrien L @Adzouz
• Alexandre Kohler @kwy404
• Andrei L @unrevised6419
• Arthur Moreau
• Ben Irvin
• Dex
• DMehaffy
• Giulio Montagner @giu1io
• HichamELBSI
• Michael @theluckystrike
• Minho Yoo
• Mohith Gajjela @Mohith26
• Nico André
• Obada Qawwas @onyxdevs
• Simon Norris
• Valentin @valfur03
• Yevhen Leontiev
• Younes Beriane
• ナム
• 陈志谦 @simpleqt

• Mobile: mail login form migrated to the new Vue.js UI.
• Mobile: added read/unread buttons.
• Removed the unnecessary confirmation dialog when deleting a message.
• Added Custom Mail Tags module.
• Long folder names are now truncated in the Files drawer.
• Added missing Contacts indexes, which fixes very slow performance.
• Verified compatibility with PHP 8.4 and 8.5.
• Extended the log entry format to include the user account, session hash
• Fixed cross-user arbitrary file access.
• Fixed the verify-security-key vulnerability.
• Fixed JS/CSS/HTML injection in calendar events.
• Mobile: fixed plain-text messages and linked images not being shown in emails.
• Messages are moved to Trash instead of being removed permanently.
• Fixed BCC with scheduled messages.
• Fixed fresh contacts missing from the suggestion list.
• Fixed the incorrect path when restoring a file from Trash.
• Fixed creating public links and deleting file shortcuts.
• Fixed removing the last instance of a recurring event.
• Fixed the number of repetitions of recurring tasks.
• Fixed using the calendar with an alias email address.
• Fixed logging in as superadmin and deleting a user via the admin panel.
• Fixed tenant admin access to users' data.
• Users are no longer deleted when their mail server is deleted.

Diep onder het ijs van Antarctica bevindt zich een gigantische detector die de meest ongrijpbare deeltjes van het heelal probeert te vangen: neutrino’s. De Belgische natuurkundige Francis Halzen kreeg er dit jaar de Nobelprijs voor Natuurkunde voor. Diederik en Krijn duiken in de werking van IceCube en bespreken ook de Nobelprijzen voor Scheikunde en Geneeskunde. […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Diederik Jekel en Krijn Soeteman bespreken de Nobelprijs voor natuurkunde 2026 voor Francis Halzen. Eerst kondigen zij een samenwerking met Met Nerds om Tafel en een livepodcast in Amsterdam aan. Daarna leggen zij uit waarom neutrino’s een nieuwe manier zijn om het heelal te bestuderen: ze zijn elektrisch neutraal en hebben slechts zelden wisselwerking met […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Hoe meet je een paar nanogram PFAS in een liter water? In deze aflevering beantwoorden Diederik en Krijn een luisteraarsvraag over de extreem kleine hoeveelheden die tegenwoordig in drinkwater kunnen worden aangetoond. https://scientias.nl/waar-is-alles-van-gemaakt-scientias-podcast-23/ https://podcastfestival.nl/festival/wetenschapspodcastfestival-2026/ Uitgelezen? Luister ook eens naar de Scientias Podcast: !

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

In deze aflevering praten Diederik en Krijn over PFAS in het Nederlandse drinkwater. Wat zijn PFAS precies, waarom gebruiken we ze op zoveel plaatsen en wanneer vormen ze een risico? (En waarom we er echt zo snel mogelijk mee moeten proberen te stoppen). Daarna beantwoorden ze een luisteraarsvraag: hoe werkt geur eigenlijk? Van Aristoteles en […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Wie krijgt het miljoen? En heeft AI nou wel of niet de Navier-Stokesvergelijking opgelost, een van de millenniumproblemen, opgesteld door het Clay Mathematichs Institute of Cambridge, Massachusetts (VS). Diederik legt uit aan Krijn hoe het nou eigenlijk zit met die vloeistofdynamica, een nogal pittige tak van de natuurkunde. Luister hier naar de 88ste aflevering van […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Krijn en Diederik vervolgen hun tweeluik over de Nancy Grace Roman Space Telescope met de vraag wat een panoramische ruimtetelescoop wetenschappelijk oplevert. Diederik legt uit waarom onze huidige methoden om exoplaneten te vinden een groot deel van alle planeten missen. Via gravitationele microlensing kan Roman juist planeten met wijde banen en zelfs losgeslagen planeten zonder moederster […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

Diederik en Krijn openen een tweeluik over NASA’s Nancy Grace Roman Space Telescope, die op 30 augustus 2026 met een Falcon Heavy is gelanceerd. Via naamgever Nancy Grace Roman en ruimtepionier Lyman Spitzer verschuift de aflevering naar de vraag waarom telescopen in de ruimte staan en hoe hun optiek door vier eeuwen probleemoplossing ontstond. Hans […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

In aflevering 85 lossen Diederik en Krijn het mysterie op van de Europese klokken die in 2018 zes minuten achterliepen. Daarna reconstrueren ze stap voor stap hoe oscillaties, oplopende spanning, verkeerd ingestelde beveiligingen en uitvallende productie-eenheden de stroomuitval in Spanje en Portugal veroorzaakten. Tot slot bespreken ze hoe grid-forming omvormers, batterijen, synchrone compensatoren en elektrische […]

Meer wetenschap? Lees de nieuwste artikelen op Scientias.nl .

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -d com.apple.quarantine /Applications/MarkText.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• chore(release): v0.22.0 by @Jocs in #5779
• chore: begin v0.23.0 development by @Jocs in #5780
• fix(release): explicitly select the previous stable version by @Jocs in #5781
• feat: #5695 ship Linux arm64 packages in releases by @kukirin-ui in #5778
• fix: unify inline and block code font families by @Jocs in #5783
• fix: #4997 give icon-only controls accessible names by @Pranav435 in #5739
• fix: #4997 theme icon tooltips and delay hover hints by @Jocs in #5788
• feat: foldable headings in the WYSIWYG editor (#1869) by @rkristelijn in #5276
• feat: #3743 add an independent responsive document outline by @Jocs in #5791
• feat: simplify sidebar navigation and search layout by @Jocs in #5792
• feat: add localized document statistics popover by @Jocs in #5794
• [1/5] fix(muya): validate asynchronous edit targets by @Jocs in #5799
• [2/5] feat(muya): add accessible code copy and clipboard feedback by @Jocs in #5800
• refactor(notification): use Element Plus Notification for global notices by @Jocs in #5798
• fix(menu): localize recent documents and polish theme labels by @Jocs in #5803
• fix(desktop): stabilize tab and sidebar dirty actions by @Jocs in #5804
• [3/5] feat(muya): add read-only document mode by @Jocs in #5801
• [4/5] feat: integrate per-tab document modes and protected saves by @Jocs in #5802
• [5/5] feat: expose per-tab Reading Mode controls and menu eligibility by @Jocs in #5793
• fix: #5784 declare ALSA and libgbm dependencies in Linux packages by @kukirin-ui in #5785
• fix: prevent duplicate sidebar trash confirmations by @Jocs in #5806
• fix: unify heading and code copy feedback by @Jocs in #5805
• refactor(muya): type mutation sources with ChangeSource by @Jocs in #5811
• refactor(muya): centralize read-only select-all in selection by @Jocs in #5813
• refactor(muya): reduce Markdown state and export complexity by @Jocs in #5815
• refactor(muya): rename read-only state getter to isReadOnly by @Jocs in #5812
• docs(muya): remove redundant implementation and test comments by @Jocs in #5814
• docs(desktop): remove redundant comments by @Jocs in #5816
• chore(desktop): remove unused bindings and lint directives by @Jocs in #5817
• refactor(desktop): remove redundant non-null assertions by @Jocs in #5818
• fix(desktop): refine document statistics popover by @Jocs in #5819
• feat(desktop): add preview tabs for sidebar files (#2395) by @Jocs in #5820
• feat(desktop): add --read-only CLI option by @Jocs in #5821

New Contributors

• @kukirin-ui made their first contribution in #5778
• @Pranav435 made their first contribution in #5739

Full Changelog: v0.22.0...v0.23.0

Ernst was in Barcelona en betaalde 73 euro per kind om een stadion in de steigers in en uit te lopen. Alexander verloor in Londen zijn rugzak met laptop in een taxi. Grokbot herkende een logootje in zijn bankapp en een uur later reed de chauffeur vanaf de andere kant van de stad terug.

En toen checkten we in bij de voorspelling van Sam Altman: het eerste eenpersoonsbedrijf van een miljard. Het aantal soloondernemers met meer dan een miljoen omzet verdubbelde en Rick Pastoor bouwt in zijn eentje een vervanger voor Google Workspace.

