Releases Notes for 30.2.6

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.5.0
• #2452
• Updates to draw.io core 30.2.6.

The Stable channel has been updated to 149.0.7827.200/201 for Windows and Mac and 149.0.7827.200 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 3 security fixes. Please see the Chrome Security Pagefor more information.

[N/A][513138301] High CVE-2026-13281: Integer overflow in Mojo. Reported by Google on 2026-05-14

[N/A][517522620] High CVE-2026-13282: Use after free in Payments. Reported by Google on 2026-05-28

[N/A][522561151] High CVE-2026-13283: Use after free in AdFilter. Reported by Google on 2026-06-11

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Changelog

1. Fix the boot issue with old UEFI version firmware when secure boot is disabled.
2. Fix the latest Kicksecure boot issue. (#3651)
3. Fix the issue that VTOY_WIN_UEFI_RES_LOCK option reset when enter VentoyPlugson.
4. Languages update.

Attention
Ventoy use a new UEFI secure boot CA since v1.1.14, so you need to enroll the new key for the first boot time.
If you want to delete the key used in old release, please refer:
https://www.ventoy.net/en/doc_delete_key.html

================================================================
Wana boot and install OS through network (PXE)? Welcome to my new project iVentoy.

About iVentoy https://www.iventoy.com/
iVentoy is an enhanced version of the PXE server.
Extremely easy to use
Many advanced features
x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI and ARM64 UEFI mode supported
110+ common types of OS supported (Windows/WinPE/Linux/VMware)
Turn any PC, laptop, server, NAS, or Raspberry Pi into a PXE server instantly!
......

SHA-256

a9ffd7bd5e26df486cafff924b8dbcb6caae20cbe2b179a009fe59ae740c7572  ventoy-1.1.16-linux.tar.gz
6bf8e53de52289b8281705610a6a2c47c731e285ce28cfd18efa1b00b45ca535  ventoy-1.1.16-livecd.iso
7db5b3a1e23af39d0a648843c263eb5cf51493ccbf2a38c6a4315db80a4f9b58  ventoy-1.1.16-windows.zip

Changelog

1. Fix the boot issue when Secure Boot is disabled in the UEFI firmware. (#3650)

Attention
Ventoy use a new UEFI secure boot CA since v1.1.14, so you need to enroll the new key for the first boot time.
If you want to delete the key used in old release, please refer:
https://www.ventoy.net/en/doc_delete_key.html

================================================================
Wana boot and install OS through network (PXE)? Welcome to my new project iVentoy.

About iVentoy https://www.iventoy.com/
iVentoy is an enhanced version of the PXE server.
Extremely easy to use
Many advanced features
x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI and ARM64 UEFI mode supported
110+ common types of OS supported (Windows/WinPE/Linux/VMware)
Turn any PC, laptop, server, NAS, or Raspberry Pi into a PXE server instantly!
......

SHA-256

dfed601b689fa4f552bc4c44dc0a45ef893226630fb11f43ca3ab618ff429279  ventoy-1.1.15-linux.tar.gz
280cf28305126c6ea73c4be79ea949dc96998d7e7acc31bb8f02ff3eb947620c  ventoy-1.1.15-livecd.iso
d5af29281ba8b57d7c398f452d31a5d031f6dcb460bdb0a67b2115dfef372b76  ventoy-1.1.15-windows.zip

The Stable channel has been updated to 150.0.7871.46/.47 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

Changelog

1. Update secure boot shim file to solve the UEFI CA 2023 issue.
   The new release use a new CA, so you need to enroll the new key for the first boot time.
2. VentoyPlugson update synchronously.
3. Global control plugin add a VTOY_SECURE_BOOT_POLICY option. Notes

================================================================
Wana boot and install OS through network (PXE)? Welcome to my new project iVentoy.

About iVentoy https://www.iventoy.com/
iVentoy is an enhanced version of the PXE server.
Extremely easy to use
Many advanced features
x86 Legacy BIOS, IA32 UEFI, x86_64 UEFI and ARM64 UEFI mode supported
110+ common types of OS supported (Windows/WinPE/Linux/VMware)
Turn any PC, laptop, server, NAS, or Raspberry Pi into a PXE server instantly!
......

SHA-256

96add45625f7634726bc64633ddaf93851f183e00beabf556c5ab7f1b080a81a  ventoy-1.1.14-linux.tar.gz
91d6694664e14ff10d73034f6f9c22d1c0a376a0f7889773564c1b7bf948f9c9  ventoy-1.1.14-livecd.iso
3dc0baf85a183bb8fc72b49ea0646d259984c37b6a6dc61ce7087fe8ce187075  ventoy-1.1.14-windows.zip

This release was deprecated due to a mistake

The Extended Stable channel has been updated to 148.0.7778.280 for Windows and Mac which will roll out over the coming days/weeks.

