โŒ

Normale weergave

2026.6: Pick a card, any card

3 Juni 2026 om 02:00

Home Assistant 2026.6! ๐ŸŽ‰

Iโ€™m going to put my hand up right away: โœ‹ I am not a dashboard person. Not because I donโ€™t like them; I love seeing what you all build. But designing a beautiful one is a kind of visual creativity I just donโ€™t have. Thatโ€™s a big part of why I love the built-in Home dashboard so much, it does the designing for me. But when I do build a custom dashboard, I usually stare at that โ€œadd a cardโ€ dialog for way too long, picking cards almost at random just to see if they look good with the data I have.

So you can imagine my excitement for my personal favorite of this release: the new card picker. Instead of asking โ€œwhich card type do I want?โ€, it now asks โ€œwhich thing in your home do you want to show?โ€, and then suggests cards that actually make sense for it, with live previews using your own data. For someone like me, thatโ€™s not just easier; itโ€™s genuinely inspiring. It nudges me towards combinations I would not have thought of on my own. ๐Ÿ’ก

This fits into a bigger direction I keep getting more excited about: Home Assistant getting better at starting from the thing you want to do, instead of asking you to first learn the building blocks. The same idea is what makes purpose-specific triggers and conditions in Home Assistant Labs feel so right, and this release brings them a big step closer to graduating out of Labs with brand new zone triggers and conditions. ๐Ÿ“

A close second favorite for me this release is everything happening around that in the automation editor: live test indicators on your conditions, target counts on every device, area, floor, and label, and proper notes you can attach to any step. Individually they are small quality-of-life touches; together, they make building automations feel a whole lot more transparent. โœจ

And there is plenty more to love in this release: new tile card features, Z-Wave smart locks catching up with their Matter siblings, a friendlier Apps page, and another big batch of new integrations from our community. ๐Ÿš€

Enjoy the release!

../Frenck

A huge thank you to all the contributors who made this release possible! And a special shout-out to @piitaya who helped write the release notes this release. Also, @karwosts, @lexpostma, and @Petro31 for putting effort into tweaking its contents. Thanks to them, these release notes are in great shape. โค๏ธ

A friendlier way to add cards to your dashboard

Adding a card to a dashboard is one of those moments where Home Assistant has historically asked a lot of you. The old dialog opened on a wall of card types, all named after the building blocks we use under the hood: tile, entities, button, gauge, glance, picture, markdown, and so on. Lovely if you already know what each one does. A lot less lovely if you came in thinking โ€œI just want my living room light on this dashboard.โ€ ๐Ÿ’ก

User research kept telling us the same thing: people open the editor with a deviceA device is a model representing a physical or logical unit that contains entities. or an entityAn entity represents a sensor, actor, or function in Home Assistant. Entities are used to monitor physical properties or to control other entities. An entity is usually part of a device or a service. [Learn more] in mind, not a card type. So we flipped the dialog around.

When you add a card now, the dialog opens on a new By entity tab. On the left, your home: a tree of floorsA floor in Home Assistant is a logical grouping of areas that are meant to match the physical floors in your home. Devices & entities are not assigned to floors but to areas. Floors can be used in automations and scripts as a target for actions. For example, to turn off all the lights on the downstairs floor when you go to bed. [Learn more], areasAn area in Home Assistant is a logical grouping of devices and entities that are meant to match areas (or rooms) in the physical world: your home. For example, the living room area groups devices and entities in your living room. [Learn more], devices, and entities, the same shape some of you may recognize from the new purpose-specific triggers and conditions currently in Settings > System > Labs. Anything that doesnโ€™t fit cleanly into your areas shows up under Unassigned, so nothing gets lost. Search jumps straight to a flat result list.

Pick an entity, and the right side fills with live previews of cards that actually fit it, not a generic list:

  • For a light, you get a plain tile, a tile with a brightness slider, a toggle tile, color temperature, and favorite colors.
  • For a cover, open/close, a position slider, and tilt.
  • For a media player, a tile with playback controls or with the volume slider.
  • For a numeric sensor like temperature, humidity, or power, a trend graph tile so you can see history at a glance.
  • For a calendar or to-do list, the matching dedicated card.
  • And a Browse all cards option in case none of those is what you wanted; the familiar By card tab is still there too, unchanged.

