30.0.2
Releases Notes for 30.0.2
Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
- Uses electron 42.1.0
- Updates to draw.io core 30.0.2.
Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 79 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.
[$43000][493310462] Critical CVE-2026-8509: Heap buffer overflow in WebML. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-17
[$25000][502636904] Critical CVE-2026-8510: Integer overflow in Skia. Reported by q@calif.io on 2026-04-14
[N/A][495108488] Critical CVE-2026-8511: Use after free in UI. Reported by Google on 2026-03-22
[N/A][495782021] Critical CVE-2026-8512: Use after free in FileSystem. Reported by Google on 2026-03-24
[N/A][495939973] Critical CVE-2026-8513: Use after free in Input. Reported by Google on 2026-03-25
[N/A][495948109] Critical CVE-2026-8514: Use after free in Aura. Reported by Google on 2026-03-25
[N/A][495999127] Critical CVE-2026-8515: Use after free in HID. Reported by Google on 2026-03-25
[N/A][496393078] Critical CVE-2026-8516: Insufficient validation of untrusted input in DataTransfer. Reported by Google on 2026-03-26
[N/A][497531263] Critical CVE-2026-8517: Object lifecycle issue in WebShare. Reported by Google on 2026-03-29
[N/A][497830330] Critical CVE-2026-8518: Use after free in Blink. Reported by Google on 2026-03-30
[N/A][498400132] Critical CVE-2026-8519: Integer overflow in ANGLE. Reported by Google on 2026-04-01
[N/A][503619813] Critical CVE-2026-8520: Race in Payments. Reported by Google on 2026-04-17
[N/A][504106200] Critical CVE-2026-8521: Use after free in Tab Groups. Reported by Google on 2026-04-18
[N/A][504185107] Critical CVE-2026-8522: Use after free in Downloads. Reported by Google on 2026-04-19
[$25000][483956252] High CVE-2026-8523: Use after free in Mojo. Reported by Paul Seekamp / nullenc0de on 2026-02-12
[$10000][503425922] High CVE-2026-8558: Out of bounds write in Fonts. Reported by Matej Smycka on 2026-04-16
[$7000][499565267] High CVE-2026-8524: Out of bounds write in WebAudio. Reported by Brendan Dolan-Gavitt, XBOW on 2026-04-06
[$2000][497928952] High CVE-2026-8525: Heap buffer overflow in ANGLE. Reported by Nathaniel Oh (@calysteon) on 2026-03-30
[TBD][486536241] High CVE-2026-8526: Out of bounds write in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22
[TBD][486761172] High CVE-2026-8527: Insufficient validation of untrusted input in Downloads. Reported by rachmat.abdul.ro on 2026-02-23
[N/A][490222151] High CVE-2026-8529: Heap buffer overflow in Codecs. Reported by Google on 2026-03-06
[N/A][491930142] High CVE-2026-8530: Use after free in Network. Reported by Google on 2026-03-11
[TBD][492350403] High CVE-2026-8531: Heap buffer overflow in WebML. Reported by Syn4pse on 2026-03-13
[N/A][492812194] High CVE-2026-8532: Integer overflow in XML. Reported by Google on 2026-03-14
[N/A][495247950] High CVE-2026-8533: Use after free in Accessibility. Reported by Google on 2026-03-23
[N/A][495314407] High CVE-2026-8534: Integer overflow in GPU. Reported by Google on 2026-03-23
[N/A][495530312] High CVE-2026-8535: Out of bounds read in Media. Reported by Google on 2026-03-23
[N/A][495857582] High CVE-2026-8536: Insufficient validation of untrusted input in ReadingMode. Reported by Google on 2026-03-24
[N/A][495890000] High CVE-2026-8537: Insufficient policy enforcement in ViewTransitions. Reported by Google on 2026-03-24
[N/A][496415073] High CVE-2026-8538: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-03-26
[TBD][496524586] High CVE-2026-8539: Script injection in SanitizerAPI. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po) on 2026-03-26
[TBD][496627235] High CVE-2026-8540: Type Confusion in V8. Reported by Google on 2026-03-26
[N/A][496645393] High CVE-2026-8541: Out of bounds read in UI. Reported by Google on 2026-03-26
[N/A][497066659] High CVE-2026-8542: Use after free in Core. Reported by Google on 2026-03-28
[N/A][497095799] High CVE-2026-8543: Out of bounds read in FileSystem. Reported by Google on 2026-03-28
[N/A][497151750] High CVE-2026-8544: Use after free in Media. Reported by Google on 2026-03-28
[N/A][497486030] High CVE-2026-8545: Object corruption in Compositing. Reported by Google on 2026-03-29
[N/A][497531791] High CVE-2026-8546: Out of bounds read in GPU. Reported by Google on 2026-03-29
[N/A][497632199] High CVE-2026-8547: Insufficient policy enforcement in Passwords. Reported by Google on 2026-03-30
[N/A][497821764] High CVE-2026-8548: Out of bounds write in Media. Reported by Google on 2026-03-30
[N/A][497985088] High CVE-2026-8549: Use after free in Media. Reported by Google on 2026-03-31
[N/A][498322453] High CVE-2026-8550: Use after free in Google Lens. Reported by Google on 2026-03-31
[N/A][498376171] High CVE-2026-8551: Use after free in Downloads. Reported by Google on 2026-04-01
[N/A][498706958] High CVE-2026-8552: Heap buffer overflow in GPU. Reported by Google on 2026-04-01
[N/A][498715368] High CVE-2026-8553: Use after free in GPU. Reported by Google on 2026-04-01
[N/A][499131214] High CVE-2026-8554: Type Confusion in ANGLE. Reported by Google on 2026-04-03
[N/A][500033878] High CVE-2026-8555: Use after free in GTK. Reported by Google on 2026-04-06
[N/A][500052361] High CVE-2026-8556: Inappropriate implementation in ANGLE. Reported by Google on 2026-04-06