Verder: Alexander vindt rust in een Linux-laptop, Ernst heeft een titanium drinkbeker en we vragen ons af wanneer AI de dood van nu.nl wordt.

Deze aflevering wordt mede mogelijk gemaakt door itsme, de app die bewijst dat jij het bent. Download de app of ga naar itsme-id.com.

Co-existentie voorbestellen: Bestel Co-existentie van Ethan Mollick voor via pom.press en krijg de masterclass van Wietse over Claude Opus 5.5 cadeau. Bestel het hier via pom.press.

chore(function): remove exchange_github_app_token_with_pat route (#57…

release: v2.1.2

 The Chrome team is delighted to announce the promotion of Chrome 156 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.

Chrome 156.0.8078.47 (Linux) 156.0.8078.47/.48 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 156.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 353 security fixes. Please see the Chrome Security Page for more information.

[N/A][569165786] Critical CVE-2026-113341: Memory corruption in Skia. Reported by Google on 2026-10-03
[N/A][570093145] Critical CVE-2026-113279: Memory corruption in Accessibility. Reported by Xinyang Ge on 2026-10-05
[N/A][570638836] Critical CVE-2026-113072: Memory corruption in CSS. Reported by Xinyang Ge on 2026-10-06
[N/A][570740320] Critical CVE-2026-113280: Memory corruption in Paint. Reported by Xinyang Ge on 2026-10-06

[N/A][571618833] Critical CVE-2026-113271: Use after free in Accessibility. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-08

[N/A][574041825] Critical CVE-2026-113303: Memory corruption in WebRTC. Reported by OpenAI Codex Security (kylebot) on 2026-10-15

[$10,000][560749221] High CVE-2026-113101: Use after free in SiteIsolation. Reported by Quyen Son at VinFast (@zer0qs) on 2026-09-13

[$3,000][526039697] High CVE-2026-113097: Use after free in FileSystem. Reported by nh.dev2022 on 2026-06-21

[$2,000][548989584] High CVE-2026-113098: Memory corruption in CacheStorage. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-19

[$2,000][550626693] High CVE-2026-113242: Memory corruption in ANGLE. Reported by JonathanBouman on 2026-08-23

[$2,000][551059870] High CVE-2026-113058: Use after free in WebUI. Reported by OGINOME Tomohito on 2026-08-22

[$2,000][556505644] High CVE-2026-113082: Memory corruption in ANGLE. Reported by Zabith Mohammed on 2026-09-03

[$2,000][557075191] High CVE-2026-113119: Use after free in Network. Reported by JonathanBouman on 2026-09-04

[$2,000][558377544] High CVE-2026-113092: Use after free in Passwords. Reported by OGINOME Tomohito on 2026-09-07

[$2,000][560423758] High CVE-2026-113134: Memory corruption in ANGLE. Reported by Jinpyo Lee on 2026-09-12

[$2,000][572862424] High CVE-2026-113339: Use after free in SVG. Reported by Arni Hardarson (Neonix Security) on 2026-10-12

[$1,000][555337558] High CVE-2026-113317: Memory corruption in Accessibility. Reported by Findingz on 2026-08-31

[$1,000][559932543] High CVE-2026-113193: Memory corruption in V8. Reported by Nebula Security (@nebusecurity) on 2026-09-11

[$1,000][563788518] High CVE-2026-113117: Improper input validation in ANGLE. Reported by hamayanhamayan on 2026-09-19

[N/A][533122125] High CVE-2026-113188: Memory corruption in GPU. Reported by Google on 2026-07-09

[N/A][535749304] High CVE-2026-113104: Memory corruption in Frames. Reported by Google on 2026-07-17

[N/A][536639352] High CVE-2026-113322: Memory corruption in Dawn. Reported by Google on 2026-07-19

[N/A][548066294] High CVE-2026-113163: Use after free in WebGL. Reported by Google on 2026-08-17

[N/A][553117109] High CVE-2026-113253: Use after free in Canvas. Reported by Google on 2026-08-26

[N/A][553117374] High CVE-2026-113298: Use after free in Transactions Platform. Reported by Google on 2026-08-26

[N/A][553117511] High CVE-2026-113315: Memory corruption in ANGLE. Reported by Google on 2026-08-26

[N/A][553119084] High CVE-2026-113236: Use after free in Navigation. Reported by Google on 2026-08-26

[N/A][553121395] High CVE-2026-113284: Memory corruption in XML. Reported by Google on 2026-08-26

[N/A][553128833] High CVE-2026-113141: Use after free in Transactions Platform. Reported by Google on 2026-08-26

[N/A][553140050] High CVE-2026-113316: Improper input validation in Views. Reported by Google on 2026-08-26

[N/A][556750158] High CVE-2026-113234: Memory corruption in ANGLE. Reported by Google on 2026-09-03

[N/A][556750258] High CVE-2026-113252: Improper input validation in ANGLE. Reported by Google on 2026-09-03

[TBD][558464760] High CVE-2026-113305: Use after free in Privacy. Reported by Hafiizh on 2026-09-08

[N/A][559266116] High CVE-2026-113044: Use after free in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-10

[N/A][560251733] High CVE-2026-113135: Memory corruption in PictureInPicture. Reported by Xinyang Ge on 2026-09-11

[N/A][561499641] High CVE-2026-113266: Memory corruption in ANGLE. Reported by Google on 2026-09-14

[N/A][561999377] High CVE-2026-113273: Memory corruption in ANGLE. Reported by Google on 2026-09-15

[N/A][562040486] High CVE-2026-113293: Use after free in ANGLE. Reported by Google on 2026-09-15

[N/A][562109703] High CVE-2026-113225: Memory corruption in Browser. Reported by Google on 2026-09-15

[N/A][563354824] High CVE-2026-113210: Use after free in ANGLE. Reported by Google on 2026-09-18

[N/A][563355257] High CVE-2026-113285: Memory corruption in ANGLE. Reported by Google on 2026-09-18

[N/A][563357593] High CVE-2026-113324: Use after free in GPU. Reported by Google on 2026-09-18

[TBD][564064199] High CVE-2026-113334: Improper input validation in ANGLE. Reported by Jinpyo Lee on 2026-09-20

[N/A][565838017] High CVE-2026-113020: Improper input validation in Date. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-24

[TBD][566091009] High CVE-2026-113222: Use after free in V8. Reported by zenneth (randomguy6407) on 2026-09-25

[N/A][566136673] High CVE-2026-113318: Memory corruption in ServiceWorker. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-25

[TBD][566687517] High CVE-2026-113310: Out of bounds read in Bluetooth. Reported by James Burton on 2026-09-27

[N/A][567175125] High CVE-2026-113338: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb) on 2026-09-28

[N/A][567612004] High CVE-2026-113093: Memory corruption in DisplayLocking. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29

[TBD][568215670] High CVE-2026-113012: Improper input validation in GPU. Reported by Matthias Pleschinger (Popax21) on 2026-10-01

[TBD][568822820] High CVE-2026-113175: Improper input validation in FileSystem. Reported by huntersnot4 on 2026-10-02

[N/A][568831099] High CVE-2026-113192: Memory corruption in V8. Reported by Xinyang Ge on 2026-10-02

[N/A][568831768] High CVE-2026-113309: Out of bounds read in Media. Reported by Xinyang Ge on 2026-10-02

[N/A][568897206] High CVE-2026-113295: Out of bounds read in ANGLE. Reported by Google on 2026-10-02

[N/A][568900845] High CVE-2026-113217: Use after free in WebAppInstalls. Reported by Google on 2026-10-02

[TBD][568906040] High CVE-2026-113040: Improper input validation in Proxy. Reported by o on 2026-10-02

[TBD][568945639] High CVE-2026-113161: Use after free in WebRTC. Reported by C0rk1 on 2026-10-03

[N/A][569127861] High CVE-2026-113154: Memory corruption in Canvas. Reported by Xinyang Ge on 2026-10-05

[N/A][569286604] High CVE-2026-113336: Memory corruption in Compositing. Reported by Xinyang Ge on 2026-10-05

[N/A][569408568] High CVE-2026-113181: Use after free in Navigation. Reported by Xinyang Ge on 2026-10-05

[TBD][570003644] High CVE-2026-113019: Use after free in Turbolev. Reported by Project WhatForLunch (@nebusecurity) on 2026-10-05

[N/A][570167919] High CVE-2026-113095: Out of bounds read in Focus. Reported by Xinyang Ge on 2026-10-05