Every suggestion renders as a real preview of how the card will look on your dashboard, with your data, before you pick it. No more โ€œadd it, see how it looks, delete it, try the next one.โ€

Custom cards can join the party too. If a custom card you have installed has opted in to the new picker, its suggestions show up under a separate Community section, right below the built-in ones. Support depends on the custom cardโ€™s author adding it.

On mobile, the same dialog turns into a two-step flow: pick your entity, then pick your card.

Screenshot of the new add card dialog with an entity tree on the left and live card previews on the right.

This is the first visible step of a broader effort on the Open Home Foundation roadmap to make building a dashboard feel as natural as building an automation: start from what you want to control, and let Home Assistant suggest the rest. Expect more in this direction in the releases to come.

Tip

Maintain a custom card? You can opt in to the new picker by adding a getEntitySuggestion function to your window.customCards entry. The developer blog post Custom card suggestions in the card picker walks through the details.

Infrared now also listens

Two releases ago, infrared became a first-class citizen of Home Assistant, but as a one-way street: Home Assistant could send commands to your TV or air conditioner, but it had no way to hear what the device, or its original remote, was doing. The most asked-for follow-up was simple: โ€œcan Home Assistant also listen?โ€ ๐Ÿ“ก

In this release, it does.

The Infrared platform gains a new receiver event entityEvents are signals that are emitted when something happens, for example, when a user presses a physical button like a doorbell or when a button on a remote control is pressed. [Learn more]. Any transmitter integration that supports it can expose the IR commands it picks up as events in Home Assistant, ready to drive automations just like any other event trigger. ESPHome is the first transmitter integration on board, so any ESPHome device with an IR receiver wired up can now act as an IR listener for your whole house. On the device side, LG Infrared is the first device integration to use it, exposing the commands its receiver sees as events you can react to.

This means you can keep Home Assistant in sync with the original remote: use the remote that came with the device, and Home Assistant sees it happen instead of being left in the dark with stale state. It also opens the door for future integrations to do more with what they hear, like turning a spare IR remote into a Home Assistant controller.

This is the second half of the infrared story we started two releases ago, making infrared a true two-way platform in Home Assistant. It also closes out the Open Home Foundation roadmap opportunity that set out to make infrared a two-way platform in Home Assistant.

Polishing the automation editor

Ever since Home Assistant 2025.12 introduced purpose-specific triggers and conditions, every release has nudged the automation editor a little closer to how you actually think about your home. The work in Labs is ongoing, and feedback keeps pouring in. While we keep iterating there, the rest of the automation editor has been getting some love too. โœจ

Purpose-specific triggers and conditions

The Labs preview keeps growing, both in capabilities and polish. This release picks up where last month left off: the cross-domain successors to the old Person and Device Tracker home triggers and conditions have landed, this time built around zones. ๐Ÿ“

Four new zone triggers and four new zone conditions cover the same ground the removed entered_home, left_home, is_home, and is_not_home building blocks did, but in a more flexible way:

  • Triggers to react when a person or device trackerDevice trackers are used to track the presence, or location, of a device. [Learn more] enters or leaves a zoneZones allow you to specify certain regions on a map. They enable zone presence-detection and can be used in automations. For example, to start the vacuum after you left home or start the heating at home when you leave the office. [Learn more], and when a zone becomes occupied or empty.
  • Conditions to check whether a person or device tracker is in or not in a zone, or whether a zone is currently occupied or not.

Youโ€™re no longer limited to your home zone: any zone youโ€™ve defined works, so reacting to someone arriving at work, school, or the gym is just as straightforward. Both triggers and conditions support the for duration field added last release, so you can wait until someone has actually settled in (or out) before doing anything.

Weโ€™ve also been busy giving the existing triggers and conditions the documentation they deserve. About half of the purpose-specific triggers and conditions now have their own dedicated reference page over at triggers and conditions, with examples, options, and the small details that make a real difference when you are wiring things up. The rest are on their way.

Havenโ€™t tried them yet? Now is a great time. Enable the feature at Settings > System > Labs, give it a spin, and let us know what you think. The more feedback we collect, the sooner we can graduate this out of Labs.

