❌

Normale weergave

Stable Channel Update for Desktop

29 September 2026 om 23:18

The Stable channel has been updated to 154.0.8037.92/.93 for Windows and Mac and 154.0.8037.92 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log


Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 32 security fixes. Please see the Chrome Security Page for more information.

[TBD][551673541] Critical CVE-2026-102331: Buffer overflow in ANGLE. Reported by @mfx on 2026-08-24
[N/A][517312707] High CVE-2026-102317: Improper privilege management in Mojo. Reported by Google on 2026-05-28
[TBD][551668264] High CVE-2026-102312: UI misrepresentation in Omnibox. Reported by jodyritonga on 2026-08-24
[N/A][556789073] High CVE-2026-102313: Uninitialized resource in ANGLE. Reported by Google on 2026-09-03
[TBD][556908674] High CVE-2026-102299: Type confusion in V8. Reported by Andrew Boni on 2026-09-04
[N/A][556926296] High CVE-2026-102306: Use after free in Bluetooth. Reported by Google on 2026-09-04
[N/A][556959073] High CVE-2026-102307: Uninitialized resource in Dawn. Reported by Google on 2026-09-04
[TBD][559266114] High CVE-2026-102323: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-10
[N/A][559727039] High CVE-2026-102303: Uninitialized resource in GPU. Reported by Google on 2026-09-10
[N/A][559737160] High CVE-2026-102311: Uninitialized resource in GPU. Reported by Google on 2026-09-10
[TBD][560062638] High CVE-2026-102300: Uninitialized resource in WebGPU. Reported by Arni Hardarson (Neonix Security) on 2026-09-11
[TBD][560233248] High CVE-2026-102326: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-11
[TBD][560238698] High CVE-2026-102316: Use after free in Views. Reported by Xinyang Ge on 2026-09-11
[TBD][560251736] High CVE-2026-102304: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-11
[TBD][560536732] High CVE-2026-102328: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-12
[TBD][560867085] High CVE-2026-102309: Use after free in FullScreen. Reported by sean geofrey on 2026-09-13
[N/A][561994362] High CVE-2026-102325: Uninitialized resource in Skia. Reported by Google on 2026-09-15
[N/A][561997480] High CVE-2026-102308: Use after free in Views. Reported by Google on 2026-09-15
[N/A][562004351] High CVE-2026-102301: Out of bounds write in GPU. Reported by Google on 2026-09-15
[N/A][562042411] High CVE-2026-102319: Uninitialized resource in GPU. Reported by Google on 2026-09-15
[TBD][562174487] High CVE-2026-102324: Use after free in PictureInPicture. Reported by Blockian Creator of Kritt and Open-Kritt on 2026-09-15
[N/A][562279351] High CVE-2026-102318: Out of bounds read in WebGL. Reported by Google on 2026-09-16
[TBD][563297615] High CVE-2026-102329: Cross-site scripting in WebUI. Reported by chipsec on 2026-09-18
[N/A][563351482] High CVE-2026-102315: Uninitialized resource in Media. Reported by Google on 2026-09-18
[N/A][563716534] High CVE-2026-102302: Buffer overflow in V8. Reported by Google on 2026-09-19
[TBD][565328105] High CVE-2026-102321: Type confusion in V8. Reported by Taisic Yun (@taisic_) of Theori, with Xint on 2026-09-23
[TBD][554038924] Medium CVE-2026-102320: Missing authorization in CORS. Reported by Anonymous on 2026-08-28
[$1,000][477726837] Low CVE-2026-102310: Missing authorization in Payments. Reported by Autodidact on 2026-01-22
[N/A][496212975] Low CVE-2026-102327: Incorrect authorization in WebView. Reported by Google on 2026-03-25
[N/A][498793976] Low CVE-2026-102330: Incorrect authorization in SiteIsolation. Reported by Google on 2026-04-02
[N/A][514059780] Low CVE-2026-102314: UI misrepresentation in TabStrip. Reported by Google on 2026-05-17
[N/A][533021953] Low CVE-2026-102305: UI misrepresentation in SignIn. Reported by Google on 2026-07-09

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.


Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Srinivas Sista

Google Chrome
  •  

Extended Stable Update for Desktop

29 September 2026 om 20:38

The Extended Stable channel has been updated to 152.0.7977.149Β for Windows and Mac which will roll out over the coming days/weeks.