[TBD][570203091] High CVE-2026-113160: Use after free in Turbolev. Reported by Hoyong Jin on 2026-10-06

[N/A][572237007] High CVE-2026-113212: Memory corruption in PDF. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-10

[TBD][572598342] High CVE-2026-113000: Memory corruption in Paint. Reported by Arni Hardarson (Neonix Security) on 2026-10-12

[TBD][572695599] High CVE-2026-113179: Use after free in Paint. Reported by Arni Hardarson (Neonix Security) on 2026-10-12

[TBD][572893186] High CVE-2026-112993: Use after free in Input. Reported by Arni Hardarson (Neonix Security) on 2026-10-12

[$2,000][340578708] Medium CVE-2026-113055: Type confusion in FullScreen. Reported by Kirill Baev on 2024-05-15

[$2,000][40942045] Medium CVE-2026-113068: Use after free in Input. Reported by Hafiizh (https://www.linkedin.com/in/hafiizh-7aa6bb31/) on 2023-11-13

[$2,000][429432679] Medium CVE-2026-113320: Memory corruption in Navigation. Reported by @RenwaX23 on 2025-07-03

[$2,000][477664550] Medium CVE-2026-113231: Improper input validation in Extensions. Reported by Luan Herrera (@lbherrera_) on 2026-01-21

[$2,000][501419037] Medium CVE-2026-113174: Use after free in Extensions. Reported by foxribeye on 2026-04-10

[$1,000][494352583] Medium CVE-2026-113022: Memory corruption in PDFium. Reported by Jamos Zhu, Sebastian Dowell on 2026-03-19

[TBD][40055319] Medium CVE-2026-113079: Use after free in SiteIsolation. Reported by David Erceg on 2021-03-25

[N/A][441089142] Medium CVE-2026-113191: Use after free in Internals. Reported by Google on 2025-08-25

[TBD][490808751] Medium CVE-2026-113250: Use after free in ANGLE. Reported by mikey233 of HackerOne on 2026-03-08

[N/A][495471295] Medium CVE-2026-113109: Memory corruption in API. Reported by Google on 2026-03-23

[N/A][495899355] Medium CVE-2026-113113: Use after free in Extensions. Reported by Google on 2026-03-24

[N/A][496644575] Medium CVE-2026-113069: Memory corruption in Compositing. Reported by Google on 2026-03-26

[N/A][496650333] Medium CVE-2026-113006: Out of bounds read in Navigation. Reported by Google on 2026-03-26

[N/A][497026542] Medium CVE-2026-113263: Use after free in Core. Reported by Google on 2026-03-27

[N/A][497072295] Medium CVE-2026-113018: Memory corruption in IME. Reported by Google on 2026-03-28

[N/A][497299147] Medium CVE-2026-113301: Memory corruption in WebAppInstalls. Reported by Google on 2026-03-28

[N/A][497482008] Medium CVE-2026-113034: Memory corruption in FileSystem. Reported by Google on 2026-03-29

[N/A][497494634] Medium CVE-2026-113094: Memory corruption in API. Reported by Google on 2026-03-29

[N/A][497577345] Medium CVE-2026-113240: Use after free in Chromecast. Reported by Google on 2026-03-30

[N/A][497965748] Medium CVE-2026-113102: Out of bounds read in FileSystem. Reported by Google on 2026-03-31

[N/A][498733953] Medium CVE-2026-113142: Memory corruption in Extensions. Reported by Google on 2026-04-01

[N/A][498742883] Medium CVE-2026-113281: Memory corruption in SiteIsolation. Reported by Google on 2026-04-01

[N/A][498786597] Medium CVE-2026-113035: Out of bounds read in API. Reported by Google on 2026-04-02

[N/A][498828493] Medium CVE-2026-113211: Memory corruption in ServiceWorker. Reported by Google on 2026-04-02

[N/A][498843754] Medium CVE-2026-113011: Use after free in CredentialProvider. Reported by Google on 2026-04-02

[N/A][498861195] Medium CVE-2026-113198: Use after free in Extensions. Reported by Google on 2026-04-02

[N/A][498994634] Medium CVE-2026-113257: Memory corruption in Media. Reported by Google on 2026-04-02

[N/A][499112419] Medium CVE-2026-113070: Out of bounds read in GetUserMedia. Reported by Google on 2026-04-03

[N/A][499143720] Medium CVE-2026-113176: Memory corruption in Omnibox. Reported by Google on 2026-04-03

[N/A][499250086] Medium CVE-2026-113150: Memory corruption in Bindings. Reported by Google on 2026-04-03

[N/A][499365667] Medium CVE-2026-113311: Use after free in ServiceWorker. Reported by Google on 2026-04-03

[TBD][499520020] Medium CVE-2026-113078: Improper input validation in Compositing. Reported by Werner Kasselman on 2026-04-05

[N/A][499869964] Medium CVE-2026-113033: Use after free in Streaming. Reported by Google on 2026-04-06

[N/A][500173014] Medium CVE-2026-113026: Memory corruption in PDF. Reported by Google on 2026-04-07

[N/A][500491981] Medium CVE-2026-113302: Use after free in Extensions. Reported by Google on 2026-04-08

[N/A][500497398] Medium CVE-2026-113164: Memory corruption in Voice. Reported by Google on 2026-04-08

[N/A][500522368] Medium CVE-2026-113239: Range error in SiteIsolation. Reported by Google on 2026-04-08

[N/A][500536121] Medium CVE-2026-113131: Memory corruption in Bluetooth. Reported by Google on 2026-04-08

[N/A][501370810] Medium CVE-2026-113333: Memory corruption in Extensions. Reported by Google on 2026-04-10

[N/A][501531546] Medium CVE-2026-113147: Improper input validation in WebShare. Reported by Google on 2026-04-10

[N/A][501680084] Medium CVE-2026-113337: Memory corruption in Scroll. Reported by Google on 2026-04-11

[N/A][501730091] Medium CVE-2026-113127: Memory corruption in Browser. Reported by Google on 2026-04-11

[N/A][501738293] Medium CVE-2026-113129: Improper access control in Extensions. Reported by Google on 2026-04-11

[N/A][501786099] Medium CVE-2026-113264: Improper input validation in Extensions. Reported by Google on 2026-04-12

[N/A][501805751] Medium CVE-2026-113105: Use after free in Extensions. Reported by Google on 2026-04-12

[N/A][501875966] Medium CVE-2026-113220: Memory corruption in Extensions. Reported by Google on 2026-04-12

[N/A][502040109] Medium CVE-2026-113275: Use after free in API. Reported by Google on 2026-04-13

[N/A][502085234] Medium CVE-2026-113283: Memory corruption in CredentialProvider. Reported by Google on 2026-04-13

[N/A][502251640] Medium CVE-2026-113014: Use after free in PerformanceAPIs. Reported by Google on 2026-04-13

[N/A][502299325] Medium CVE-2026-113108: Use after free in Script. Reported by Google on 2026-04-13

[N/A][502376419] Medium CVE-2026-113343: Memory corruption in Sandbox. Reported by Google on 2026-04-14

[N/A][502689637] Medium CVE-2026-113319: Use after free in Accessibility. Reported by Google on 2026-04-14

[N/A][502710681] Medium CVE-2026-113057: Improper access control in ComputePressure. Reported by Google on 2026-04-15

[N/A][503583985] Medium CVE-2026-113219: Memory corruption in Contacts. Reported by Google on 2026-04-17

[N/A][503584859] Medium CVE-2026-113005: Memory corruption in Bluetooth. Reported by Google on 2026-04-17

[N/A][503774403] Medium CVE-2026-113209: Memory corruption in Navigation. Reported by Google on 2026-04-17

[N/A][504073211] Medium CVE-2026-113166: Memory corruption in History. Reported by Google on 2026-04-18

[N/A][504107363] Medium CVE-2026-113051: Memory corruption in CSS. Reported by Google on 2026-04-18

[N/A][504231046] Medium CVE-2026-113196: Improper access control in Mobile. Reported by Google on 2026-04-19

[TBD][505024593] Medium CVE-2026-113003: Memory corruption in HID. Reported by Florian Pradines on 2026-04-21

[N/A][505994167] Medium CVE-2026-113155: Use after free in Glic. Reported by Google on 2026-04-24

[N/A][506152584] Medium CVE-2026-113290: Use after free in Input. Reported by Google on 2026-04-24

[N/A][507227196] Medium CVE-2026-113183: Memory corruption in FedCM. Reported by Google on 2026-04-28

[N/A][511311494] Medium CVE-2026-113289: Improper input validation in PerformanceAPIs. Reported by Google on 2026-05-08