[N/A][502978647] High CVE-2026-8557: Use after free in Accessibility. Reported by Google on 2026-04-15
[N/A][504629701] High CVE-2026-8559: Integer overflow in Internationalization. Reported by Google on 2026-04-20
[N/A][487795397] Medium CVE-2026-8528: Insufficient validation of untrusted input in SiteIsolation. Reported by Google on 2026-02-26
[TBD][328109821] Medium CVE-2026-8560: Heap buffer overflow in SwiftShader. Reported by Cassidy Kim(@cassidy6564) on 2024-03-05
[TBD][343352552] Medium CVE-2026-8561: Incorrect security UI in Fullscreen. Reported by Wolfgang Ettlinger (aff. Certitude Consulting GmbH)
Alexander Hurbean (aff. Certitude Consulting GmbH) on 2024-05-29
[N/A][40057534] Medium CVE-2026-8562: Side-channel information leakage in Navigation. Reported by Google on 2021-10-06
[TBD][40061220] Medium CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox. Reported by Luan Herrera (@lbherrera_) on 2022-10-04
[TBD][418273622] Medium CVE-2026-8564: Incorrect security UI in Downloads. Reported by Alesandro Ortiz https://AlesandroOrtiz.com on 2025-05-16
[TBD][442860473] Medium CVE-2026-8565: Inappropriate implementation in Downloads. Reported by Farras Givari on 2025-09-04
[TBD][470646792] Medium CVE-2026-8566: Insufficient policy enforcement in Payments. Reported by Jorian Woltjer on 2025-12-21
[TBD][484986863] Medium CVE-2026-8567: Integer overflow in ANGLE. Reported by cinzinga on 2026-02-16
[TBD][488728570] Medium CVE-2026-8568: Insufficient policy enforcement in AI. Reported by Tianyi Hu on 2026-03-01
[N/A][490229299] Medium CVE-2026-8569: Out of bounds write in Codecs. Reported by Google on 2026-03-06
[N/A][490353576] Medium CVE-2026-8570: Type Confusion in V8. Reported by Google on 2026-03-06
[TBD][491422244] Medium CVE-2026-8571: Insufficient policy enforcement in GPU. Reported by Mark Blaszczyk on 2026-03-10
[N/A][495405493] Medium CVE-2026-8572: Insufficient policy enforcement in Network. Reported by Google on 2026-03-23
[N/A][495417883] Medium CVE-2026-8573: Integer overflow in Codecs. Reported by Google on 2026-03-23
[N/A][495902113] Medium CVE-2026-8574: Use after free in Core. Reported by Google on 2026-03-24
[N/A][496217775] Medium CVE-2026-8575: Use after free in UI. Reported by Google on 2026-03-25
[N/A][496231853] Medium CVE-2026-8576: Inappropriate implementation in CORS. Reported by Google on 2026-03-25
[N/A][496302307] Medium CVE-2026-8577: Integer overflow in Fonts. Reported by Google on 2026-03-25
[N/A][496395450] Medium CVE-2026-8578: Out of bounds read in GPU. Reported by Google on 2026-03-26
[N/A][496526419] Medium CVE-2026-8579: Insufficient validation of untrusted input in Skia. Reported by Google on 2026-03-26
[N/A][496639647] Medium CVE-2026-8580: Use after free in Mojo. Reported by Google on 2026-03-26
[N/A][497292072] Medium CVE-2026-8581: Use after free in GPU. Reported by Google on 2026-03-28
[N/A][497594413] Medium CVE-2026-8582: Object lifecycle issue in Dawn. Reported by Google on 2026-03-30
[N/A][497975477] Medium CVE-2026-8583: Insufficient policy enforcement in WebXR. Reported by Google on 2026-03-31
[N/A][498892595] Medium CVE-2026-8584: Inappropriate implementation in Views. Reported by Google on 2026-04-02
[N/A][499052720] Medium CVE-2026-8585: Inappropriate implementation in Media. Reported by Google on 2026-04-02
[N/A][499154022] Medium CVE-2026-8586: Inappropriate implementation in Chromoting. Reported by Google on 2026-04-03
[TBD][507356235] Medium CVE-2026-8587: Use after free in Extensions. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2026-04-28
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out howΒ here. If you find a new issue, please let us know byΒ filing a bug. TheΒ community help forumΒ is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
β
Welcome to the first alpha for the 5.2 update! This new version is focused on performance, quality-of-life, and infrastructure improvements which prepare for the big 6.0 version that will be coming later. The two biggest changes are the new FileType plugin system and the rewritten high-precision layer rendering engine.
New FileType Plugin System
The original FileType plugin system dates back to 2005 with the v2.5 release. It has withstood the test of time in the sense that it still works and has provided a lot of value for a lot of people, but it has also noticeably aged poorly in ways that have prevented progress in other areas of the app. It was written at a time when .NET itself was just 3 years old and hitting its 2.0 release with generics and 64-bit support. The modern systems used in Paint.NET for component management and isolation were nowhere to be found back then. I had no clue that the projectβs longevity would stretch so far into the future, nor that so many plugins would be developed!
The old FileType plugin system is tightly coupled with the Document, Layer, and Surface classes which Paint.NET also uses internally for UI and rendering purposes. They only support the 32-bit BGRA UI8 pixel format and a flat list of bitmap layers. The new FileType system works through interfaces such as IFileTypeDocument<TPixel> and ILayer<TPixel>, along with a rich and strongly-typed imaging framework providing support for a wide variety of pixel formats, pooled bitmap allocation, scaling/interpolation, quantization/dithering, format conversion, color management, and more.