A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista
Google Chrome
  •  

Firefox 157.0

29 September 2026 om 16:10

New

  • Screenshot of Firefox visual refresh

    Firefox's biggest visual refresh in years is now available, with a modernized look across the browser toolbars, sidebar, menus and individual features, built with our updated design system. It also includes:

    • New built-in themes with light and dark versions, to personalize the look of Firefox in one click.
    • A new compact mode that reduces toolbar and tab spacing to leave more room for web content, useful on smaller screens and in split-screen layouts.
  • WebRTC video calls can now use hardware AV1 decoding on devices that support it, instead of always decoding AV1 video in software.

  • Firefox now shows a warning in the site information panel (the shield icon in the address bar) and in Settings when it has been set up to record its encryption keys, which could let other software on the computer read encrypted web traffic.
    Screenshot of TLS interception UI

  • Firefox Suggest now offers suggestions in the address bar in Austria, Belgium, Czech Republic, Denmark, Finland, Hungary, Ireland, Luxembourg, Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, and Switzerland. They can be controlled in the Firefox Suggest settings. Learn more.

Fixed

  • Fixed video from phones and tablets appearing sideways or upside down in WebRTC calls.

  • Fixed the address bar searching for the typed text instead of opening the selected suggestion when a page was still loading, such as shortly after Firefox started.

  • Fixed some HDR videos encoded in 8-bit color formats looking dull and gray on Windows instead of displaying in HDR.

  • Improved audio and video synchronization when repeatedly changing the playback speed of videos, for example on YouTube.

  • Fixed the Vertical Tabs sidebar not reappearing when the cursor moves to the edge of the screen in full screen mode.

  • Fixed an issue on Windows where making a video full screen would leave the Windows taskbar showing over the video.

  • Various security fixes.

Changed

  • Pressing Tab now moves focus straight to the text field of the address bar and search bar instead of stopping on the search engine button first. The button can still be reached with Shift+Tab.

  • Amazon is no longer included as a built-in search engine. It can still be added as a custom search engine in the search settings. Learn more.

  • The updated sidebar is now enabled for everyone. Anyone still using the previous sidebar will keep a similar layout, with the panel switcher at the top of the sidebar. Additionally, the β€œShow sidebar” option has been removed from Settings.

    While we continue to refine the new design, the previous sidebar version can still be restored by setting sidebar.revamp to false in about:config. This also turns off vertical tabs. The preference will remain available until the end of 2027.

  • Web page alert(), confirm() and prompt() dialogs, the color and date pickers, and form autocomplete drop-downs now match the page's light or dark color scheme.

Enterprise

Developer

Web Platform

  • Firefox now supports the at-rule() function for @supports. This allows authors to detect browser support for specific at-rules, such as @supports at-rule(@scope).

  • Firefox now supports the chain value for the CSS overscroll-behavior property.

Community Contributions

  •  

v0.20.0-rc.7

29 September 2026 om 13:54

❗ This is a pre-release

  • May contain bugs and unfinished features.

⚠️ Note for macOS users

Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:

xattr -cr /Applications/marktext.app

Verifying downloads

All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:

sha256sum -c SHA256SUMS.txt --ignore-missing

What's Changed

  • fix: restore code block legibility and text crispness (#5539) by @Jocs in #5553
  • test: fold the two #5539 specs into one by @Jocs in #5557
  • fix(muya): keep a hard line break's glyph on the line it ends (#2094) by @Jocs in #5556
  • revert: keep grayscale antialiasing on editor text (#5539) by @Jocs in #5558
  • fix(muya): keep sequence diagram arrowheads in exported PDFs (#2423) by @Jocs in #5561
  • fix(muya): pair emphasis delimiters the way CommonMark does (#2086) by @Jocs in #5555
  • fix(muya): parse link destinations the way CommonMark does (#2377) by @Jocs in #5562
  • Add a zoom/pan viewer and image export for rendered diagrams by @Jocs in #5554
  • fix: give the editor and Preferences windows their own menu bar (#2245) by @Jocs in #5560
  • perf(muya): re-render only the two affected blocks when stepping through search (#5580) by @ycyc0421 in #5569

New Contributors

Full Changelog: v0.20.0-rc.6...v0.20.0-rc.7

  •  
❌