[N/A][511325076] Medium CVE-2026-113146: Memory corruption in PerformanceAPIs. Reported by Google on 2026-05-09

[N/A][511806651] Medium CVE-2026-113207: Use after free in SiteIsolation. Reported by Google on 2026-05-10

[N/A][511820971] Medium CVE-2026-113205: Use after free in Variations. Reported by Google on 2026-05-10

[N/A][513147880] Medium CVE-2026-113162: Improper input validation in Actor. Reported by Google on 2026-05-14

[N/A][513184498] Medium CVE-2026-113118: Memory corruption in Extensions. Reported by Google on 2026-05-14

[N/A][513226023] Medium CVE-2026-113232: Memory corruption in Search. Reported by Google on 2026-05-14

[N/A][513417142] Medium CVE-2026-113327: Use after free in Chromecast. Reported by Google on 2026-05-15

[N/A][513452101] Medium CVE-2026-112999: Use after free in API. Reported by Google on 2026-05-15

[N/A][513480110] Medium CVE-2026-113249: Improper input validation in Mobile. Reported by Google on 2026-05-15

[N/A][513486355] Medium CVE-2026-113272: Memory corruption in Extensions. Reported by Google on 2026-05-15

[N/A][513512147] Medium CVE-2026-113112: Use after free in Extensions. Reported by Google on 2026-05-15

[N/A][513521516] Medium CVE-2026-113321: Use after free in Extensions. Reported by Google on 2026-05-15

[N/A][513620385] Medium CVE-2026-113059: Memory corruption in Sensor. Reported by Google on 2026-05-15

[N/A][513758047] Medium CVE-2026-113137: Memory corruption in Extensions. Reported by Google on 2026-05-16

[N/A][513774784] Medium CVE-2026-113208: Use after free in ContextualSearch. Reported by Google on 2026-05-16

[N/A][513789297] Medium CVE-2026-113238: Memory corruption in CustomTabs. Reported by Google on 2026-05-16

[N/A][513989760] Medium CVE-2026-113194: Memory corruption in Core. Reported by Google on 2026-05-17

[N/A][514016335] Medium CVE-2026-113189: Use after free in Core. Reported by Google on 2026-05-17

[N/A][514017698] Medium CVE-2026-113060: Improper input validation in Bluetooth. Reported by Google on 2026-05-17

[N/A][514018015] Medium CVE-2026-113115: Use after free in Transactions Platform. Reported by Google on 2026-05-17

[N/A][514040146] Medium CVE-2026-113045: Out of bounds read in Offline. Reported by Google on 2026-05-17

[N/A][514066180] Medium CVE-2026-113307: Memory corruption in Extensions. Reported by Google on 2026-05-17

[N/A][514066540] Medium CVE-2026-113009: Use after free in WindowControlsOverlay. Reported by Google on 2026-05-17

[N/A][514079212] Medium CVE-2026-113071: Use after free in Notifications. Reported by Google on 2026-05-17

[N/A][514080341] Medium CVE-2026-113278: Use after free in Extensions. Reported by Google on 2026-05-17

[TBD][514372708] Medium CVE-2026-113190: Use after free in ServiceWorker. Reported by TheKng on 2026-05-18

[N/A][514422784] Medium CVE-2026-112992: Memory corruption in Canvas. Reported by Google on 2026-05-18

[N/A][514447367] Medium CVE-2026-112995: Use after free in Animation. Reported by Google on 2026-05-18

[N/A][515440087] Medium CVE-2026-113261: Use after free in WebAppInstalls. Reported by Google on 2026-05-21

[TBD][515451922] Medium CVE-2026-113172: Memory corruption in ServiceWorker. Reported by Bhavya on 2026-05-21

[N/A][517031871] Medium CVE-2026-113332: Memory corruption in GPU. Reported by Google on 2026-05-27

[N/A][517094892] Medium CVE-2026-113262: Use after free in Extensions. Reported by Google on 2026-05-27

[N/A][517221283] Medium CVE-2026-113149: Memory corruption in FullScreen. Reported by Google on 2026-05-27

[N/A][517407917] Medium CVE-2026-113206: Memory corruption in Omnibox. Reported by Google on 2026-05-28

[N/A][517461056] Medium CVE-2026-113185: Memory corruption in Extensions. Reported by Google on 2026-05-28

[N/A][517477395] Medium CVE-2026-113171: Memory corruption in Prompts. Reported by Google on 2026-05-28

[N/A][517486906] Medium CVE-2026-113042: Use after free in Extensions. Reported by Google on 2026-05-28

[N/A][517809727] Medium CVE-2026-113276: Memory corruption in Passwords. Reported by Google on 2026-05-29

[N/A][518003952] Medium CVE-2026-113218: Use after free in DataTransfer. Reported by Google on 2026-05-29

[N/A][518055043] Medium CVE-2026-113195: Improper input validation in Downloads. Reported by Google on 2026-05-30

[N/A][518055862] Medium CVE-2026-113328: Improper input validation in Privacy. Reported by Google on 2026-05-30

[N/A][518055882] Medium CVE-2026-113335: Memory corruption in Extensions. Reported by Google on 2026-05-30

[N/A][518065595] Medium CVE-2026-113255: Use after free in CustomTabs. Reported by Google on 2026-05-30

[N/A][518068748] Medium CVE-2026-113076: Use after free in Toolbar. Reported by Google on 2026-05-30

[N/A][518088604] Medium CVE-2026-113325: Memory corruption in SignIn. Reported by Google on 2026-05-30

[N/A][518099505] Medium CVE-2026-113084: Improper input validation in Permissions. Reported by Google on 2026-05-30

[N/A][518102808] Medium CVE-2026-113308: Use after free in Core. Reported by Google on 2026-05-30

[N/A][518108422] Medium CVE-2026-113224: Memory corruption in WebAppInstalls. Reported by Google on 2026-05-30

[N/A][518138781] Medium CVE-2026-113148: Memory corruption in WebUI. Reported by Google on 2026-05-30

[N/A][518240362] Medium CVE-2026-113010: Out of bounds read in Extensions. Reported by Google on 2026-05-30

[N/A][519217664] Medium CVE-2026-113073: Use after free in Browser. Reported by Google on 2026-06-02

[N/A][520017400] Medium CVE-2026-113265: Memory corruption in BFCache. Reported by Google on 2026-06-04

[N/A][520429499] Medium CVE-2026-113329: Out of bounds read in Installer. Reported by Google on 2026-06-05

[N/A][521978171] Medium CVE-2026-113043: Use after free in iOSWeb. Reported by Google on 2026-06-09

[N/A][523201686] Medium CVE-2026-113202: Use after free in BrowserTag. Reported by Google on 2026-06-12

[N/A][523237501] Medium CVE-2026-113016: Improper input validation in Extensions. Reported by Google on 2026-06-12

[N/A][523705767] Medium CVE-2026-113246: Memory corruption in iOSWebView. Reported by Google on 2026-06-13

[N/A][524319033] Medium CVE-2026-113041: Use after free in Actor. Reported by Google on 2026-06-15

[N/A][531182364] Medium CVE-2026-113126: Memory corruption in PolicyContainer. Reported by Google on 2026-07-04

[N/A][532939000] Medium CVE-2026-113031: Memory corruption in Media. Reported by Google on 2026-07-09

[N/A][534956586] Medium CVE-2026-113081: Use after free in Compositing. Reported by Google on 2026-07-15

[N/A][536607604] Medium CVE-2026-113139: Memory corruption in Autofill. Reported by Google on 2026-07-19

[N/A][537109293] Medium CVE-2026-113128: Missing authorization in Animation. Reported by Google on 2026-07-21

[N/A][537465180] Medium CVE-2026-113049: Memory corruption in Core. Reported by Google on 2026-07-21

[TBD][541604102] Medium CVE-2026-113032: Memory corruption in Omnibox. Reported by Anonymous on 2026-08-01

[TBD][544328873] Medium CVE-2026-113204: Use after free in TrustedWebActivities. Reported by jodyritonga on 2026-08-09

[TBD][544498565] Medium CVE-2026-113144: Memory corruption in Speech. Reported by Cassio Lima on 2026-08-10

[TBD][549529981] Medium CVE-2026-113054: Out of bounds read in SiteIsolation. Reported by a45hif on 2026-08-20

[TBD][551930637] Medium CVE-2026-113123: Use after free in GPU. Reported by TIENPA on 2026-08-24

[TBD][552951369] Medium CVE-2026-113277: Out of bounds read in CustomTabs. Reported by mute1008 on 2026-08-26