Decoupling the FileType system from the internal classes means that these two systems can now evolve independently, and internal details can be abstracted away from plugins. The new plugin system has been designed to support versioning, meaning that functionality can be added or changed in the programming interfaces that are provided to plugins while maintaining compatibility for plugins that have already been published. New layer types and topologies (e.g. layer folders) can be added without breaking existing plugins, new blend modes can be introduced, and bitmap layers will finally be able to migrate to a tiled storage system.
Note to plugin authors: In general, plugins should provide pixel data in the image fileβs original format without converting it to BGRA32. In other words, let Paint.NET handle the conversion, whether youβre supplying pixels as RGBA64, BGR24, or even an HDR format such as RGBA FP32. Paint.NET will figure out the best conversion for pixel format and color profile handling, and when expanded pixel format support is rolled out your plugin can automatically benefit from it. Note that plugins can also determine at runtime which pixel formats are supported and which are native, in case they do want to do the conversion themselves for whatever reason.
New Layer Rendering Engine
The old layer rendering engine has its roots going all the way back to the 1.0 release in 2004. Over the years it has migrated from C# to C for performance reasons, and then back to C# once the language and JIT had finally caught up to the performance of the native code. However, it has no SIMD optimizations, it only has 8 bits per channel of precision (βUI8β), and the code was very messy and difficult to make changes to. Working with many layers can result in incorrect colors or banding artifacts as off-by-1 errors accumulate across multiple layers.Β
With 5.2, this has been completely rewritten and upgraded to use 32-bits of floating-point precision per channel (βFP32β). It is fully optimized for AVX2, AVX512, and even ARM64 NEON thanks to .NETβs new platform-agnostic intrinsics support. Because FP32 uses a lot more memory bandwidth than UI8, many tricks have been employed to cut down on that to the point that there is no perceptible performance reduction from previous versions (the old renderer not using any SIMD also helps this comparison). The bottleneck is compute, not memory bandwidth, and performance really shines on CPUs with AVX512 support even with standard dual channel memory.
A driving factor behind this change was to prepare for future versions of Paint.NET that will expand pixel format support beyond BGRA UI8. In order to do this in a sane and maintainable manner, having a canonical pixel format became important so that each rendering kernel only needs to be written once. All of the rendering kernels can now operate exclusively on FP32 data, with high-performance format conversion and color transform kernels at the beginning and end of the rendering pipeline. This will make it much easier to add support for RGBA UI16, RGBA FP16, and even RGBA FP32 β the layer rendering engine already supports it, the rest of the app just has to catch up.
Whatβs coming in 6.0?
This update will introduce a new .PDN file format that will finally enable the ability to add new features to the document and layering systems. High bit-depth pixel formats, new blend modes, and layer folders are planned to be the first use of these. Later on, features such as adjustment layers, text layers, and HDR will also be added (to name a few).
Change Log
Changes since 5.1.12:
Download and Install
This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable βAlso check for pre-release (beta) versions of paint.netβ and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.
You can also download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.
β

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
auto adaptive colours (matching web based draw.io); upgrades preserve simple. Change via Extras β Configuration.
Fixed an issue where websites on internal or corporate networks that require a login prompt would show a blank page. (Bug 2034752)
Fixed an issue that prevented highlighting from working on scanned images in the built-in PDF viewer. (Bug 2034980)
Fixed an issue where the "New" badge persisted on Split View menu items. (Bug 2027793)
Fixed an issue that prevented some webcams from working correctly in video calls. (Bug 2034722)
Fixed an issue where a tab would crash when dragging and dropping nested folders onto a webpage. (Bug 2030461)
Improved how Firefox displays websites with advanced 3D effects, fixing cases where parts of the page could disappear or appear incorrectly. (Bug 2034283)
Fixed an issue that could prevent Firefoxβs local backup feature from completing successfully. (Bug 2029240)
Fixed an issue where the status and navigation bars would flicker or show mismatched colors when editing a pageβs address. (Bug 2021596)
Improved the appearance of search suggestions in the address bar by preventing icons from appearing stretched or distorted. (Bug 2035353)
Various security fixes.
Reference link to 150.0.1 release notes.