The Stable channel has been updated to 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 18 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information

[TBD][520656244] Critical CVE-2026-13028: Use after free in WebGL. Reported by anonymous on 2026-06-07

[N/A][523591974] Critical CVE-2026-13032: Use after free in WebGL. Reported by Google on 2026-06-13

[N/A][523677844] Critical CVE-2026-13033: Out of bounds read in Blink>InterestGroups. Reported by Google on 2026-06-13

[N/A][523740781] Critical CVE-2026-13038: Use after free in Autofill. Reported by Google on 2026-06-14

[N/A][511776603] High CVE-2026-13021: Inappropriate implementation in DeviceBoundSessionCredentials. Reported by Google on 2026-05-10

[N/A][516734537] High CVE-2026-13022: Inappropriate implementation in Autofill. Reported by Google on 2026-05-26

[N/A][517080836] High CVE-2026-13023: Uninitialized Use in GPU. Reported by Google on 2026-05-27

[N/A][517148260] High CVE-2026-13024: Insufficient validation of untrusted input in Navigation. Reported by Google on 2026-05-27

[N/A][518043569] High CVE-2026-13025: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-05-30

[N/A][519728279] High CVE-2026-13026: Use after free in Digital Credentials. Reported by Google on 2026-06-03

[N/A][520543781] High CVE-2026-13027: Use after free in FileSystem. Reported by Google on 2026-06-05

[N/A][521495992] High CVE-2026-13029: Use after free in Web Authentication. Reported by Google on 2026-06-08

[N/A][522840723] High CVE-2026-13030: Uninitialized Use in GPU. Reported by Google on 2026-06-11

[N/A][523308824] High CVE-2026-13031: Use after free in Blink. Reported by Google on 2026-06-12

[N/A][523699355] High CVE-2026-13034: Inappropriate implementation in Passwords. Reported by Google on 2026-06-13

[N/A][523704570] High CVE-2026-13035: Use after free in Bluetooth. Reported by Google on 2026-06-13

[N/A][523711130] High CVE-2026-13036: Use after free in Blink. Reported by Google on 2026-06-13

[N/A][523721871] High CVE-2026-13037: Use after free in WebView. Reported by Google on 2026-06-14

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

Beta 2 Changes

• Fixed a CI deployment issue. There are no application changes since Beta 1.

32.2 New Features

• Replaced add source dropdown with new dialog [Warchamp7]
• Improved FPS selector UX [jcm93]
• Added missing file support for filters [exeldro]
• Added ability for plugins to set custom icons for new source types [cg2121]
• Included .webp files when adding a directory to Image Slide Show source [TarunCore]
• Added copy paste functions to frontend API [exeldro]
• Added filter to compose SDR into HDR [jpark37]
• Added delete as a hotkey to delete sources on macOS [PatTheMav]
• Added dynamic bitrate support to multitrack video [lexano-ivs]

32.2 Changes

• Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
  • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
• Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
• Added theming for checked QToolButtons [glikely]
• Improved OpenGL performance slightly on low-end machines [kkartaltepe]
• Set minimum size for color source to 1 pixel [exeldro]
• Added minimum width to spinboxes [Warchamp7]
• Disallowed overwriting the crash handler [sebastian-s-beckmann]
• Applied process mitigation policies for Windows [notr1ch]
• Adjusted description of multitrack video [jhnbwrs]
• Changed new capture devices to use fallback frame rate by default [PatTheMav]
• Improved DLL loading behavior on Windows [notr1ch]
• Limited multitrack video config to Custom service [PatTheMav]

32.2 Bug Fixes

• Fixed OAuth and dock state save corruption [PatTheMav]
• Fixed group bounds not resizing when removing items [howellrl]
• Fixed canvas mixes not being restored after video reset [dsaedtler]
• Fixed some erroneous crashes during shutdown [Warchamp7]
• Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
• Fixed color of controls dock output buttons in System theme [shiina424]
• Fixed virtual camera reset failures [stephematician]
• Fixed potential crash when user discards changes in the settings window [suogesi]
• Fixed incorrect return value in virtualcam filter [xtfo]
• Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
• Fixed properties hint icon spacing [Warchamp7]
• Fixed potential crash when a video device reconnects on macOS [jcm93]
• Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
• Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]