See exactly how many things an automation targets

When you build an automationAutomations in Home Assistant allow you to automatically respond to things that happen in and around your home. [Learn more] that acts on a floorA floor in Home Assistant is a logical grouping of areas that are meant to match the physical floors in your home. Devices & entities are not assigned to floors but to areas. Floors can be used in automations and scripts as a target for actions. For example, to turn off all the lights on the downstairs floor when you go to bed. [Learn more], an areaAn area in Home Assistant is a logical grouping of devices and entities that are meant to match areas (or rooms) in the physical world: your home. For example, the living room area groups devices and entities in your living room. [Learn more], a labelLabels in Home Assistant allow grouping elements irrespective of their physical location or type. Labels can be assigned to areas, devices, entities, automations, scenes, scripts, and helpers. Labels can be used in automations and scripts as a target for actions. Labels can also be used to filter data. [Learn more], or a device, the editor used to just show the name of that target. So โ€œBedroomsโ€ could mean three lights, or thirty, with no way to tell at a glance.

Now every floor, area, device, and label pill in your automation rows shows the number of entities it expands to, right next to its name. If your target selector also filters by domain or device class, the count reflects that filter, so what you see is what the action will actually touch. Select the pill for a quick peek at exactly which entities are included.

It is the kind of small detail that turns โ€œI hope this only hits the right lightsโ€ into โ€œyep, twelve, thatโ€™s correctโ€, especially handy as your home grows or you start using labels across rooms.

Screenshot of an automation row showing the number of entities next to each device and area target.

See at a glance which conditions pass

Conditions are the gatekeepers of your automations. They decide whether something runs or not, and when an automation doesnโ€™t fire the way you expected, the first question is usually: โ€œwhich condition was actually blocking it?โ€ Until now, finding out meant testing each condition one by one, or waiting for the next run and digging through the trace afterwards.

The automation editor now tells you right there, while you are editing. Every condition row shows a small live test indicator as a badge on its icon that updates in real time as your home changes:

  • A green check when the condition currently passes
  • A red circle when it doesnโ€™t
  • A neutral state when the condition is incomplete or canโ€™t be evaluated yet
  • A clear error indicator, with the full message in a tooltip, when the configuration is invalid

Hover the icon to see exactly what the condition is reporting. Edit the condition, and the badge updates immediately, so you can dial in thresholds, zones, or state matches and see the result without leaving the editor. The same indicators also show up on dashboard visibility conditions, so the cards you hide or show conditionally tell you the same story.

Screenshot of an automation condition row with a live test indicator badge on the condition icon.

This is part of a broader roadmap effort to bring home context into the automation editor: surfacing the information you need to build and debug automations right where you are working on them.

Add notes to any step in your automation

Aliases are great for renaming a trigger or action, but they have always been a single line, and they double as the label you see in the row. So if you wanted to explain why a step exists (โ€œthe porch sensor sometimes triggers on its own in winter, so this waits a few seconds to make sureโ€), you were out of luck without dropping into YAML.

Every triggerA trigger is a set of values or conditions of a platform that are defined to cause an automation to run. [Learn more], conditionConditions are an optional part of an automation that will prevent an action from firing if they are not met. [Learn more], actionActions are used in several places in Home Assistant. As part of a script or automation, actions define what is going to happen once a trigger is activated. In scripts, an action is called sequence. [Learn more], option, and scriptScripts are components that allow you to specify a sequence of actions to be executed by Home Assistant when turned on. [Learn more] field now has a dedicated Notes field, separate from its name. Open the stepโ€™s sidebar, jot down whatever future-you needs to know, and it stays with that step forever. We deliberately called it notes and not comments to keep it clear from YAML comments, which are a different thing entirely.

Notes travel with the automation when you duplicate, export, or share it as a blueprintA blueprint is a script, automation, or template entity configuration with certain parts marked as configurable. This allows you to create multiple scripts, automations, or template entities based on the same blueprint, with each having its own configuration-specific settings. Blueprints are shared by the community on the blueprints exchange in the forum. [Learn more], so the reasoning behind a setup is no longer something only the original author remembers.

Screenshot of an automation trigger row with a small note icon, showing the note in a tooltip on hover.

Tile card features

The tile card keeps growing into one of the most capable building blocks in your dashboards. This release adds two brand-new card features for weather entities and a generous round of additions to the media player tile.

Your forecast, right where you check the weather

Most of us already have a weather tile sitting somewhere on a dashboard. Up until now, the moment you wanted to know what tomorrow looks like, you had to open the more info dialog, jump to a different card, or build a whole forecast section just for that. No more.

Two new tile card features put the forecast directly onto your existing weather tile:

  • Temperature forecast draws a bar chart of high and low temperatures for the days ahead, colored from cool cyan to deep red so you can read the week at a glance. In the hourly view, it renders as a smooth filled curve.
  • Precipitation forecast shows how much rain (or snow) is expected for each slot, or, when your weather service only provides it, the chance of precipitation.