[N/A][553114456] Medium CVE-2026-113136: Memory corruption in DevTools. Reported by Google on 2026-08-26

[N/A][553126587] Medium CVE-2026-113106: Memory corruption in Skia. Reported by Google on 2026-08-26

[N/A][553144392] Medium CVE-2026-113001: Use after free in Workers. Reported by Google on 2026-08-26

[N/A][553146807] Medium CVE-2026-113064: Memory corruption in OptimizationGuide. Reported by Google on 2026-08-26

[N/A][553147798] Medium CVE-2026-113243: Memory corruption in DOM. Reported by Google on 2026-08-26

[N/A][553150372] Medium CVE-2026-113326: Memory corruption in Core. Reported by Google on 2026-08-26

[N/A][553150456] Medium CVE-2026-113124: Memory corruption in DataTransfer. Reported by Google on 2026-08-26

[N/A][553153823] Medium CVE-2026-113230: Improper input validation in Browser. Reported by Google on 2026-08-26

[N/A][553155133] Medium CVE-2026-113090: Memory corruption in Interstitials. Reported by Google on 2026-08-26

[N/A][553157579] Medium CVE-2026-113158: Use after free in Streaming. Reported by Google on 2026-08-26

[N/A][553159183] Medium CVE-2026-113077: Memory corruption in Core. Reported by Google on 2026-08-26

[N/A][553160293] Medium CVE-2026-113282: Use after free in Views. Reported by Google on 2026-08-26

[N/A][553163770] Medium CVE-2026-113165: Use after free in Core. Reported by Google on 2026-08-27

[N/A][553163820] Medium CVE-2026-113178: Memory corruption in Views. Reported by Google on 2026-08-27

[TBD][553390794] Medium CVE-2026-113110: Memory corruption in ShadowDOM. Reported by Zabith Mohammed on 2026-08-27

[TBD][553394270] Medium CVE-2026-113007: Memory corruption in Permissions. Reported by Anonymous on 2026-08-27