32.2 Deprecations

• Deprecated obs_properties_add_button [sebastian-s-beckmann]

Checksums

OBS-Studio-32.2.0-beta2-Sources.tar.gz: 2b643fba022a7a7b512522b598dfa587fd87be071e43ff345cd73608f7bdae13
OBS-Studio-32.2.0-beta2-Ubuntu-24.04-x86_64-dbsym.ddeb: ba2ce12e1a220c6aa5d00e23bc10bfead82dae263ac1c213a81e9ac88e122403
OBS-Studio-32.2.0-beta2-Ubuntu-24.04-x86_64.deb: bc02de836d115323c87eee5fca17c1bc3831ef5c1fc64709aeabd8dbce32785a
OBS-Studio-32.2.0-beta2-Ubuntu-26.04-x86_64-dbsym.ddeb: 84956ff43ffec70581db566adbfd29942bab783bc98a92620ac73fdc6f3e2006
OBS-Studio-32.2.0-beta2-Ubuntu-26.04-x86_64.deb: 1816bc64e4e587883a6887744e5e48348290e8944ac8c6c5866f3c39db9a4600
OBS-Studio-32.2.0-beta2-Windows-arm64-PDBs.zip: 3110e6a4a1fef3f5474de37962e97b702601380e5afba48ec905a79966f4acfe
OBS-Studio-32.2.0-beta2-Windows-arm64.zip: d8998e8f0d7ae05da07a62c4b31dacfbd9a0f22e819736d045d0a6db85afc9db
OBS-Studio-32.2.0-beta2-Windows-x64-Installer.exe: 10ed6505b22df7c3d7ce3c30e8584bd9c475f0775b8515ab5bb895eefae870e6
OBS-Studio-32.2.0-beta2-Windows-x64-PDBs.zip: 302e7039d31dc897a2ce9d7323e9409e2e4bfcfe3d374de1cc21d0dbba783083
OBS-Studio-32.2.0-beta2-Windows-x64.zip: 38914895b20a6a2ffad4ed54ed41bf5ab2461fb10192cddc721eabccff526eae
OBS-Studio-32.2.0-beta2-macOS-Apple-dSYMs.tar.xz: f2f4cf21a396147be3b6a301f08b272ae546da0d5d4be0dd34d7b52191519560
OBS-Studio-32.2.0-beta2-macOS-Apple.dmg: 902de6585cddf070a161c6278db857aa3d5986e840a67cebb647dbcdae68ea72
OBS-Studio-32.2.0-beta2-macOS-Intel-dSYMs.tar.xz: 3dd5316492e67b8fe53197c28a6ae2def05a06df2cdfc5ad5af4189fd808d5f0
OBS-Studio-32.2.0-beta2-macOS-Intel.dmg: cddff8ff00b96eec9f5fb7116b4729d7de50ae58611bbc605958f3c458ccd02e

12.20 - 2026-06-22

⛰️ Features

• Support some keywords like CURRENT_TIMESTAMP in SQLite default value drop-down - (dbadd37)

🐛 Bug Fixes

• SelectUserNode on macOS cannot find a newly created node with a TUser, probably because nodes were refreshed too late in OnBeforePaint - (f6c5d2d)
• Expect "IF NOT EXISTS" clause in trigger definition - (71af8d3)
• Reveal procedures and function in MySQL which are stored with correct case in mysql.proc - (106010e)

⚙️ Miscellaneous Tasks

• Ignore all .po translation files pulled from Transifex - (611212a)
• Restrict cliff release notes from previous tag to current one, prefer spaces indentation in Makefile variable assignment - (548f44f)

Bump version for v12.20 release

32.2 New Features

• Replaced add source dropdown with new dialog [Warchamp7]
• Improved FPS selector UX [jcm93]
• Added missing file support for filters [exeldro]
• Added ability for plugins to set custom icons for new source types [cg2121]
• Included .webp files when adding a directory to Image Slide Show source [TarunCore]
• Added copy paste functions to frontend API [exeldro]
• Added filter to compose SDR into HDR [jpark37]
• Added delete as a hotkey to delete sources on macOS [PatTheMav]
• Added dynamic bitrate support to multitrack video [lexano-ivs]