The Chrome team is delighted to announce the promotion of Chrome 148 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 127 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
[$43000][493747582] Critical CVE-2026-7896: Integer overflow in Blink. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-18
[N/A][504069514] Critical CVE-2026-7897: Use after free in Mobile. Reported by Google on 2026-04-18
[N/A][504587882] Critical CVE-2026-7898: Use after free in Chromoting. Reported by Google on 2026-04-20
[$55000][505481948] High CVE-2026-7899: Out of bounds read and write in V8. Reported by Project WhatForLunch (@pjwhatforlunch) on 2026-04-23
[$16000][496503799] High CVE-2026-7900: Heap buffer overflow in ANGLE. Reported by Anonymous on 2026-03-26
[$16000][497724490] High CVE-2026-7901: Use after free in ANGLE. Reported by Syn4pse (@ret2happy) on 2026-03-30
[$8000][502030575] High CVE-2026-7902: Out of bounds memory access in V8. Reported by JunYoung Park(@candymate) of KAIST Hacking Lab on 2026-04-13
[TBD][491760376] High CVE-2026-7903: Integer overflow in ANGLE. Reported by heesun on 2026-03-11
[TBD][492350406] High CVE-2026-7904: Out of bounds read in Fonts. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-13
[N/A][495259842] High CVE-2026-7905: Insufficient validation of untrusted input in Media. Reported by Google on 2026-03-23
[N/A][496284584] High CVE-2026-7906: Use after free in SVG. Reported by Google on 2026-03-25
[N/A][496292089] High CVE-2026-7907: Use after free in DOM. Reported by Google on 2026-03-25
[N/A][497436531] High CVE-2026-7908: Use after free in Fullscreen. Reported by Google on 2026-03-29
[N/A][497437113] High CVE-2026-7909: Inappropriate implementation in ServiceWorker. Reported by Google on 2026-03-29
[N/A][497543810] High CVE-2026-7910: Use after free in Views. Reported by Google on 2026-03-29
[N/A][497548912] High CVE-2026-7911: Use after free in Aura. Reported by Google on 2026-03-29
[N/A][497639714] High CVE-2026-7912: Integer overflow in GPU. Reported by Google on 2026-03-30
[N/A][497936728] High CVE-2026-7913: Insufficient policy enforcement in DevTools. Reported by Google on 2026-03-30
[N/A][498401609] High CVE-2026-7914: Type Confusion in Accessibility. Reported by Google on 2026-04-01
[N/A][498454478] High CVE-2026-7915: Insufficient data validation in DevTools. Reported by Google on 2026-04-01
[N/A][498720754] High CVE-2026-7916: Insufficient data validation in InterestGroups. Reported by Google on 2026-04-01
[N/A][498752242] High CVE-2026-7917: Use after free in Fullscreen. Reported by Google on 2026-04-02
[N/A][498780188] High CVE-2026-7918: Use after free in GPU. Reported by Google on 2026-04-02
[N/A][498832921] High CVE-2026-7919: Use after free in Aura. Reported by Google on 2026-04-02
[N/A][498989348] High CVE-2026-7920: Use after free in Skia. Reported by Google on 2026-04-02
[N/A][499062376] High CVE-2026-7921: Use after free in Passwords. Reported by Google on 2026-04-02
[N/A][499449324] High CVE-2026-7922: Use after free in ServiceWorker. Reported by Google on 2026-04-04
[N/A][500080194] High CVE-2026-7923: Out of bounds write in Skia. Reported by Google on 2026-04-06
[N/A][500087204] High CVE-2026-7924: Uninitialized Use in Dawn. Reported by Google on 2026-04-06
[N/A][501833981] High CVE-2026-7925: Use after free in Chromoting. Reported by Google on 2026-04-12
[TBD][502249087] High CVE-2026-7926: Use after free in PresentationAPI. Reported by anonymous on 2026-04-14
[N/A][502830119] High CVE-2026-7927: Type Confusion in Runtime. Reported by Google on 2026-04-15
[N/A][504612429] High CVE-2026-7928: Use after free in WebRTC. Reported by Google on 2026-04-20
[N/A][504660052] High CVE-2026-7929: Use after free in MediaRecording. Reported by Google on 2026-04-20
[TBD][434825208] Medium CVE-2026-7930: Insufficient validation of untrusted input in Cookies. Reported by Satoki on 2025-07-29
[TBD][474338157] Medium CVE-2026-7931: Insufficient validation of untrusted input in iOS. Reported by Qadhafy Muhammad Tera on 2026-01-08
[TBD][481634116] Medium CVE-2026-7932: Insufficient policy enforcement in Downloads. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-02-04
[TBD][488585490] Medium CVE-2026-7933: Out of bounds read in WebCodecs. Reported by heapracer (@heapracer) on 2026-03-01
[N/A][489023922] Medium CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker. Reported by Google on 2026-03-02
[TBD][489624550] Medium CVE-2026-7935: Inappropriate implementation in Speech. Reported by Qadhafy Muhammad Tera on 2026-03-04
[TBD][490485402] Medium CVE-2026-7936: Object lifecycle issue in V8. Reported by Christian Holler on 2026-03-07
[TBD][491766258] Medium CVE-2026-7937: Insufficient policy enforcement in DevTools. Reported by lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab on 2026-03-11
[TBD][492735384] Medium CVE-2026-7938: Use after free in CSS. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-15
[TBD][492963096] Medium CVE-2026-7939: Inappropriate implementation in SanitizerAPI. Reported by s3zer0 on 2026-03-15