[TBD][553845833] Medium CVE-2026-113187: Use after free in DOM. Reported by Zabith Mohammed on 2026-08-28
[N/A][553931271] Medium CVE-2026-113075: Use after free in DevTools. Reported by Google on 2026-08-28
[TBD][554008013] Medium CVE-2026-113259: Use after free in Frames. Reported by Zabith Mohammed on 2026-08-28
[N/A][554556700] Medium CVE-2026-113228: Use after free in Network. Reported by Google on 2026-08-29
[N/A][556227230] Medium CVE-2026-113099: Improper input validation in Omnibox. Reported by Google on 2026-09-02
[N/A][556899544] Medium CVE-2026-113216: Use after free in Navigation. Reported by Google on 2026-09-04
[TBD][557501968] Medium CVE-2026-113270: Use after free in Internals. Reported by weihengqiuu on 2026-09-05
[TBD][558301759] Medium CVE-2026-113087: Use after free in Actor. Reported by Joshua Uphold on 2026-09-07
[TBD][559707641] Medium CVE-2026-113267: Memory corruption in Video. Reported by weihengqiuu on 2026-09-10
[N/A][559720179] Medium CVE-2026-113304: Memory corruption in GPU. Reported by Google on 2026-09-10
[TBD][559795243] Medium CVE-2026-113177: Use after free in FileSystem. Reported by Hoyong Jin on 2026-09-11
[N/A][560157609] Medium CVE-2026-113151: Out of bounds read in Actor. Reported by Google on 2026-09-11
[N/A][560373976] Medium CVE-2026-113028: Use after free in Media. Reported by Google on 2026-09-12
[N/A][560476932] Medium CVE-2026-113120: Improper input validation in Media. Reported by Google on 2026-09-12
[TBD][560664595] Medium CVE-2026-112997: Memory corruption in CSS. Reported by caveeroo on 2026-09-12
[TBD][560939312] Medium CVE-2026-113037: Use after free in WebSockets. Reported by HoneyBee on 2026-09-13
[TBD][561099700] Medium CVE-2026-113153: Memory corruption in SiteIsolation. Reported by Hoyong Jin on 2026-09-14
[TBD][561396577] Medium CVE-2026-113138: Memory corruption in WebAppInstalls. Reported by phamtien.ohr.s on 2026-09-14
[N/A][561660149] Medium CVE-2026-113030: Improper access control in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-15
[N/A][561787556] Medium CVE-2026-113100: Memory corruption in Audio. Reported by Google on 2026-09-15
[TBD][561921279] Medium CVE-2026-113221: Use after free in Google Lens. Reported by OGINOME Tomohito on 2026-09-15
[N/A][561926123] Medium CVE-2026-113344: Use after free in Performance. Reported by Google on 2026-09-15
[N/A][562024413] Medium CVE-2026-113342: Memory corruption in Network. Reported by Google on 2026-09-15
[N/A][562041808] Medium CVE-2026-113159: Improper access control in DevTools. Reported by Google on 2026-09-15
[N/A][562111801] Medium CVE-2026-113233: Out of bounds read in Core. Reported by Google on 2026-09-15
[N/A][562223549] Medium CVE-2026-113065: Use after free in Media. Reported by Google on 2026-09-16
[N/A][562225226] Medium CVE-2026-113002: Memory corruption in Transactions Platform. Reported by Google on 2026-09-16
[N/A][562226316] Medium CVE-2026-113199: Out of bounds read in Payments. Reported by Google on 2026-09-16
[N/A][562230410] Medium CVE-2026-113197: Use after free in Forms. Reported by Google on 2026-09-16
[N/A][562230438] Medium CVE-2026-113203: Use after free in CSS. Reported by Google on 2026-09-16
[N/A][562236428] Medium CVE-2026-113170: Use after free in Autofill. Reported by Google on 2026-09-16
[N/A][562236876] Medium CVE-2026-113258: Memory corruption in Chromoting. Reported by Google on 2026-09-16
[N/A][562237117] Medium CVE-2026-113297: Improper access control in Ozone. Reported by Google on 2026-09-16
[N/A][562237871] Medium CVE-2026-113062: Improper input validation in API. Reported by Google on 2026-09-16
[N/A][562238089] Medium CVE-2026-113096: Memory corruption in Text. Reported by Google on 2026-09-16
[N/A][562655586] Medium CVE-2026-113050: Out of bounds read in HID. Reported by Google on 2026-09-17
[N/A][563089510] Medium CVE-2026-113008: Memory corruption in Transactions Platform. Reported by Google on 2026-09-18
[TBD][563163857] Medium CVE-2026-113111: Use after free in Compositing. Reported by Shubham Raj, Causal Security - https://causalsecurity.com on 2026-09-18
[N/A][563350676] Medium CVE-2026-113200: Use after free in ANGLE. Reported by Google on 2026-09-18
[N/A][563352451] Medium CVE-2026-113143: Memory corruption in ANGLE. Reported by Google on 2026-09-18
[N/A][563352515] Medium CVE-2026-113157: Information leak in ANGLE. Reported by Google on 2026-09-18
[N/A][563352925] Medium CVE-2026-113235: Improper input validation in Passwords. Reported by Google on 2026-09-18
[N/A][563362367] Medium CVE-2026-113089: Improper input validation in PrintPreview. Reported by Google on 2026-09-18
[TBD][564213722] Medium CVE-2026-113340: Memory corruption in ANGLE. Reported by Jinpyo Lee on 2026-09-21
[TBD][564326756] Medium CVE-2026-113052: Memory corruption in V8. Reported by gundyman on 2026-09-21
[TBD][565349184] Medium CVE-2026-113133: Memory corruption in PlatformIntegration. Reported by Roshan Singh on 2026-09-23
[N/A][567673405] Medium CVE-2026-113086: Improper input validation in Input. Reported by Google on 2026-09-29
[$2,000][40056239] Low CVE-2026-113251: Use after free in PDF. Reported by kirtikumarar on 2021-06-16
[$2,000][40092886] Low CVE-2026-113215: Use after free in Extensions. Reported by David Erceg on 2018-10-29
[$1,000][40061291] Low CVE-2026-113053: Use after free in Cookies. Reported by Luan Herrera (@lbherrera_) on 2022-10-09
[$1,000][439873332] Low CVE-2026-113312: Memory corruption in Autofill. Reported by Manojkumar Jaganathan (https://www.linkedin.com/in/manojkumar-j-7ba35b202/) Aka TheWhiteEvil (https://hackerone.com/the-white-evil) with HackerBro Technologies on 2025-08-20
[$1,000][480153486] Low CVE-2026-113323: Use after free in Chrome for iOS. Reported by Qadhafy Muhammad Tera on 2026-01-30
[N/A][497087197] Low CVE-2026-113114: Use after free in SignIn. Reported by Google on 2026-03-28
[N/A][497408124] Low CVE-2026-113015: Use after free in Workers. Reported by Google on 2026-03-29
[N/A][497433155] Low CVE-2026-113091: Use after free in PerformanceAPIs. Reported by Google on 2026-03-29
[N/A][497593347] Low CVE-2026-113168: Use after free in Permissions. Reported by Google on 2026-03-30
[N/A][497827101] Low CVE-2026-113229: Use after free in Loader. Reported by Google on 2026-03-30
[N/A][498748871] Low CVE-2026-113256: Use after free in Permissions. Reported by Google on 2026-04-02
[N/A][500474551] Low CVE-2026-113103: Use after free in WebProtect. Reported by Google on 2026-04-07
[N/A][502288792] Low CVE-2026-113056: Memory corruption in PerformanceAPIs. Reported by Google on 2026-04-13
[N/A][503665813] Low CVE-2026-113201: Memory corruption in Google Lens. Reported by Google on 2026-04-17
[N/A][505807063] Low CVE-2026-113027: Memory corruption in WebFonts. Reported by Google on 2026-04-23
[N/A][506148052] Low CVE-2026-113214: Improper input validation in FullScreen. Reported by Google on 2026-04-24
[N/A][513394775] Low CVE-2026-113004: Memory corruption in Sync. Reported by Google on 2026-05-15
[N/A][513468106] Low CVE-2026-113300: Out of bounds write in Forms. Reported by Google on 2026-05-15
[N/A][513686739] Low CVE-2026-113213: Memory corruption in DevTools. Reported by Google on 2026-05-15
[N/A][513692667] Low CVE-2026-113167: Memory corruption in Network. Reported by Google on 2026-05-16
[N/A][513735940] Low CVE-2026-113223: Memory corruption in DevTools. Reported by Google on 2026-05-16
[N/A][514008724] Low CVE-2026-113291: Memory corruption in FullScreen. Reported by Google on 2026-05-17
[N/A][514078082] Low CVE-2026-113241: Memory corruption in Toolbar. Reported by Google on 2026-05-17
[N/A][514078112] Low CVE-2026-113244: Improper input validation in UI. Reported by Google on 2026-05-17
[N/A][514445657] Low CVE-2026-113048: Memory corruption in DevTools. Reported by Google on 2026-05-18
[N/A][514508203] Low CVE-2026-113247: Memory corruption in DevTools. Reported by Google on 2026-05-19
[N/A][517148875] Low CVE-2026-113023: Improper input validation in Extensions. Reported by Google on 2026-05-27
[N/A][517320634] Low CVE-2026-113330: Memory corruption in CustomTabs. Reported by Google on 2026-05-28
[N/A][523248913] Low CVE-2026-113226: Memory corruption in Model. Reported by Google on 2026-06-12
[N/A][523264945] Low CVE-2026-113152: Memory corruption in SignIn. Reported by Google on 2026-06-12
[N/A][523708661] Low CVE-2026-113029: Improper access control in ANGLE. Reported by Google on 2026-06-13
[N/A][524316342] Low CVE-2026-113296: Memory corruption in Actor. Reported by Google on 2026-06-15
[N/A][524695296] Low CVE-2026-113306: Improper input validation in Network. Reported by Google on 2026-06-16
[N/A][532985249] Low CVE-2026-113245: Memory corruption in DevTools. Reported by Google on 2026-07-09
[N/A][532987588] Low CVE-2026-113299: Memory corruption in WebProtect. Reported by Google on 2026-07-09
[N/A][533043403] Low CVE-2026-113024: Use after free in WebAppInstalls. Reported by Google on 2026-07-09
[N/A][533113044] Low CVE-2026-113025: Use after free in Input. Reported by Google on 2026-07-09
[N/A][533135911] Low CVE-2026-113080: Use after free in WebAppInstalls. Reported by Google on 2026-07-10
[N/A][533644359] Low CVE-2026-113186: Memory corruption in DevTools. Reported by Google on 2026-07-11
[N/A][535725111] Low CVE-2026-113180: Memory corruption in ContentCapture. Reported by Google on 2026-07-16
[N/A][536445815] Low CVE-2026-113140: Use after free in ANGLE. Reported by Google on 2026-07-19
[N/A][540068924] Low CVE-2026-113184: Memory corruption in Scheduling. Reported by Google on 2026-07-28
[N/A][553132165] Low CVE-2026-113017: Use after free in Views. Reported by Google on 2026-08-26
[N/A][553134101] Low CVE-2026-112998: Memory corruption in Views. Reported by Google on 2026-08-26
[N/A][553146562] Low CVE-2026-113021: Use after free in WebAppInstalls. Reported by Google on 2026-08-26
[N/A][553169805] Low CVE-2026-113145: Memory corruption in Messages. Reported by Google on 2026-08-27
[N/A][553248404] Low CVE-2026-113292: Improper input validation in Omnibox. Reported by Google on 2026-08-27
[N/A][553253820] Low CVE-2026-113156: Use after free in Messages. Reported by Google on 2026-08-27
[N/A][553259748] Low CVE-2026-113116: Use after free in DevTools. Reported by Google on 2026-08-27
[N/A][553267541] Low CVE-2026-113047: Memory corruption in BrowserTag. Reported by Google on 2026-08-27
[N/A][553274389] Low CVE-2026-113173: Improper input validation in UI. Reported by Google on 2026-08-27
[N/A][553326035] Low CVE-2026-113260: Memory corruption in Core. Reported by Google on 2026-08-27
[N/A][553334273] Low CVE-2026-113269: Memory corruption in BrowserTag. Reported by Google on 2026-08-27
[N/A][553335083] Low CVE-2026-113036: Memory corruption in HTML. Reported by Google on 2026-08-27
[N/A][553661952] Low CVE-2026-113268: Memory corruption in Navigation. Reported by Google on 2026-08-27
[N/A][553931056] Low CVE-2026-113038: Memory corruption in DevTools. Reported by Google on 2026-08-28
[N/A][554475322] Low CVE-2026-113313: Memory corruption in DevTools. Reported by Google on 2026-08-29
[N/A][554557866] Low CVE-2026-113061: Memory corruption in Chromoting. Reported by Google on 2026-08-29
[N/A][554560940] Low CVE-2026-113248: Memory corruption in FileSystem. Reported by Google on 2026-08-29
[N/A][556213889] Low CVE-2026-113288: Memory corruption in Core. Reported by Google on 2026-09-02
[N/A][559776316] Low CVE-2026-113085: Use after free in Media. Reported by Google on 2026-09-10
[N/A][559776445] Low CVE-2026-113107: Use after free in Media. Reported by Google on 2026-09-10
[N/A][562223550] Low CVE-2026-113066: Memory corruption in Fonts. Reported by Google on 2026-09-16
[N/A][562909956] Low CVE-2026-113121: Memory corruption in ContextMenu. Reported by Google on 2026-09-17
[N/A][562945664] Low CVE-2026-113287: Use after free in Prompts. Reported by Google on 2026-09-17
[N/A][562953023] Low CVE-2026-113132: Memory corruption in DevTools. Reported by Google on 2026-09-17
[N/A][562955271] Low CVE-2026-113169: Memory corruption in WebAppInstalls. Reported by Google on 2026-09-17
[N/A][562955705] Low CVE-2026-113254: Memory corruption in DevTools. Reported by Google on 2026-09-17
[N/A][562960821] Low CVE-2026-113063: Improper input validation in Chromoting. Reported by Google on 2026-09-17
[N/A][562962437] Low CVE-2026-112994: Memory corruption in Browser. Reported by Google on 2026-09-17
[N/A][562970433] Low CVE-2026-113314: Use after free in Media. Reported by Google on 2026-09-17
[N/A][562978160] Low CVE-2026-113237: Memory corruption in Chromoting. Reported by Google on 2026-09-17
[N/A][562993085] Low CVE-2026-113331: Memory corruption in Controls. Reported by Google on 2026-09-17
[N/A][562994234] Low CVE-2026-113182: Memory corruption in Passwords. Reported by Google on 2026-09-17
[N/A][562999635] Low CVE-2026-113046: Improper input validation in Passwords. Reported by Google on 2026-09-17
[N/A][562999766] Low CVE-2026-113067: Use after free in Chromoting. Reported by Google on 2026-09-17
[N/A][563003907] Low CVE-2026-113074: Use after free in Media. Reported by Google on 2026-09-17
[N/A][563004214] Low CVE-2026-113130: Use after free in Actor. Reported by Google on 2026-09-17
[N/A][563015337] Low CVE-2026-113294: Improper input validation in Loader. Reported by Google on 2026-09-17
[N/A][563015686] Low CVE-2026-112996: Memory corruption in Loader. Reported by Google on 2026-09-17
[N/A][563016452] Low CVE-2026-113122: Memory corruption in Loader. Reported by Google on 2026-09-17
[N/A][563021080] Low CVE-2026-113227: Use after free in Editing. Reported by Google on 2026-09-17
[N/A][563183231] Low CVE-2026-113286: Memory corruption in Google Lens. Reported by Google on 2026-09-18
[N/A][563337773] Low CVE-2026-113083: Memory corruption in Actor. Reported by Google on 2026-09-18
[N/A][563812927] Low CVE-2026-113088: Memory corruption in Mobile. Reported by Google on 2026-09-19
[N/A][563814519] Low CVE-2026-113013: Memory corruption in DevTools. Reported by Google on 2026-09-19
[N/A][563819290] Low CVE-2026-113125: Memory corruption in DevTools. Reported by Google on 2026-09-19
[TBD][566069559] Low CVE-2026-113039: Use after free in Bookmarks. Reported by NH DEV on 2026-09-25
[TBD][570715681] Low CVE-2026-113274: Use after free in ReadingMode. Reported by chipsec on 2026-10-06