Both features automatically pick the best forecast resolution your weather service offers (daily, twice-daily, or hourly), and you can pin a specific resolution or toggle the day and hour labels from the card editor. One small change, big difference: your dashboard now answers the next question before you ask it.

Screenshot of weather tile cards showing the temperature and precipitation forecast features.

Turning the media player tile into a real remote

Last release was a big step for the media player tile: a proper source picker, a sound mode picker, and playback buttons you could finally pick and reorder. Lots of you ran with it and built beautiful, focused media controls on your dashboards, and some of you immediately came back with: โ€œthis is great, but can it alsoโ€ฆโ€ ๐ŸŽถ

This release fills in those last gaps. Across the media player tile card features, you now have:

  • A Mute button on both the Volume slider and Volume buttons features, so you can silence the room straight from the tile.
  • Shuffle, Repeat, Volume up, Volume down, and Mute as extra controls you can mix into the Playback feature, alongside the existing transport buttons.
  • A filter for the Source and Sound mode dropdowns, so a receiver that reports two dozen inputs only shows the three you actually use.

The result: a single tile that looks like, and acts like, a remote built specifically for that device. No more โ€œalmost rightโ€ tiles, no more falling back to the more info dialog for that one button you really need. Your Music Assistant setup is going to feel right at home. Thanks, @pcan08 and @MindFreeze!

Screenshot of a media player tile card showing the new mute, shuffle, repeat, and volume controls together with a filtered source dropdown.

Z-Wave smart lock credential management

Two releases ago, we added credential management for MatterMatter is an open-source standard that defines how to control smart home devices on a Wi-Fi or Thread network. [Learn more] smart locks: a friendly dialog to add, edit, and remove the users (and the PIN codes that go with them) that your lock accepts, without ever opening the lockโ€™s own app. This release, Z-Wave smart locks get the same treatment. ๐Ÿ”

Open your lock from the device page and select Manage access from the menu to get an overview of every user the lock has, and the credentials assigned to them. From there, you can add a new user, give existing ones extra credentials, edit them, or remove them. If you try to reuse a PIN that is already in use on the lock, the dialog will warn you instead of silently overwriting it. Everything happens directly between Home Assistant and your lock over Z-Wave; no cloud account, no vendor app, no internet connection required.

Screenshot of a Z-Wave smart lock device page with the new Manage access option in the menu.

There is one small difference with the Matter version that plays to Z-Waveโ€™s strengths: both PIN codes and passwords are supported, where the lock supports them. PIN codes are limited to digits (the familiar keypad experience), while passwords accept the full character set for locks with an alphanumeric keypad.

Screenshot of the Add user dialog for a Z-Wave smart lock, with fields for the user name, a PIN code / Password credential type selector, and a PIN code input.

Just like the Matter equivalent, every action behind the dialog is also available as a regular Home Assistant actionActions are used in several places in Home Assistant. As part of a script or automation, actions define what is going to happen once a trigger is activated. In scripts, an action is called sequence. [Learn more]. That means you can hand out a one-time PIN to a guest from an automation, rotate codes on a schedule, or wipe a lost user with a single button press on your dashboard.

A fresh look for the Apps page

Apps (previously known as add-ons) are how you extend the system that Home Assistant runs on with extra software, like a media server, an MQTT broker, a VPN, or a code editor, all running right next to Home Assistant on the same device.

This release gives the Apps page a friendlier, more modern look. Every installed app is shown as its own card with its icon, name, a short description, and a clear indicator of whether it is running, so you can spot the state of your apps at a glance.

Screenshot of the refreshed Apps page, showing installed apps as cards with their icon, name, description, and status.

Installed apps can now also carry small tags that highlight what they are, making it easier to scan your list and find what you are looking for. The app detail page got the same care, with a cleaner layout that also works well on a tablet.

Integrations

Thanks to our community for keeping pace with the new integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] and improvements to existing ones! Youโ€™re all awesome ๐Ÿฅฐ

New integrations

We welcome the following new integrations in this release:

  • AiDot, added by @s1eedz
    Control your AiDot Wi-Fi smart lights, including A19 and BR30 bulbs, directly from Home Assistant. Communication happens locally over your network, so no cloud connection is required.