32.2 Changes

• Forced Intel-based installations to update to Apple Silicon version on macOS [PatTheMav]
  • This change means that OBS Studio versions built for Intel-based Macs but running on Apple Silicon Macs will automatically update to OBS Studio built for Apple Silicon Macs. If an installation was using third-party plugins, those plugins will no longer load until replaced with Apple Silicon versions.
• Fixed audio mixer state getting out of sync when changing settings via websockets or plugins [Warchamp7]
• Added theming for checked QToolButtons [glikely]
• Improved OpenGL performance slightly on low-end machines [kkartaltepe]
• Set minimum size for color source to 1 pixel [exeldro]
• Added minimum width to spinboxes [Warchamp7]
• Disallowed overwriting the crash handler [sebastian-s-beckmann]
• Applied process mitigation policies for Windows [notr1ch]
• Adjusted description of multitrack video [jhnbwrs]
• Changed new capture devices to use fallback frame rate by default [PatTheMav]
• Improved DLL loading behavior on Windows [notr1ch]
• Limited multitrack video config to Custom service [PatTheMav]

32.2 Bug Fixes

• Fixed OAuth and dock state save corruption [PatTheMav]
• Fixed group bounds not resizing when removing items [howellrl]
• Fixed canvas mixes not being restored after video reset [dsaedtler]
• Fixed some erroneous crashes during shutdown [Warchamp7]
• Fixed display capture sometimes capturing black after a duplicator failure [ThrowTop]
• Fixed color of controls dock output buttons in System theme [shiina424]
• Fixed virtual camera reset failures [stephematician]
• Fixed potential crash when user discards changes in the settings window [suogesi]
• Fixed incorrect return value in virtualcam filter [xtfo]
• Fixed source toolbar buttons not working after dragging a source into a group [Warchamp7]
• Fixed properties hint icon spacing [Warchamp7]
• Fixed potential crash when a video device reconnects on macOS [jcm93]
• Fixed an issue where PipeWire could fail on NVIDIA GPUs [hoshinolina]
• Fixed obs_canvas_get_video_info returning incorrect framerate [dsaedtler]

32.2 Deprecations

• Deprecated obs_properties_add_button [sebastian-s-beckmann]

12.19 - 2026-06-20

⛰️ Features

• Label the new tab like the selected table, in the "Select top x rows" action - (f87cc85)

🚀 Enhancements

• Pass LogLevel=error to the SSH command line - (923296d)

🐛 Bug Fixes

• (ui) Apply "disabled painting" to tree node icons, not to the text which gets unreadable - (4b2f469)
• Crash in grid export with no focused column and usage of IfThen() which evaluates all arguments before the function is called - (bfe336b)
• Reveal default text value of SQLite columns - (7f6e368)
• Do not use INVISIBLE keyword on MariaDB - (fb082b8)
• Prevent duplicate icons in Linux Alt-Tab by providing StartupWMClass with what xprop told me in the WM_CLASS line - (249c311)
• Compiler error 4001 on arm64: Incompatible type - (1dbe1ae)
• Compiler error 4001 and 4025on arm64: Incompatible type for arg no. 1: Got "SYSTEM.UITYPES.TFontStyles", expected "GRAPHICS.TFontStyles" - (aefc8fb)
• Compiler error 4001 on arm64: Incompatible types: got "TFontStyles" expected "Set Of TFontStyle" - (f67445f)
• Unhide hint on lblPasswordHint - (5f35d41)
• Initially visible password hint may confuse user - (ed0f932)
• Set new authentication plugin only if the user changed it, and then hint the user this will reset the password - (4ed89b8)
• Error dialog due to unsupported SHOW GLOBAL VARIABLES query on MySQL 3.x servers - (49c70f8)
• Truncate strings on UTF-8 boundaries in StrEllipsis - (2174388)
• Prevent access violation on session disconnect (nil ActivePage) - (f878277)
• "sort alphabetically" checkbox in column selector does nothing on macOS - (ec2b942)
• A checkbox does not seem to have Focused on macOS during a mouse-click - (c21f646)
• Work around mysql bug for "hidden" routines in UPPERCASE databases - (f51834c)

⚙️ Miscellaneous Tasks

• Add missing download QT6ARM step to release job - (7df0567)
• Align hostname in Transifex config file with the one in my ~/.transifexrc - (1a316c6)
• Align Transifex config to current directory structure, and add a client for Windows - (40bfb69)
• Require new step in release job, fix /tmp naming - (1fb805d)
• Attempt to compile a QT6 binary for Linux ARM64 / RaspiOS - (5dc2bc4)

Localize

• Update compiled .mo translation files - (ae730a8)

Contributors

• @ansgarbecker
• @ in #2514

Bump version for v12.19 release

Releases Notes for 30.2.4

Windows Installer
Windows No Installer (zip)
macOS - Universal
Linux - deb, AppImage or rpm

Windows intel x32 releases are marked -ia32-

ChangeLog:

• Uses electron 42.4.1
• Updates to draw.io core 30.2.4.

