The Stable channel has been updated to 153.0.8010.47/.48 for Windows and Mac and 153.0.8010.47 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log 

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 42 security fixes. Please see the Chrome Security Page for more information.

[N/A][556870863] Critical CVE-2026-91726: Out of bounds read in WebGL. Reported by Google on 2026-09-03 [TBD][557320614] Critical CVE-2026-91721: Use after free in Internals. Reported by xinyang on 2026-09-04 [TBD][558456602] Critical CVE-2026-91749: Use after free in Workers. Reported by WinD39 - Huynh Dinh Vu on 2026-09-08 [$1,500][552283275] High CVE-2026-91724: Use after free in Input. Reported by Hafiizh on 2026-08-25 [$1,000][556715288] High CVE-2026-91728: Integer overflow in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-03 [N/A][516780835] High CVE-2026-91734: Incorrect authorization in Core. Reported by Google on 2026-05-26 [N/A][516893912] High CVE-2026-91727: Incorrect reference resolution in Extensions. Reported by Google on 2026-05-26 [N/A][516947138] High CVE-2026-91743: Race condition in Core. Reported by Google on 2026-05-27 [N/A][520019273] High CVE-2026-91744: Race condition in PlatformIntegration. Reported by Google on 2026-06-04 [N/A][521486621] High CVE-2026-91712: Race condition in Extensions. Reported by Google on 2026-06-08 [N/A][521559611] High CVE-2026-91748: Race condition in Extensions. Reported by Google on 2026-06-09 [N/A][523470135] High CVE-2026-91720: Uninitialized resource in ANGLE. Reported by Google on 2026-06-13 [N/A][523554372] High CVE-2026-91731: Type confusion in Compositing. Reported by Google on 2026-06-13 [N/A][540016074] High CVE-2026-91747: Use after free in Skia. Reported by Google on 2026-07-28 [N/A][540021213] High CVE-2026-91733: Improper state validation in Skia. Reported by Google on 2026-07-28 [TBD][546413288] High CVE-2026-91741: Type confusion in CacheStorage. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-14 [TBD][547815507] High CVE-2026-91709: Type confusion in ServiceWorker. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17 [TBD][549225472] High CVE-2026-91717: Missing authorization in Android. Reported by jodyritonga on 2026-08-20 [N/A][552416113] High CVE-2026-91735: Incorrect authorization in WebUI. Reported by Google on 2026-08-25 [N/A][553115724] High CVE-2026-91708: Race condition in Network. Reported by Google on 2026-08-26 [N/A][553121008] High CVE-2026-91736: Use after free in DOM. Reported by Google on 2026-08-26 [N/A][553122373] High CVE-2026-91740: Uninitialized resource in Skia. Reported by Google on 2026-08-26 [N/A][553132148] High CVE-2026-91710: Use after free in WebAppInstalls. Reported by Google on 2026-08-26 [N/A][553133215] High CVE-2026-91718: Use after free in Core. Reported by Google on 2026-08-26 [N/A][554558368] High CVE-2026-91716: Use after free in Auth. Reported by Google on 2026-08-29 [N/A][556260782] High CVE-2026-91746: Integer overflow in Compositing. Reported by Google on 2026-09-02 [TBD][557206809] High CVE-2026-91729: Use after free in DigitalCredentials. Reported by sean geofrey on 2026-09-04 [TBD][558036280] High CVE-2026-91737: Use after free in PDF. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722) on 2026-09-06 [TBD][558342353] High CVE-2026-91711: Out of bounds write in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [TBD][558367547] High CVE-2026-91715: Type confusion in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [N/A][558734727] High CVE-2026-91745: Use after free in V8. Reported by Google on 2026-09-08 [TBD][474131239] Medium CVE-2026-91723: Race condition in WebAppInstalls. Reported by Luan Herrera (@lbherrera_) on 2026-01-07 [TBD][511062248] Medium CVE-2026-91732: Missing authorization in AppManifest. Reported by pakhunov.anton.n on 2026-05-08 [N/A][513858387] Medium CVE-2026-91742: Confused deputy in PriceTracking. Reported by Google on 2026-05-16 [N/A][517710554] Medium CVE-2026-91714: Observable discrepancy in Fonts. Reported by Google on 2026-05-29 [N/A][518032534] Medium CVE-2026-91725: Observable discrepancy in CSS. Reported by Google on 2026-05-29 [N/A][521951328] Medium CVE-2026-91739: Missing authorization in Transactions Platform. Reported by Google on 2026-06-09 [N/A][523715133] Medium CVE-2026-91713: Missing authorization in Browser. Reported by Google on 2026-06-14 [N/A][536450979] Medium CVE-2026-91738: Improper input validation in ANGLE. Reported by Google on 2026-07-19 [TBD][543640868] Medium CVE-2026-91730: Incomplete cleanup in GetUserMedia. Reported by Keita Sode and Daisuke Hatakeyama (SYZD Research) on 2026-08-07 [TBD][554953456] Medium CVE-2026-91722: Use after free in Input. Reported by TIENPA on 2026-08-31 [TBD][542115030] Low CVE-2026-91719: Code injection in XML. Reported by Zabith Mohammed (@nmzabith) on 2026-08-03

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

 The Extended Stable channel has been updated to 152.0.7977.130 for Windows and Mac which will roll out over the coming days/weeks.