  • CentriConnect/MyPropane, added by @gresrun
    Keep an eye on your propane tank from Home Assistant. The integration connects to the centriconnect.com cloud service to expose the level and status of tanks equipped with a MyPropane monitor, perfect for getting a notification before you run out.

  • Cielo Home, added by @ihsan-cielo
    Control your Cielo smart air conditioner and heat pump controllers from Home Assistant, contributed by Cielo themselves. Connects through the Cielo Connect cloud API and exposes each device as a climate entity, so you can adjust modes and temperatures alongside the rest of your home automations.

  • Data Grand Lyon, added by @Crocmagnon โ€” launching at ๐Ÿ† platinum quality
    Bring open data from the city of Lyon, France, into Home Assistant. Track upcoming departure times at TCL public transit stops, and monitor real-time bike and dock availability at Vรฉloโ€™v bike-sharing stations.

  • Guntamatic, added by @JensTimmerman โ€” launching at ๐Ÿฅˆ silver quality
    Monitor your Guntamatic wood or pellet heater locally from Home Assistant. The integration reads sensor data directly from the heaterโ€™s web interface over your local network, with no cloud account needed.

  • LG TV via Serial, added by @balloob โ€” launching at ๐Ÿฅˆ silver quality
    Control your LG TV locally from Home Assistant over its built-in RS-232 serial port. Works through a direct serial cable, a USB-to-serial adapter, or an ESPHome-based serial proxy, giving you a reliable connection that even works while the TV is in standby. Great for older sets without smart features and for commercial signage displays.

  • Marantz Infrared, added by @balloob โ€” launching at ๐Ÿฅˆ silver quality
    Control your Marantz amplifier with any infrared transmitter you already have set up in Home Assistant. Built on top of the Infrared entity platform, so you can pair it with an ESPHome device with an IR LED, or any other supported IR emitter, and operate your amplifier without depending on the network or cloud.

  • Mitsubishi Comfort, added by @nikolairahimi
    Bring Mitsubishi Electric ductless minisplit heat pump and air conditioning systems into Home Assistant. The integration talks directly to each indoor unit over your local network for low-latency control, and only uses the Kumo Cloud account for the initial device discovery and credential retrieval. Kumo Station outdoor units are supported for temperature monitoring.

  • Ouman EH-800, added by @Markus98
    Connect your Ouman EH-800 heating controller to Home Assistant. Monitor and control your heating system locally with climate, number, select, sensor, and valve entities, perfect for automating your homeโ€™s heat distribution.

  • OVHcloud AI Endpoints, added by @Crocmagnon Add a conversation agent powered by OVHcloud AI Endpoints to Home Assistant. Pick from a curated catalog of open-weight large language models hosted in Europe, and use them with Assist to control your home and answer questions.

  • PAJ GPS, added by @skipperro
    Track the location of your PAJ GPS devices on the map in Home Assistant. The integration creates a device tracker entity for each tracker in your PAJ account, so you can build automations around their location, like notifications when a tracker arrives home or leaves a zone.

  • PTDevices, added by @frogman85978
    Monitor your PTLevel water level sensors in Home Assistant. Get notifications when tanks run low or are being used unexpectedly, and build automations to turn off pumps when levels drop or run appliances once water has been delivered.

  • Samsung Infrared, added by @lmaertin
    Control your Samsung TV with any infrared transmitter you already have set up in Home Assistant. Like the Marantz Infrared integration, it builds on the Infrared entity platform, so you can use an ESPHome device with an IR LED, or any other supported IR emitter, to operate your TV.

  • Vistapool, added by @fdebrus Monitor and control your Hayward-branded pool controllers from Home Assistant, including AquaRite, Vistapool, Sugar Valley, Poolwatch, Kripsol, and Dagen devices. The integration uses the official Hayward cloud API with real-time push updates, so changes show up instantly without polling.

  • Xthings Cloud, added by @zhangluofeng
    Control your Xthings smart home devices, starting with the U-tec Bright A19 Color smart light bulb, through the Xthings Cloud service. Contributed by Xthings themselves, with real-time status updates delivered over WebSocket push, so the state in Home Assistant stays in sync with whatโ€™s happening on your devices.

  • Yoto, added by @piitaya
    Control your Yoto audio players from Home Assistant. Play and pause cards, change the volume, skip and seek tracks, and see what is currently playing. The integration connects to your Yoto account and receives live playback updates, so changes that happen on the player show up in Home Assistant almost immediately.