[TBD][493631402] Medium CVE-2026-7940: Use after free in V8. Reported by sakana on 2026-03-17
[TBD][493955234] Medium CVE-2026-7941: Insufficient validation of untrusted input in Mobile. Reported by Adithya Kotian on 2026-03-19
[N/A][495363705] Medium CVE-2026-7942: Integer overflow in ANGLE. Reported by Google on 2026-03-23
[TBD][495373657] Medium CVE-2026-7943: Insufficient validation of untrusted input in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-23
[N/A][495783187] Medium CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache. Reported by Google on 2026-03-24
[N/A][495802788] Medium CVE-2026-7945: Insufficient validation of untrusted input in COOP. Reported by Google on 2026-03-24
[N/A][496016840] Medium CVE-2026-7946: Insufficient policy enforcement in WebUI. Reported by Google on 2026-03-25
[N/A][496169594] Medium CVE-2026-7947: Insufficient validation of untrusted input in Network. Reported by Google on 2026-03-25
[N/A][496193452] Medium CVE-2026-7948: Race in Chromoting. Reported by Google on 2026-03-25
[N/A][496206134] Medium CVE-2026-7949: Out of bounds read in Skia. Reported by Google on 2026-03-25
[N/A][496259890] Medium CVE-2026-7950: Out of bounds read and write in GFX. Reported by Google on 2026-03-25
[TBD][496266456] Medium CVE-2026-7951: Out of bounds write in WebRTC. Reported by soft.connect.fr on 2026-03-26
[N/A][496279876] Medium CVE-2026-7952: Insufficient policy enforcement in Extensions. Reported by Google on 2026-03-25
[N/A][496379792] Medium CVE-2026-7953: Insufficient validation of untrusted input in Omnibox. Reported by Google on 2026-03-26
[N/A][496380960] Medium CVE-2026-7954: Race in Shared Storage. Reported by Google on 2026-03-26
[N/A][496441232] Medium CVE-2026-7955: Uninitialized Use in GPU. Reported by Google on 2026-03-26
[N/A][496463315] Medium CVE-2026-7956: Use after free in Navigation. Reported by Google on 2026-03-26
[N/A][496607380] Medium CVE-2026-7957: Out of bounds write in Media. Reported by Google on 2026-03-26
[N/A][496632973] Medium CVE-2026-7958: Inappropriate implementation in ServiceWorker. Reported by Google on 2026-03-26
[N/A][496645205] Medium CVE-2026-7959: Inappropriate implementation in Navigation. Reported by Google on 2026-03-26
[N/A][497007825] Medium CVE-2026-7960: Race in Speech. Reported by Google on 2026-03-27
[N/A][497008295] Medium CVE-2026-7961: Insufficient validation of untrusted input in Permissions. Reported by Google on 2026-03-27
[N/A][497081987] Medium CVE-2026-7962: Insufficient policy enforcement in DirectSockets. Reported by Google on 2026-03-28
[N/A][497250399] Medium CVE-2026-7963: Inappropriate implementation in ServiceWorker. Reported by Google on 2026-03-28
[N/A][497254383] Medium CVE-2026-7964: Insufficient validation of untrusted input in FileSystem. Reported by Google on 2026-03-28
[N/A][497255035] Medium CVE-2026-7965: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-03-28
[N/A][497341787] Medium CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation. Reported by Google on 2026-03-29
[N/A][497365545] Medium CVE-2026-7967: Insufficient validation of untrusted input in Navigation. Reported by Google on 2026-03-29
[N/A][497432281] Medium CVE-2026-7968: Insufficient validation of untrusted input in CORS. Reported by Google on 2026-03-29
[N/A][497450574] Medium CVE-2026-7969: Integer overflow in Network. Reported by Google on 2026-03-29
[N/A][497487462] Medium CVE-2026-7970: Use after free in TopChrome. Reported by Google on 2026-03-29
[N/A][497529290] Medium CVE-2026-7971: Inappropriate implementation in ORB. Reported by Google on 2026-03-29
[N/A][497546281] Medium CVE-2026-7972: Uninitialized Use in GPU. Reported by Google on 2026-03-29
[N/A][497565944] Medium CVE-2026-7973: Integer overflow in Dawn. Reported by Google on 2026-03-29
[N/A][497649372] Medium CVE-2026-7974: Use after free in Blink. Reported by Google on 2026-03-30
[N/A][497735587] Medium CVE-2026-7975: Use after free in DevTools. Reported by Google on 2026-03-30
[N/A][497736679] Medium CVE-2026-7976: Use after free in Views. Reported by Google on 2026-03-30
[N/A][497821223] Medium CVE-2026-7977: Inappropriate implementation in Canvas. Reported by Google on 2026-03-30
[N/A][497828892] Medium CVE-2026-7978: Inappropriate implementation in Companion. Reported by Google on 2026-03-30
[N/A][497849876] Medium CVE-2026-7979: Inappropriate implementation in Media. Reported by Google on 2026-03-30
[N/A][497859275] Medium CVE-2026-7980: Use after free in WebAudio. Reported by Google on 2026-03-30
[N/A][497926602] Medium CVE-2026-7981: Out of bounds read in Codecs. Reported by Google on 2026-03-30
[N/A][497952533] Medium CVE-2026-7982: Uninitialized Use in WebCodecs. Reported by Google on 2026-03-30
[N/A][497975608] Medium CVE-2026-7983: Out of bounds read in Dawn. Reported by Google on 2026-03-31
[N/A][498277368] Medium CVE-2026-7984: Use after free in ReadingMode. Reported by Google on 2026-03-31
[N/A][498352423] Medium CVE-2026-7985: Use after free in GPU. Reported by Google on 2026-03-31
[N/A][498396238] Medium CVE-2026-7986: Insufficient policy enforcement in Autofill. Reported by Google on 2026-04-01