The Stable channel has been updated to 150.0.7871.24/.25 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

The Stable channel has been updated to 149.0.7827.155/.156 for Windows and Mac and 149.0.7827.155 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 33 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.

[N/A][516496659] Critical CVE-2026-12437: Use after free in WebShare. Reported by Google on 2026-05-25

[N/A][516947912] Critical CVE-2026-12438: Inappropriate implementation in WebView. Reported by Google on 2026-05-27

[N/A][519728275] Critical CVE-2026-12439: Use after free in Digital Credentials. Reported by Google on 2026-06-03

[N/A][519731619] Critical CVE-2026-12440: Use after free in DigitalCredentials. Reported by Google on 2026-06-03

[N/A][520157118] Critical CVE-2026-12441: Use after free in File Input. Reported by Google on 2026-06-05

[N/A][521950423] Critical CVE-2026-12442: Use after free in Passwords. Reported by Google on 2026-06-09

[N/A][522566295] Critical CVE-2026-12443: Use after free in Web Authentication. Reported by Google on 2026-06-11

[N/A][513160088] High CVE-2026-12444: Out of bounds read in Chromoting. Reported by Google on 2026-05-14

[N/A][513199795] High CVE-2026-12445: Use after free in Extensions. Reported by Google on 2026-05-14

[N/A][513313107] High CVE-2026-12446: Insufficient data validation in Passwords. Reported by Google on 2026-05-14

[N/A][513405023] High CVE-2026-12447: Heap buffer overflow in WebRTC. Reported by Google on 2026-05-15

[N/A][513458233] High CVE-2026-12448: Inappropriate implementation in WebView. Reported by Google on 2026-05-15

[N/A][513480539] High CVE-2026-12449: Use after free in Chromoting. Reported by Google on 2026-05-15

[N/A][514531776] High CVE-2026-12450: Inappropriate implementation in Media. Reported by Zhixin Tu on 2026-05-19

[N/A][514741076] High CVE-2026-12451: Use after free in DigitalCredentials. Reported by Google on 2026-05-19

[N/A][515462244] High CVE-2026-12452: Use after free in Downloads. Reported by Google on 2026-05-21

[N/A][516448843] High CVE-2026-12453: Insufficient validation of untrusted input in Input. Reported by Google on 2026-05-25

[N/A][516926968] High CVE-2026-12454: Race in Safe Browsing. Reported by Google on 2026-05-27

[N/A][517069848] High CVE-2026-12455: Use after free in Tab Strip. Reported by Google on 2026-05-27

[N/A][517124587] High CVE-2026-12456: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-27

[N/A][517153117] High CVE-2026-12457: Insufficient data validation in Extensions. Reported by Google on 2026-05-27

[N/A][517258337] High CVE-2026-12458: Incorrect security UI in Passwords. Reported by Google on 2026-05-27

[N/A][517406035] High CVE-2026-12459: Inappropriate implementation in Serial. Reported by Google on 2026-05-28

[N/A][517484284] High CVE-2026-12460: Insufficient policy enforcement in File System Access. Reported by Google on 2026-05-28

[N/A][517727318] High CVE-2026-12461: Out of bounds read in WebRTC. Reported by Google on 2026-05-29

[N/A][517916024] High CVE-2026-12462: Use after free in Media. Reported by Google on 2026-05-29

[N/A][518042749] High CVE-2026-12463: Inappropriate implementation in Views. Reported by Google on 2026-05-30

[N/A][519358344] High CVE-2026-12464: Use after free in Browser. Reported by Google on 2026-06-03

[N/A][520189702] High CVE-2026-12465: Insufficient validation of untrusted input in Metrics. Reported by Google on 2026-06-05

[N/A][520199394] High CVE-2026-12466: Heap buffer overflow in WebRTC. Reported by Google on 2026-06-05

[N/A][520202726] High CVE-2026-12467: Use after free in Extensions. Reported by Google on 2026-06-05

[N/A][521485244] High CVE-2026-12468: Inappropriate implementation in Updater. Reported by Google on 2026-06-08

[N/A][521618871] High CVE-2026-12469: Uninitialized Use in GPU. Reported by Google on 2026-06-09

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

The Extended Stable channel has been updated to 148.0.7778.271 for Windows and Mac which will roll out over the coming days/weeks.