Noteworthy improvements to existing integrations

It is not just new integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] that have been added; existing ones are also being constantly improved. Here are some of the noteworthy changes to existing integrations:

  • MQTT picked up two improvements: a new message expiry interval option, and subentry support extended to the date, datetime, and time entity platforms. Thanks, @jbouwh!
  • Shelly now exposes an occupancy binary sensor. Thanks, @bieniu!
  • Sonos got search, so you can now find tracks, albums, and artists across your music services straight from Home Assistant. Thanks, @PeteRager!
  • Reolink battery cameras can now connect directly to Home Assistant, without needing a Reolink Home Hub or NVR as a bridge. Not all models and features are supported yet; using a Home Hub or NVR remains the preferred method. A battery camera cannot be connected both ways at the same time. Thanks, @starkillerOG!
  • Tuya received a wave of device-specific improvements: number entities and fault codes for the Pro Breeze OmniDr dehumidifier, water-timer data points and a countdown number for the sfkzq single-valve timers, additional entities for cameras, a number entity for the WG2 alarm panel (Duosmart C30), total production sensor support for SPM02 devices, and support for the InverGo inverter pool heat pump. Thanks, @peterlang-p, @mik-laj, @davidXire, @tbouron, @ChayoteJarocho, and @focabr!
  • SwitchBot had a great release with broad device support: the Permanent Outdoor Light, Weather Station, and Lock Vision (Pro) / Lock Pro Wifi are now supported, the Meter CO2 gained a display time offset number entity, and the Air Purifier now exposes its LED settings. Thanks, @elgris, @Onero-testdev, and @zerzhang!
  • SmartThings TVs now let you select the input source, and Copper water meters expose their sensors. Thanks, @felipecrs and @joostlek!
  • Alexa Devices got two big additions: a new media player platform that exposes your Echo devices as media players, with playback, volume, and mute controls, and a new event entity that surfaces the voice commands your Echo hears so you can react to them in automations. Thanks, @jamesonuk and @chemelli74!
  • Anthropic Claude conversations now support the web fetch tool, allowing the model to retrieve and reason about live web content. Thanks, @Shulyaka!
  • Google Nest added a nest.set_fan_timer action, so you can script your thermostatโ€™s fan timer right from Home Assistant. Thanks, @tronikos!
  • HomeWizard updated charging strategies with support for their new smart charging feature, and two new battery group sensors: target power and group power. Thanks, @DCSBL!
  • UniFi Protect added an alarm profile select entity, letting you switch between alarm profiles directly from Home Assistant. Thanks, @RaHehl!
  • FRITZ!SmartHome now ships data descriptions for all configuration fields, making setup easier to understand. Thanks, @mib1185!
  • Viessmann ViCare RadiatorActuator devices now expose a target temperature sensor. Thanks, @lackas!
  • Cambridge Audio receivers now expose a volume limit, so you can prevent overly loud playback. Thanks, @noahhusby!
  • Nord Pool picked up a binary sensor for price-based automations. Thanks, @gjohansson-ST!
  • YouTube channels now expose a video count sensor. Thanks, @nathan-osman!
  • OneDrive added a delete action so you can clean up files from your automations. Thanks, @leodrivera!
  • WeatherFlow Cloud stations now expose dedicated station-level sensors. Thanks, @jeeftor!
  • Portainer continues to grow: new system health and disk space coordinators, and recreate-container service actions. Thanks, @erwindouna!
  • Ohme EV chargers got two new controls: a state of charge input number and a solar boost switch. Thanks, @dan-r!
  • Jewish Calendar now exposes a calendar entity, perfect for tracking Jewish holidays and Shabbat in your dashboards and automations. Thanks, @tsvi!
  • BleBox picked up several improvements: a new update platform that exposes installed and latest firmware versions and lets you trigger firmware updates straight from Home Assistant, plus tilt-only mode and 180-degree tilt support for cover and shutter entities. Thanks, @bkobus-bbx!
  • PrusaLink 3D printers gained more sensors: X/Y axis position, location, minimum extrusion temperature, plus SD ready, farm mode, and connection status binary sensors. Thanks, @heikkih!
  • System Bridge gained a notify entity, so you can send desktop notifications from your automations. Thanks, @tr4nt0r!
  • Indevolt battery support expanded significantly with new battery temperature, MOS temperature, main MOS temperature, cycle count, transformer temperature, and real-time control sensors. Thanks, @Xirt and @karlbeecken!
  • Qube heat pump added a water heater entity for domestic hot water control (with a boost mode for using surplus energy), plus switches for summer mode, anti-legionella cycle, heating curve, and heating demand. Thanks, @MattieGit!
  • Eurotronic Comet Blue thermostats added a number platform exposing the eco and comfort setpoints and the temperature offset, so you can fine-tune your schedule without leaving the dashboard. Thanks, @rikroe!
  • Elk-M1 Control picked up dedicated number entities for the Elkโ€™s configurable settings (such as timers), previously buried inside a single sensor. Thanks, @gwww!
  • Control4 now supports motorized window treatments through a new cover platform. Thanks, @nayfield!
  • IMGW-PIB added river vegetation cover sensors for emergent, floating, and submerged vegetation. Disabled by default, so you can enable just the ones you need. Thanks, @bieniu!
  • Watts Vision + received HVAC action and preset mode support, plus a new timer mode service. Thanks, @theobld-ww!
  • Kiosker gained a switch to disable the screensaver, plus a set of buttons for common kiosk actions: navigate forward, backward, and home; clear cache and cookies; print; ping; and interact with the screensaver. Thanks, @Claeysson!
  • V2C EV chargers now expose their LED lights. Thanks, @dgomes!
  • Lunatone DALI lighting controllers now expose their device status as sensors. Thanks, @MoonDevLT!
  • Satel Integra alarm zones now expose temperature sensors. Thanks, @Tommatheussen!
  • Template entities now support the device tracker platform, giving you a modern replacement for the device_tracker.see action that was deprecated last release. Thanks, @Petro31!