Srinivas Sista

Google Chrome

OBS Studio 33.0.0 Release Candidate 3

Release Candidate 3 Changes

• Fixed browser sources not working when OBS Studio is run as admin on Windows 11 [WizardCM] (#553)

Release Candidate 2 Changes

• Fixed a crash in the browser migration code on Windows when the plugin path contained unicode characters [Warchamp7] (#552)
• Fixed incorrect paths in the virtual camera install scripts [Fenrir] (#14028)
• Hid the warning icon in the plugin manager for Legacy plugins [Warchamp7] (#14030)
• Fixed leftover Replay Buffer hotkey code that was causing errors when switching profiles [prgmitchell] (#14014)
• Fixed an issue where the browser local file handler could be invoked from a remote page served over an insecure context [Warchamp7] (#552)
• Developer Info: Fixed an issue where building libobs with core modules disabled would fail [PatTheMav] (#14035)

Release Candidate 1 Changes

• Fixed audio monitoring on browser sources briefly being enabled every time in Beta 1-6 [prgmitchell] (#14003)
• Fixed browser sources appearing blank on refresh in Beta 1-6 [WizardCM] (#14003)
• Fixed local network requests failing in browser sources in Beta 1-6 [WizardCM] (#14009)
• Fixed Plugin Manager showing third-party plugins as missing when OBS is launched in Safe Mode in Beta 1-6 [Warchamp7] (#14001)
• Fixed Plugin Manager removal button sometimes not removing missing plugins from the Plugin Manager in Beta 1-6 [Warchamp7] (#14008)
• Fixed the Missing Encoders popup not showing in taskbar [Warchamp7] (#14010)
• Fixed profile import failing on paths with a trailing slash [Ushkalovk] (#13863)
• Developer Info: Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
• Developer Info: Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)

Beta 6 Changes

• Fixed a crash during certain actions involving groups in Beta 1-5 [prgmitchell] (#13978)
• Fixed scripting not working on macOS in Beta 1-5 [PatTheMav] (#13976)
• Fixed game capture hooks not updating in Beta 1-5 [Warchamp7] (#13968)
• Fixed clock Lua script not working in Beta 1-5 [RytoEX] (#13974)
• Changed Safe Mode to not start WebSocket Server [FiniteSingularity/RytoEX] (#13984)
• Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
• Removed support for Qt 6.4-6.9 [RytoEX] (#13969)

Beta 5 Changes

• Fixed duplicate "Save Replay" hotkey entries when switching profiles in Beta 1-4 [xtfo] (#13943)
• Fixed warning dialogs on macOS not rendering rich text in Beta 1-4 [Warchamp7] (#13949)
• Fixed source icon state appearing inverted in Beta 1-4 [Warchamp7] (#13953)
• Fixed audio monitoring settings not saving in Beta 1-4 [Warchamp7] (#13951)
• Fixed missing encoder check showing missing encoders in an output mode that is not currently selected in Beta 1-4 [Warchamp7] (#13950)
• Fixed Windows updater not updating game capture and virtual camera in some cases in Beta 1-4 [Warchamp7] (#13939)

Beta 4 Changes

• Fixed a CI and packaging issue. There are no application changes since Beta 1.

Beta 3 Changes

• Fixed a CI issue. There are no application changes since Beta 1.

Beta 2 Changes

• Fixed a versioning issue. There are no application changes since Beta 1.

33.0 New Features

• Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
  • This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
  • All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
• Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
  • First-party plugins are now in a new folder named core
  • Third-party plugins have an updated installation location and folder structure
  • Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
  • More information is available in our knowledge base article
• Improved how source snapping works in the preview [Warchamp7] (#12298)
  • New visual indicator added
  • Sources now snap along the entire axis instead of only when directly touching
  • Sources no longer snap to hidden sources
• Improved behavior of spinboxes for number values [Warchamp7] (#12337)
  • Typing is no longer mysteriously blocked in some situations
  • Numbers are no longer cut off in some situations
  • Values now update only after pressing Enter and Enter does not close the window
  • Holding Shift + Up/Down now advances multiple steps at a time
  • Dragging the cursor inside the input but outside the text itself now works properly
• Enabled NVENC on Arm64 [RytoEX] (#13827)

33.0 Changes

• Added a check for encoders being missing when loading a profile [derrod] (#11340)
• Added support for newest NVIDIA Broadcast SDKs for NVIDIA Audio Effects and Video Effects [pkviet] (#13838)
• Added hotkeys for controlling audio monitoring of a source [Warchamp7] (#13599)
• Fixed issues with groups in Studio Mode [Warchamp7] (#11092)
  • Fixed moving sources inside a group causing them to glitch out in Program
  • Fixed moving sources inside a group showing up live in Program
• Adjusted naming of Window Capture methods on Windows [Penwy] (#12047)
• Improved detection of fullscreen games for Game Capture [Kira-NT] (#10880)
• Improved transparency handling for macOS Screen Capture [jcm93] (#13030)
• Scaled simple output recording audio bitrate by channel count [nickvonkaenel] (#13311)
• Removed support for Ubuntu 24.04

33.0 Bug Fixes

• Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
• Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
• Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
• Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
• Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
• Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
• Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
• Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
• Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
• Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
• Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
• Fixed a source toolbar crash when source type is missing [Penwy] (#13539)

33.0 Developer Information

• Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
• Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
• Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
• Added obs_frontend_is_safe_mode for first-party plugins
  • Third-party plugins are not loaded at all in Safe Mode
• Added versions to Flatpak plugin extension point [tytan652] (#13735)
• Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
• The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
  • Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
  • Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
• Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
• Updated libnsgif to 1.0.0 [RytoEX] (#11178)
  • This is a breaking change for any plugins using libobs/graphics gs_image_file
• Clarified documentation for obs_module_unload [notr1ch] (#13327)
• Required MbedTLS 3 and exclude 4 or later [tytan652] (#13799)
• Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
• Removed support for Qt 6.4-6.9 [RytoEX] (#13969)
• Fixed repeated preview enable/disables not working [WarmUpTill] (#12580)
• Only emit core signal handlers for public canvases [tt2468] (#13574)
• Deprecated unused hidden API for sources [derrod] (#13122)
• Deprecated APIs for audio source monitoring_type [Warchamp7] (#13599)
  • This is replaced by a new monitoring_enabled boolean