Changes from 2.7.2 to 2.7.3:

Updates:

• Updated LAV Filters to version 0.82
• Updated MPC Video Renderer to version 0.10.4.2550
• Updated MPC Audio Renderer

Fixes:

• A few crash fixes, bug fixes and small improvements.

[3.0.6] - 2026-06-13

Fixed

• Manually edited album covers are overwritten on the next collection refresh
• Fixed AppImage package not working on modern GNU/Linux distributions
• Deleting song from playlist sometimes fails
• Playback controls only work when clicking on upper half of the buttons
• It's unclear that files must be tagged with an external ReplayGain scanner (for example rsgain) before normalization can take effect.
• Change to Artist or Album tags is not reflected in the song list view nor in the Now Playing information
• ReplayGain issues
• Smart playlist filters ignore text containing accents or other special characters
• Some MP3 files trigger an "MPEG header not found" error due to a too-narrow initial MPEG header scan range

Changed

• Updated the Vietnamese translation

• Intel Arc G3 & G3 Extreme (Panther Lake).
• Intel Core Ultra 5 250KF Plus (Arrow Lake Refresh).
• AMD Ryzen 7 7700X3D (Raphael).
• AMD Ryzen AI Max+ 495, 492, 488 (Gorgon Halo).
• AMD Ryzen AI Max 490, 485 (Gorgon Halo).
• AMD Ryzen AI Max PRO 495, 490, 485, 480 (Gorgon Halo).
• AMD Ryzen 9 9950X3D2 (Granite Ridge).
• AMD Ryzen 9 PRO 9965X3D, PRO 9945 (Granite Ridge).
• AMD Ryzen 7 PRO 9755, PRO 9745 (Granite Ridge).
• AMD Ryzen 5 PRO 9645 (Granite Ridge).
• AMD Ryzen AI 7/PRO 450G/GE (Gorgon Point 2).
• AMD Ryzen AI 5/PRO 440G/GE (Gorgon Point 2).
• AMD Ryzen AI 5/PRO 435G/GE (Gorgon Point 3).
• Support of HUDIMM and HSODIMM memory modules.
• New themes.
• New real-time graphs.

The Extended Stable channel has been updated to 148.0.7778.265 for Windows and Mac which will roll out over the coming days/weeks.

The Stable channel has been updated to 149.0.7827.114/.115 for Windows and Mac and 149.0.7827.114 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 27 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.

[N/A][516731749] Critical CVE-2026-12007: Use after free  Core. Reported by Google on 2026-05-26

[N/A][516942828] Critical CVE-2026-12008: Use after free  DigitalCredentials. Reported by Google on 2026-05-27

[N/A][517332006] Critical CVE-2026-12009: Insufficient validation of untrusted input  Accessibility. Reported by Google on 2026-05-28

[N/A][517531647] Critical CVE-2026-12010: Heap buffer overflow  GPU. Reported by Google on 2026-05-28

[N/A][518108291] Critical CVE-2026-12011: Use after free  WebMIDI. Reported by Google on 2026-05-30

[N/A][499182801] High CVE-2026-12012: Use after free  Network. Reported by Google on 2026-04-03

[N/A][514742747] High CVE-2026-12014: Use after free  Cast. Reported by Google on 2026-05-19

[N/A][515463295] High CVE-2026-12015: Use after free  Autofill. Reported by Google on 2026-05-21

[N/A][516482138] High CVE-2026-12016: Insufficient validation of untrusted input  DevTools. Reported by Google on 2026-05-25

[N/A][516797143] High CVE-2026-12017: Insufficient validation of untrusted input  Extensions. Reported by Google on 2026-05-26

[N/A][516808201] High CVE-2026-12018: Inappropriate implementation  Mojo. Reported by Google on 2026-05-26

[N/A][516872067] High CVE-2026-12019: Out of bounds write  Codecs. Reported by Google on 2026-05-26

[N/A][516907083] High CVE-2026-12020: Use after free  Autofill. Reported by Google on 2026-05-27

[N/A][516929496] High CVE-2026-12022: Race  Safe Browsing. Reported by Google on 2026-05-27

[N/A][517018374] High CVE-2026-12023: Use after free  GPU. Reported by Google on 2026-05-27

[N/A][517086161] High CVE-2026-12024: Insufficient policy enforcement  DevTools. Reported by Google on 2026-05-27

[N/A][517153191] High CVE-2026-12025: Insufficient validation of untrusted input  Network. Reported by Google on 2026-05-27

[N/A][517347084] High CVE-2026-12026: Out of bounds read  Video. Reported by Google on 2026-05-28