[N/A][498696266] Medium CVE-2026-7987: Use after free in WebRTC. Reported by Google on 2026-04-01
[N/A][498753456] Medium CVE-2026-7988: Type Confusion in WebRTC. Reported by Google on 2026-04-02
[N/A][498765082] Medium CVE-2026-7989: Insufficient data validation in DataTransfer. Reported by Google on 2026-04-02
[N/A][498892267] Medium CVE-2026-7990: Insufficient validation of untrusted input in Updater. Reported by Google on 2026-04-02
[N/A][499065126] Medium CVE-2026-7991: Use after free in UI. Reported by Google on 2026-04-02
[N/A][499067529] Medium CVE-2026-7992: Insufficient validation of untrusted input in UI. Reported by Google on 2026-04-02
[N/A][499099003] Medium CVE-2026-7993: Insufficient validation of untrusted input in Payments. Reported by Google on 2026-04-03
[N/A][499116954] Medium CVE-2026-7994: Inappropriate implementation in Chromoting. Reported by Google on 2026-04-03
[N/A][501745798] Medium CVE-2026-7995: Out of bounds read in AdFilter. Reported by Google on 2026-04-11
[TBD][484547631] Low CVE-2026-7996: Insufficient validation of untrusted input in SSL. Reported by heesun on 2026-02-15
[TBD][487960705] Low CVE-2026-7997: Insufficient validation of untrusted input in Updater. Reported by ochkofficial on 2026-02-26
[TBD][491676472] Low CVE-2026-7998: Insufficient validation of untrusted input in Dialog. Reported by Tianyi Hu on 2026-03-11
[TBD][493099941] Low CVE-2026-7999: Inappropriate implementation in V8. Reported by Taisic Yun (@taisic) of Theori on 2026-03-16
[TBD][494464734] Low CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver. Reported by Ryan Jupp - HAAO on 2026-03-20
[TBD][494764371] Low CVE-2026-8001: Use after free in Printing. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-21
[N/A][495779613] Low CVE-2026-8002: Use after free in Audio. Reported by Google on 2026-03-24
[N/A][495985532] Low CVE-2026-8003: Insufficient validation of untrusted input in TabGroups. Reported by Google on 2026-03-25
[N/A][496189510] Low CVE-2026-8004: Insufficient policy enforcement in DevTools. Reported by Google on 2026-03-25
[N/A][496298665] Low CVE-2026-8005: Insufficient validation of untrusted input in Cast. Reported by Google on 2026-03-25
[N/A][496373088] Low CVE-2026-8006: Insufficient policy enforcement in DevTools. Reported by Google on 2026-03-26
[N/A][496399759] Low CVE-2026-8007: Insufficient validation of untrusted input in Cast. Reported by Google on 2026-03-26
[N/A][496426191] Low CVE-2026-8008: Inappropriate implementation in DevTools. Reported by Google on 2026-03-26
[N/A][496555077] Low CVE-2026-8009: Inappropriate implementation in Cast. Reported by Google on 2026-03-26
[N/A][496624084] Low CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation. Reported by Google on 2026-03-26
[N/A][496626029] Low CVE-2026-8011: Insufficient policy enforcement in Search. Reported by Google on 2026-03-26
[N/A][496628298] Low CVE-2026-8012: Inappropriate implementation in MHTML. Reported by Google on 2026-03-26
[N/A][497427430] Low CVE-2026-8013: Insufficient validation of untrusted input in FedCM. Reported by Google on 2026-03-29
[N/A][497490364] Low CVE-2026-8014: Inappropriate implementation in Preload. Reported by Google on 2026-03-29
[N/A][497548558] Low CVE-2026-8015: Inappropriate implementation in Media. Reported by Google on 2026-03-29
[N/A][497695401] Low CVE-2026-8016: Use after free in WebRTC. Reported by Google on 2026-03-30
[N/A][497722578] Low CVE-2026-8017: Side-channel information leakage in Media. Reported by Google on 2026-03-30
[N/A][498292657] Low CVE-2026-8018: Insufficient policy enforcement in DevTools. Reported by Google on 2026-03-31
[N/A][498353173] Low CVE-2026-8019: Insufficient policy enforcement in WebApp. Reported by Google on 2026-03-31
[N/A][498382925] Low CVE-2026-8020: Uninitialized Use in GPU. Reported by Google on 2026-04-01
[N/A][498417031] Low CVE-2026-8021: Script injection in UI. Reported by Google on 2026-04-01
[N/A][499194407] Low CVE-2026-8022: Inappropriate implementation in MHTML. Reported by Google on 2026-04-03
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Interested in switching release channels? Find out howΒ here. If you find a new issue, please let us know byΒ filing a bug. TheΒ community help forumΒ is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Below are development builds for testing purposes.
Latest development build: 2.7.1.39 (May 28th 2026)
Latest stable release build: 2.7.1
https://github.com/clsid2/mpc-hc/releases/tag/2.7.1
The Stable channel has been updated to 148.0.7778.96/.97 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
The Extended Stable channel has been updated to 146.0.7680.216Β for Windows and Mac which will roll out over the coming days/weeks.
The Stable channel has been updated to 147.0.7727.137/138 for Windows/MacΒ andΒ 147.0.7727.137 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in theΒ Log
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 30 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.