Checksums

OBS-Studio-33.0.0-rc3-Sources.tar.gz: 766bb443f7e3f265a702992d1108d699e3f5509be633eacc518262e41e7d1d2d
OBS-Studio-33.0.0-rc3-Ubuntu-26.04-x86_64-dbsym.ddeb: 25d791ca5563779f2a2c9a6ac7710eb61ef009571249176b846d30940ca8e1aa
OBS-Studio-33.0.0-rc3-Ubuntu-26.04-x86_64.deb: ac939c81a5f960f7edb252520549d00b279cfbeccaae2bb4b8c87dc5f568ebe1
OBS-Studio-33.0.0-rc3-Windows-arm64-PDBs.zip: dff75284092b3bdc9929049baa6649c539a4e02b6c29b793da9e55e8e3c13ece
OBS-Studio-33.0.0-rc3-Windows-arm64.zip: 1d0347968388ad7f187701bfa13e3748211e575bd4332bc4951d8e16e456ad57
OBS-Studio-33.0.0-rc3-Windows-x64-Installer.exe: f43ed5f1e08d8b31a34fe68577a088331aebbfa5f01634c3948a2ebec5df5202
OBS-Studio-33.0.0-rc3-Windows-x64-PDBs.zip: f1b408547de973a232a565877c96b157542f3e5cf909a128bbcdc90de551aa8d
OBS-Studio-33.0.0-rc3-Windows-x64.zip: 92db35465aec0f70ab11d033674be724603780620603f87a7c56e95ed990aa28
OBS-Studio-33.0.0-rc3-macOS-Apple-dSYMs.tar.xz: 233b358dae3006dba1079795afa101c512ebb532b850e8bfda91d5ef3b682af1
OBS-Studio-33.0.0-rc3-macOS-Apple.dmg: ead594ec544503aeb42df5033266c3a9d3de5bd07335449dd751a6681b4571e6
OBS-Studio-33.0.0-rc3-macOS-Intel-dSYMs.tar.xz: 93bdfa7d2fcfdaae26c5cad02defdf4c5001282fcc09c4acf7e714846b59b799
OBS-Studio-33.0.0-rc3-macOS-Intel.dmg: a4b38098ae9c370d4536a9d4dc5ed459ac9b9cf55cf1865951ae3d9e977c9f12

Docker Images

Docker images have been built and pushed:

Docker Hub:

• alexta69/metube:latest
• alexta69/metube:2026.10.20

GitHub Container Registry:

• ghcr.io/alexta69/metube:latest
• ghcr.io/alexta69/metube:2026.10.20

Changes

• build: upgrade Python and frontend dependencies (f651a95)
• build: drop the duplicate deno.land install; yt-dlp[deno] already ships it (6a2810a)
• Address review: build connect payload on the loop, drop import batching (5be4c2a)
• Fix socket.io connect ACK delayed by get_custom_dirs() (b35fbb7)
• Fix socket.io connect handler blocking the event loop (680ed6d)

Fixed

• Mozilla blocked compromised eMudhra intermediate certificates via OneCRL on October 17th. The blocks were distributed to clients via Remote Settings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. (Learn More)

• Fixed an issue where pages would unexpectedly scroll back to the top when selecting text. (Bug 2081016)

• Fixed a crash on Windows when printing or saving a page as PDF while a screen reader or other assistive technology was running. (Bug 2082376)

• Fixed an issue where Firefox was opening windows on the wrong monitor in multi-monitor setups on Linux. (Bug 2076558)

• Fixed an issue that could prevent the built-in VPN from turning on for some users. (Bug 2055094)

• Fixed an issue where files dragged into Firefox from other applications were not dropped onto the page on macOS. (Bug 2078954)

• Various security fixes.

release: v2.1.1

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

• Fixed OpenCode models failing to load with a missing field npm error. (#65875)

• Fixed OpenCode models failing to load with a missing field npm error. (#65874)
• Added HTML syntax highlighting for svg, mathml and raw tagged templates, and CSS syntax highlighting for template literals in css({ ... }) objects, in JavaScript and TypeScript (#65688)
• Fixed window controls being misaligned in the threads sidebar header when no project is open. (#65651)

What's Changed

• feat(device): hold Back or Forward to scroll sideways with the main wheel (0x1b04 raw wheel) by @AprilNEA in #1828
• test(gui): draw dialogs at rest before clicking their buttons by @AprilNEA in #1832
• feat(desktop): offer hold-to-scroll-sideways for Back and Forward by @AprilNEA in #1835
• feat(device): smooth a mouse's main wheel by diverting it (0x2121) by @AprilNEA in #1837
• feat(desktop): add a per-device smooth wheel switch to the Scrolling card by @AprilNEA in #1839
• feat(device): reach Litra lights over HID++ 0x1990 with read-back by @AprilNEA in #1841
• fix(gui): show the Actions Ring tab for keyboards with a Keys panel by @4ni1ak in #1844
• fix(gui): retain observed connection icons for offline devices by @i0ntempest in #1830
• fix(cli): drop a paired device with no identity from fixture capture by @4ni1ak in #1861
• fix(gui): recognize the MX Ergo precision-mode button slot by @4ni1ak in #1855
• fix(agent): log thumb-wheel continuous-scroll dispatch by @4ni1ak in #1852
• fix(i18n): translate the hold-modifiers and tap-key actions in Czech by @Imbecile6197 in #1850
• feat(gui): add a Next / Previous Desktop thumb-wheel preset by @Rothschildiuk in #1848
• fix(agent): write a light only when a reload changes its settings by @AprilNEA in #1865
• feat(agent): keep a change made on a Litra as its setting and publish it by @AprilNEA in #1866
• feat(gui): add device default option for keyboard bindings by @clifinger in #702
• fix(linux): report input access as denied when the event node is unreadable by @AalmanSadath in #787
• fix(gui): embed the Sleep action's moon glyph by @AalmanSadath in #790
• feat(gui): add a Reset to defaults button to the F-key binding panel by @4ni1ak in #1255
• fix(gui): enlarge About panel logo by @4ni1ak in #1364
• fix(hid): open HID++ channels concurrently, not one node at a time by @4ni1ak in #1443
• feat(gui): add Power User actions to the Action Ring editor by @4ni1ak in #1445
• fix(inject): give the Windows Screenshot action its own Win+PrtScn chord by @AprilNEA in #1867
• fix(linux): keep "pen" out of the uinput device names by @AprilNEA in #1868
• fix(linux): grab a mouse again after it reconnects or appears late by @AprilNEA in #1869
• feat(desktop): save a change made on a Litra as its setting by @AprilNEA in #1870
• fix(hook): fall back to a recent device attribution on macOS by @andybateman in #805
• fix(hid): suppress duplicate Bolt pairing slots by @xcouturecc in #963
• fix(gui): allow clearing function-key bindings by @xcouturecc in #962
• feat(gui): show the receiver slot on each device card by @garysassano in #1802
• fix(gui): fold leftover receiver pairings into one device card by @garysassano in #1801
• fix(hid): capture the M720 Triathlon's multiplatform gesture button by @kurtlieber in #1613
• fix(i18n): route hardcoded GUI labels through the catalog by @eibidia in #1331
• fix(macos): preserve fractional wheel distance by @li-shch in #1154
• feat(linux): route window-manager native actions through KWin D-Bus on KDE by @werwolf2303 in #1087
• feat(linux): support Hyprland native remaps by @shawnyeager in #1152
• fix(agent): include MiddleClick in the macOS HID++ gesture ownership by @tims2002 in #1380
• test(inject): cover the macOS Lock Screen chord by @AprilNEA in #1885
• feat(overlay): show keyboard backlight level by @nathan-fontenele in #1695
• ci(macos): lint the macOS cfg with clippy by @AprilNEA in #1883
• chore: drop stale lint suppressions and reject module-wide #![allow] by @AprilNEA in #1884
• feat(core,gui): allow middle click gesture mode by @PedroDiogo in #1738
• feat(hidpp): add scrolling force control for smartshift enhanced mice by @pedrohgmacedo in #1636
• fix(core,agent): chain swipes within one gesture-button hold by @sarat03 in #1652
• feat(linux): ship a Flatpak bundle with each release by @AalmanSadath in #767
• ci: sweep stale #[allow] on Linux, Windows, and macOS weekly by @AprilNEA in #1887
• feat(overlay): show a notice when a device's battery runs low by @AprilNEA in #1891
• feat(overlay): show an indicator when a keyboard turns a lock key on or off by @AprilNEA in #1898
• fix(device): drop a lock-state read that answers after a reconnection by @AprilNEA in #1899
• fix(overlay): draw one Actions Ring per display on Wayland by @AprilNEA in #1906
• feat(core,gui): share per-app profiles across platforms with [apps] aliases by @AprilNEA in #1907
• chore: release v0.8.15 by @AprilNEA[bot] in #1831

New Contributors

• @i0ntempest made their first contribution in #1830
• @Rothschildiuk made their first contribution in #1848
• @andybateman made their first contribution in #805
• @xcouturecc made their first contribution in #963
• @garysassano made their first contribution in #1802
• @kurtlieber made their first contribution in #1613
• @li-shch made their first contribution in #1154
• @werwolf2303 made their first contribution in #1087
• @shawnyeager made their first contribution in #1152
• @tims2002 made their first contribution in #1380
• @PedroDiogo made their first contribution in #1738
• @pedrohgmacedo made their first contribution in #1636
• @sarat03 made their first contribution in #1652

Full Changelog: v0.8.14...v0.8.15