New

• Firefox on macOS can now be set to open automatically when the computer starts up, from the Startup section of Settings.

• Localized Wikipedia and occasional sponsored suggestions in the address bar are now available in France, Germany, and Italy. These suggestions can be turned off in Firefox Suggest settings.

Fixed

• Fixed an issue where dragging an image to a new position in a rich-text editor could replace it with a long line of text instead of moving it.

• Fixed high-sample-rate FLAC audio in MP4 failing to play on sites such as Bilibili.

• Fixed subtitles not appearing in the Picture-in-Picture window when they are turned on in the video player after the window has already opened.

• Fixed bookmarks moving out of their folder when the folder and the bookmarks inside it were selected and dragged together in the Bookmarks sidebar.

• Fixed the find bar becoming permanently unavailable in a tab after reversing the panes in Split View.

• Fixed some sites failing to load when DNS over HTTPS is enabled and the site does not support HTTPS.

• Fixed Firefox losing all network connectivity for some users with the built-in VPN enabled.

• Fixed an issue on Windows where Firefox could block an auto-hiding taskbar from showing.

• Various security fixes.

Changed

• Firefox's built-in PDF viewer now starts up to 45% faster.

• Improved memory and CPU usage when Firefox displays large JPEG images scaled down to fit a page.

• On Windows devices with ARM64 processors, WebRTC video calls may now use hardware H264 decoding instead of falling back to software.

Enterprise

• You can find information about policy updates and enterprise-specific bug fixes in the Firefox for Enterprise 156 Release Notes.

Developer

• Developer Information

Web Platform

• text-box-trim now uses the font metrics of a ::first-line pseudo-element when one applies, matching other browsers and the specification.

Community Contributions

• With the release of Firefox 156, we are pleased to welcome the developers who contributed their first code change to Firefox in this release, 10 of whom were brand new volunteers! Please join us in thanking each of these diligent and enthusiastic individuals, and take a look at their contributions:

  • Aaron Ma: 2063818
  • Dominik Bay [:eimann]: 2066736
  • ExplodingJoysticks: 1728637, 1890400, 1910664, 1928343, 1944206, 2000658, 2003000, 2059911, 2061541
  • Gopalarathnam Venkatesan: 2003172, 2042426, 2062096, 2062952, 2062989
  • Hugo Osvaldo Barrera: 2063808
  • Kana: 2062133
  • Kerissa Grubb: 2042422
  • Louis-Philippe Manette: 2062972, 2063867
  • Seunghyun An: 2063033
  • William McDonald: 1034964

❗ This is a pre-release

• May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

• fix(muya): make a code block a diagram when its language is a diagram language (#5060) by @Jocs in #5304
• docs: fix the macOS alias path in the CLI docs by @Jocs in #5308
• chore: run only eslint --fix on staged desktop TS/Vue files by @Jocs in #5318
• fix(desktop): ignore line-ending menu updates for a closed window (#4923) by @Jocs in #5319
• fix: #4926 prevent emoji deletion from splitting surrogate pairs by @Renakoni in #4931
• fix(desktop): keep exported links working from folders named with #, ? or % by @Dev-next-gen in #5320
• fix(desktop): explain the max width format in preferences (#5331) by @Jocs in #5334
• fix(muya): delete emoji whole in code blocks and drop the caret-inside-cluster handler (#4926) by @Jocs in #5332
• fix(desktop): keep exported images working from folders named with #, ? or % (#5335) by @Jocs in #5337
• fix(muya): regex search freezes on zero-width patterns and splits emoji by @Jocs in #5333
• fix(desktop): keep the share host in exported links from UNC documents (#5336) by @Jocs in #5338
• fix: #4899 keep trailing content out of the child list when outdenting a list item by @doktorigi in #4913
• fix(muya): keep the link popover open when moving between links (#5313) by @anandghegde in #5324
• fix: reuse image on case-insensitive path match (#3119) by @dzid26 in #5326
• fix(desktop): name copied images after their content, not their path (#5344) by @Jocs in #5346
• fix(muya): only outdent a paragraph that sits in a nested list item (#5342) by @Jocs in #5345
• fix(muya): split the list when outdenting a task item into a plain list (#5341) by @Jocs in #5348
• fix(muya): edit a footnote definition as its own container (#5340, #5343) by @Jocs in #5347
• fix(muya): keep a Tab-indented list item out of a sublist of the other kind (#5349) by @Jocs in #5354
• fix(muya): preserve ordered list source markers by @Renakoni in #4776

New Contributors

• @Dev-next-gen made their first contribution in #5320
• @anandghegde made their first contribution in #5324
• @dzid26 made their first contribution in #5326

Full Changelog: v0.20.0-rc.2...v0.20.0-rc.3