[$7000][494352590] Critical CVE-2026-7363: Use after free in Canvas. Reported by heapracer on 2026-03-19
[N/A][493221953] Critical CVE-2026-7361: Use after free in iOS. Reported by Google on 2026-03-16
[N/A][503419515] Critical CVE-2026-7344: Use after free in Accessibility. Reported by Google on 2026-04-16
[N/A][503645680] Critical CVE-2026-7343: Use after free in Views. Reported by Google on 2026-04-17
[$16000][493955227] High CVE-2026-7333: Use after free in GPU. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-19
[N/A][495852034] High CVE-2026-7360: Insufficient validation of untrusted input in Compositing. Reported by Google on 2026-03-24
[N/A][496284494] High CVE-2026-7359: Use after free in ANGLE. Reported by Google on 2026-03-25
[N/A][496285281] High CVE-2026-7358: Use after free in Animation. Reported by Google on 2026-03-25
[TBD][496456528] High CVE-2026-7334: Use after free in Views. Reported by Batuhan EΕref KOΓ on 2026-03-26
[N/A][497047552] High CVE-2026-7357: Use after free in GPU. Reported by Google on 2026-03-27
[N/A][497769116] High CVE-2026-7356: Use after free in Navigation. Reported by Google on 2026-03-30
[N/A][498746519] High CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google on 2026-04-01
[N/A][498809718] High CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google on 2026-04-01
[N/A][499023054] High CVE-2026-7352: Use after free in Media. Reported by Google on 2026-04-02
[N/A][499119490] High CVE-2026-7351: Race in MHTML. Reported by Google on 2026-04-02
[N/A][500018484] High CVE-2026-7350: Use after free in WebMIDI. Reported by Google on 2026-04-06
[N/A][500034684] High CVE-2026-7349: Use after free in Cast. Reported by Google on 2026-04-06
[N/A][500104917] High CVE-2026-7348: Use after free in Codecs. Reported by Google on 2026-04-06
[TBD][500387779] High CVE-2026-7335: Use after free in media. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po) on 2026-04-07
[TBD][500767595] High CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla on 2026-04-09
[TBD][500880819] High CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io on 2026-04-09
[N/A][501722605] High CVE-2026-7347: Use after free in Chromoting. Reported by Google on 2026-04-11
[N/A][502206907] High CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google on 2026-04-13
[N/A][502248774] High CVE-2026-7345: Insufficient validation of untrusted input in Feedback. Reported by Google on 2026-04-13
[TBD][502449857] High CVE-2026-7338: Use after free in Cast. Reported by Krace on 2026-04-14
[N/A][503889643] High CVE-2026-7342: Use after free in WebView. Reported by Google on 2026-04-17
[N/A][504586599] High CVE-2026-7341: Use after free in WebRTC. Reported by Google on 2026-04-20
[$4000][493957495] Medium CVE-2026-7339: Heap buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-19
[$3000][497896137] Medium CVE-2026-7340: Integer overflow in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-30
[N/A][498285711] Medium CVE-2026-7355: Use after free in Media. Reported by Google on 2026-03-31
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out howΒ here. If you find a new issue, please let us know byΒ filing a bug. TheΒ community help forumΒ is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Fixed an issue where Facebook and other websites might not load properly for users with Bitdefender security software installed. (Bug 2034178)
Fixed an issue where denying a geolocation permission prompt could cause Firefox to show the system permission dialog again on a second attempt. (Bug 2034120)
Fixed an issue that prevented tabs from being added to some older saved tab groups. (Bug 2031961)
Fixed a layout issue where some drop-down menus expanded to display all list items at once. (Bug 2033117)
Fixed an issue where borders and outlines on some page elements disappeared when pinch zooming or smart zooming on macOS and Windows. (Bug 2030043)
Various security fixes.
All Relay users can now create up to 50 email masksβan increase from the previous limit of 5.
Reference link to 150.0 release notes.

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
The Stable channel has been updated to 148.0.7778.56/.57 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Changelog
Wana boot and install OS through network (PXE)? Welcome to my new project iVentoy.
About iVentoy https://www.iventoy.com/
iVentoy is an enhanced version of the PXE server.
Extremely easy to use
Many advanced features
x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI and ARM64 UEFI mode supported
110+ common types of OS supported (Windows/WinPE/Linux/VMware)
Turn any PC, laptop, server, NAS, or Raspberry Pi into a PXE server instantly!
......
SHA-256
04620b546bcc5eeeb5971767595b3713ee3de71580a82449053c53a7cb32fcd9 ventoy-1.1.12-linux.tar.gz
c1345277c8f3a8fcc213945687bcad5ff1d680b1d6b7b7a1cdf85f7d4a368406 ventoy-1.1.12-livecd.iso
e70c505be08d99c55e506832f596c430a9c36f8d087f25542d3f6d332d9b6473 ventoy-1.1.12-windows.zip
The Stable channel has been updated to 147.0.7727.116/117 for Windows/MacΒ andΒ 147.0.7727.116 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in theΒ Log
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 19 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.
[TBD][493652473] High CVE-2026-6919: Use after free in DevTools. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-18
[TBD][499891888] High CVE-2026-6920: Out of bounds read in GPU. Reported by tatiwari of Microsoft on 2026-04-06
[TBD][493315759] Medium CVE-2026-6921: Race in GPU. Reported by soiax on 2026-03-17
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
As usual, our ongoing internal security work was responsible for a wide range of fixes:
[505764421]Various fixes from internal audits, fuzzing and other initiatives
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out howΒ here. If you find a new issue, please let us know byΒ filing a bug. TheΒ community help forumΒ is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Β The Extended Stable channel has been updated to 146.0.7680.208Β for Windows and Mac which will roll out over the coming days/weeks.
OBS-Studio-32.1.2-Sources.tar.gz: c6532380c68a75327fe8b551461adeca8f184dcbe4015096251a6de76362a554
OBS-Studio-32.1.2-Ubuntu-24.04-x86_64-dbsym.ddeb: 3cf56a96de5d0b45f641e8415d3dacc1e47dfc897ba5bcd118b3af05a9ea76da
OBS-Studio-32.1.2-Ubuntu-24.04-x86_64.deb: a3bb1b0176604dad9e22710e057f0fdd76e8afb600e0e1914c30464ae49908e8
OBS-Studio-32.1.2-Windows-arm64-PDBs.zip: 609c4cd849f8d225b021a5f50a080c31af8beb1b5275f2b0088318ab80b0ed78
OBS-Studio-32.1.2-Windows-arm64.zip: 5e1e400e1b49d2019c97c928873229336c8e0b56df488663532376485746328e
OBS-Studio-32.1.2-Windows-x64-Installer.exe: 94d180c1fc481ccc307b95513f795d088d63ac4f61ad3253c2ac0d94d0844110
OBS-Studio-32.1.2-Windows-x64-PDBs.zip: 8105fed359f3437819264b0ebb1c50db6d3bb30de1a65d4a3049e3c14f88deb8
OBS-Studio-32.1.2-Windows-x64.zip: 8d97e4563bd8d22d03e63042aa7dccede1d555c9bd35ce8a9e5019b0d0201bf6
OBS-Studio-32.1.2-macOS-Apple-dSYMs.tar.xz: eea32d7c022237e163a02f8f2fdc26c8b1a0d4a4fc3fb49aaf14df7b59b3d668
OBS-Studio-32.1.2-macOS-Apple.dmg: 2aeb3aaa99544fefd557f10ac6550e73df71540dd57528b2a1e6f39a55ebacfb
OBS-Studio-32.1.2-macOS-Intel-dSYMs.tar.xz: 6a06ed32e0626cafcb7d4f53074b80e63329c1c99309c7f5898d469ed0ef307c
OBS-Studio-32.1.2-macOS-Intel.dmg: f7febee4c52e97930ffa9d8bcae79ee4c60c411827688cfbe36bc53edc51616e
Split View just got better: You can now right-click any link and choose Open Link in Split View to open it alongside your current tab. You can also search open tabs when creating a split view and quickly reverse tab positions using the new Reverse Tabs option in the tab context menu.