[N/A][517517155] High CVE-2026-12027: Insufficient policy enforcement  Headless. Reported by Google on 2026-05-28

[N/A][517555461] High CVE-2026-12028: Use after free  GPU. Reported by Google on 2026-05-28

[N/A][518002958] High CVE-2026-12029: Use after free  Video. Reported by Google on 2026-05-29

[N/A][518007423] High CVE-2026-12030: Heap buffer overflow  GPU. Reported by Google on 2026-05-29

[N/A][518045638] High CVE-2026-12031: Inappropriate implementation  Views. Reported by Google on 2026-05-30

[N/A][518128953] High CVE-2026-12032: Inappropriate implementation  Passwords. Reported by Google on 2026-05-30

[N/A][519248779] High CVE-2026-12033: Out of bounds read  VideoCapture. Reported by Google on 2026-06-02

[N/A][519258799] High CVE-2026-12034: Insufficient validation of untrusted input  Linux Toolkit Theming. Reported by Google on 2026-06-02

[N/A][520210566] High CVE-2026-12035: Use after free  Views. Reported by Google on 2026-06-05

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

Below are development builds for testing purposes.

Latest development build: 2.7.2.18 (June 15th 2026)

Latest stable release build: 2.7.2
https://github.com/clsid2/mpc-hc/releases/tag/2.7.2

12.18 - 2026-06-09

⛰️ Features

• (packaging) Create .rpm package through Makefile, plus let GH action run that step in release mode - (fc728cf)
• Create checkbox in advanced session setting for new ForceUnicode setting - (75a0f7f)
• Create opt-out setting "ForceUnicode", for sessions which shall not force Unicode communication - (ed9a94f)
• Enable connection port visible in a column of the session tree - (7cfdb97)
• Display auth plugin in a new column of the user listing tree - (3e4f562)
• Support authentication plugin selection in user manager - (07112a0)
• Grid export option for exporting the focused grid column only - (d896680)
• Bypass automatic foreign key lookup in data grid editing through new menu item - (a5ae04b)
• Add a separate menu item "copy formatted text", using the old code for copying SynEdit-highlighted text as HTML - (84c63c6)
• Filter edit box for shortcuts in preferences - (fb243fc)
• Create CLI app for adding PE security flags to heidisql.exe - (3e797e2)
• Rename snippet per right-click on query helpers tree - (7171e48)
• Name columns in SELECT when exporting table with invisible columns - (1799b0d)
• Support invisible indexes on MySQL 8.0+ and ignored indexes on MariaDB 10.6+ - (b3fa484)
• Support assigning a default role to a user - (96d2aef)
• Support assigning roles to a user or role - (96717cd)
• Do not require MySQL's RELOAD privilege just for opening the user manager - (f79d9a5)
• When nodes are filtered, change "Check all" action to "Change all visible" - (ebd60b3)
• Disable role rename, add menu item for creating a role, support role deletion - (83472c5)
• Prevent editing contents of generated columns in data grid - (9ecdff0)
• Basic support for MariaDB user roles, loaded without SQL error and shown with a different icon - (3249401)
• Add context menu item for deleting a single query from the history - (0035d5e)
• Reset a table's current auto_increment value in "delete + insert data" mode - (0422bb3)
• Support cancelling server login dialog - (e5b9574)
• Keep EXPLAIN output format traditional, on newer MySQL servers - (90f9937)
• Make HTML export dark/light mode aware - (dc046e9)
• Allow setting database to in PostgreSQL connections, and show and in the pulldown selector - (950e2ca)

🚀 Enhancements

• Disable plugin selector as long as no user was selected - (54dd7d8)
• Do not copy default type and value from previous column when adding columns to a table - (42a061d)
• Suppress dialog for saving modified SQL on app close, when tabs get auto-restored - (4ca01d9)
• Remove FLUSH PRIVILEGES from the user managers FormShow handler. If a click on a non-flushed user in the tree produces an exception, that is caught and shown as a normal error message. - (fe7a5ef)
• 50% black grid lines, should fit on both light and dark theme - (1872916)
• Increase supported table size and row limit for quick filter menu showing distinct values - (48eca57)