Share multiple tabs in a single step. Select several tabs, right-click, and choose Copy X Links (for Windows and Linux) or choose Share β Copy X Links (for MacOS). When pasted into other apps that support rich text, links include both the page title and the URL for easy reading.
You can now use Firefoxβs built-in PDF editor to reorder, copy, paste, delete, and export pages in a PDF.
Try out real-time, private translations in Firefox Desktop with the about:translations page. Start typing the word "translate" into the URL bar for a quick-action shortcut to the page.
![]()
Added support for the GTK emoji picker on Linux, allowing users to insert emoji using the system shortcut (typically Ctrl+.).
Firefox web apps are now available to Windows users who installed Firefox through the Microsoft Store.
The new Firefox Profile management system is now available to all users, including users on Windows 10.
Backing up a profile to a file is now available to all Windows 10 and 11 users, including those who use the new profile management system.
Firefox now ships with a new .rpm package for Linux users on Red Hat, Fedora, openSUSE, and other RPM-based distributions.
Firefox now prompts you to enable location access in Windows settings when granting a website permission to use your location, if geolocation hasn't already been allowed. This behavior, previously limited to some Windows 11 versions, now applies to all supported Windows versions.
The built-in VPN is now available for users in Canada. Note: This feature is not available in enterprise environments.
This feature is part of a progressive roll out.
Certain new Firefox features are released gradually. This means some users will see the feature before everyone does. This approach helps to get early feedback to catch bugs and improve behavior quickly, meaning more Firefox users overall have a better experience.
Fixed an issue on macOS where, when macOS Lockdown mode is enabled, emoji characters are not displayed in web content.
Various security fixes.
If you prefer creating tab groups from the context menu, you can now turn off drag-and-drop group creation in Settings > Tabs > Drag tabs to create tab groups.
You can find information about policy updates and enterprise-specific bug fixes in the Firefox for Enterprise 150 Release Notes.
A new element-specific section has been added to the pseudo-class toggle panel including a toggle for the :open pseudo-class, which is only available for elements that have an open state like <dialog> elements. The existing toggle for the :visited pseudo-class was also moved there, as it only applies to <a> and <area> elements. (Learn More)
The Document.caretPositionFromPoint() method now only returns a position in a shadow DOM if its ShadowRoot is passed in the newly-added shadowRoots option.
The devtools network monitor now indicates when a connection used a certificate issued by a certificate authority not in Mozilla's Root CA Program.
Firefox now supports the ariaNotify API for accessibility notifications (e.g. for screen readers) as a more ergonomic and reliable alternative to ARIA live regions.
Firefox now supports media element pseudo-classes (e.g., :playing, :paused) to allow more precise styling based on media playback state.
Added support for the highlightsFromPoint() API, which allows web pages to interact with CSS Highlights by returning all Highlights at a given point.
Firefox now supports light-dark() on images, just like on colors, which is very useful for supporting dark mode on websites.
The color-mix() function previously accepted only two color values. This limitation has now been removed, allowing the function to accept an arbitrary number of colors.
Added support for a new auto value on the sizes attribute for lazy-loaded image elements with multiple images defined via srcset. This allows the browser to automatically select the right image based on the layout width of the image element. (Learn More)
Users with Bitdefender security software installed may experience problems loading websites, particularly Facebook.com. We are working on a workaround, but as a temporary mitigation, disabling Bitdefender or turning off its traffic filtering features may resolve the issue. (Fixed in 150.0.1)
Some websites on internal or corporate networks that require a login prompt may fail to display the sign-in dialog in Firefox 150, showing a blank page instead. (Fixed in 150.0.2 in Bug 2034752)
With the release of Firefox 150, we are pleased to welcome the developers who contributed their first code change to Firefox in this release, 22 of whom were brand new volunteers! Please join us in thanking each of these diligent and enthusiastic individuals, and take a look at their contributions:

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm
Windows intel x32 releases are marked -ia32-
ChangeLog:
The Extended Stable channel has been updated to 146.0.7680.201Β for Windows and Mac which will roll out over the coming days/weeks.
The Stable channel has been updated to 147.0.7727.101/102 for Windows/MacΒ andΒ 147.0.7727.101Β for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in theΒ Log
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 31 security fixes. Please see the Chrome Security Page for more information.
[$90000][490170083] Critical CVE-2026-6296: Heap buffer overflow in ANGLE. Reported by cinzinga on 2026-03-05
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Interested in switching release channels? Find out howΒ here. If you find a new issue, please let us know byΒ filing a bug. TheΒ community help forumΒ is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Below are development builds for testing purposes.
Latest development build: 2.7.0.10 (April 14th 2026)
Latest stable release build: 2.7.0
https://github.com/clsid2/mpc-hc/releases/tag/2.7.0