🐛 Bug Fixes

• (ui) Filter away vertical writing fonts with an @ prefix - (1814ee9)
• (ui) Size and margin of buttons on SQL help dialog - (61bc258)
• (ui) Apply the same larger tree node height on Linux - (c770406)
• (ui) Remove default "add user" event from add button, turn it into a pure dropdown button - (d7910c1)
• Copy table dialog crashes when none of dbtree and listtables has Focused=True - (9216061)
• Prefer SHOW KEYS over SHOW INDEXES, which are synonyms, while very old servers only accept the one with KEYS - (b97122c)
• Prevent grid queries from doing "WHERE intcol::text = 1", due to "1" being incompatible to the text value on the left - (bcea889)
• Vulnerability CVE-2025-70873, updating SQLite libs to v3.53.1 - (2930be8)
• Complaint about invalid password length on user plugins which have no fixed password length - (510b141)
• SUBSTRING() on array typed VARCHARs throw "function substr(...) does not exist" - (5f2959d)
• MS SQL throws "Cannot drop database xyz, because it is currently in use" when user is about to drop the current database - (fa2bb05)
• Wrong tab order after inserting new checkbox in the middle - (59d4f1f)
• Space missing in CREATE TABLE code of PG table with SERIAL column - (1633c33)
• Quick filter prompts on numbers break WHERE clause through local formatting - (e7646a0)
• Restore displayed session name in message dialog caption, was removed in commit:63028518f8b0d5869383d3bc0c42f188851797ed - (a6d6e70)
• Missing bottom anchor on shortcuts tree - (f8c4bde)
• Broken ci compilation for Windows - (570fab1)
• Broken ci compilation, move -WB -WR linker options to the conditionals section of the lpi file - (97ec20b)
• Turn exception in ParseViewStructure into a log message - (7562a1e)
• Data grid filter cut with several double-dash comments on one line - (dac7b0e)
• Hidden input box for line terminator in csv import dialog - (f20d634)
• Mouse click in edited row calls save action although focus did not change - (b8313e5)
• SSH command line tweaks, patch from jarczakpawel - (454571e)
• Broken compilation due encoding update to utf-8: ellipsis char constant seen as string now, instead of char - (26b9696)
• Replace hardcoded Windows directory separator with DirectorySeparator - (41615e6)
• Explicitly set client encoding on PG connection - (79c5e4c)
• MSSQL foreign key lookup to include table schema - (305534d)
• Wrong ENUM column type detection, due to less strict regex - (e731fd0)
• Do not start edit mode in ListTables on right mouse button click - (89ccbac)
• Staying on current table by click on "follow foreign key" when the foreign table lives in a different database - (8643172)
• Some crashes found in uploaded crash reports - (7bed735)
• Enable save button after changing default role per combobox - (508b139)
• Support backtick quoted user roles, and some other TValueListEditor related bug fixes - (86ea19c)
• A few compiler warnings - (c6dffe1)
• Pre-select nothing in BOOL grid cell editor on PostgreSQL - (1895959)
• Allow non existent SQLite files, only complain when its path does not exist - (02cf4cb)
• Solution for #2431 breaks other stuff, reverting a part of it - (e940863)
• Editing table data on mysql versions without generated column support - (32f3e6b)
• EAbort crash when copying text from SynEdit without a highlighter - (6c219b9)
• Missing anchors and autosize in user manager form - (91b90bc)
• Reset tree refresh marker earlier, so SetActiveDatabase triggers events and hides the table + data tab after dropping tables - (d2c9c96)
• Prevent crash due to unsupported edit-database feature on MS SQL - (68aeb96)
• Clear data grid before indicating a broken or temporary table for which we get no columns from IS.COLUMNS - (b4ec223)
• Populate SSH executable combo with only a global "ssh" command, do not add .exe files on Linux and macOS - (37f57ce)
• Call to non existent inherited constructor version of TSQLBatch - (b2f4d5b)
• TSQLBatch using backslash for escaping single quotes on all server types. Introduce server type specific TSQLBatch.FEscape char. - (e9af525)
• Crash in SQL export to database for zero length SQL, plus upgrade old-style string handling - (056b5e9)
• Do not delete selected SQL text from editor when trying to focus the position of erroneous SQL - (f5c5f33)
• Crash after canceling query - (ee16571)

🚜 Refactor

• Convert remaining latin1 unit to utf-8 - (85fb0bd)
• Sync from master - (9727d53)
• Revert most of what I did for #2424 - (3d547fd)
• Prefer qAutoInc in SQLProvider over dedicated AutoIncName method - (2fbb779)
• Simplify some more calls to Query() with the overloaded variants - (b0ab0fc)
• Convert more TFeatureOrRequirement's to TQueryId - (9f21853)

Localize

• Update compiled .mo translation files - (53f95d2)

Contributors

• @ansgarbecker

New Contributors ❤️

• @jonathanp12 made their first contribution

Bump version for v12.18 release