Integration quality scale achievements

One thing we are incredibly proud of in Home Assistant is our integration quality scale. This scale helps us and our contributors to ensure integrations are of high quality, maintainable, and provide the best possible user experience.

This release, we celebrate several integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] that have improved their quality scale:

This is a huge achievement for these integrations and their maintainers. The effort and dedication required to reach these quality levels is significant, as it involves extensive testing, documentation, error handling, and often complete rewrites of parts of the integration.

A big thank you to all the contributors involved! ๐Ÿ‘

Now available to set up from the UI

While most integrationsIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] can be set up directly from the Home Assistant user interface, some were only available using YAML configuration. We keep moving more integrations to the UI, making them more accessible for everyone to set up and use.

The following integrations are now available via the Home Assistant UI:

Farewell to the following

The following integrationIntegrations connect and integrate Home Assistant with your devices, services, and more. [Learn more] is also no longer available as of this release:

  • Konnected has been removed. The legacy Konnected.io integration was deprecated in Home Assistant 2025.10 and is now removed. To keep using your Konnected hardware, follow the migration guide from Konnected to flash your device with ESPHome firmware.

Other noteworthy changes

There are many more improvements in this release; here are some of the other noteworthy changes:

  • A friendlier setup for MatterMatter is an open-source standard that defines how to control smart home devices on a Wi-Fi or Thread network. [Learn more] devices. When you add any Matter device, Home Assistant now asks you to name it and assign it to an area right away, so it is ready to use the way you intend from the first moment. For contact sensors and covers, you can also pick what the device is attached to (a door, window, garage door, or something else). On iOS, the pre-filled name and device class selection require an upcoming iOS app update; until then, the previous behavior is used.
  • OpenThread Border Router 1.4 is out of beta. The OpenThread Border Router app now ships ThreadThread is a low-power mesh networking standard that is specifically designed for smart home applications. It is a protocol that defines how devices communicate. [Learn more] 1.4 by default, no beta toggle required. For now, this is mostly about bug fixes and stability, including the new built-in mDNS implementation from OpenThread, which should help resolve a class of stubborn Thread connectivity issues that previously traced back to mDNS quirks in some home routers. It also lays the groundwork for bringing the new Thread 1.4 features to Home Assistant in the near future.
  • Sirens join the Matter integration. Matter sirens (like Heiman-style smoke detectors that double as a loud alarm) are now exposed as proper siren entitiesAn entity represents a sensor, actor, or function in Home Assistant. Entities are used to monitor physical properties or to control other entities. An entity is usually part of a device or a service. [Learn more] you can switch on and off from automations and dashboards. Thanks, @lboue! ๐Ÿšจ
  • Bluetooth proxies are now much friendlier to battery-powered devices. Until now, every Bluetooth scanner ran in active mode, constantly polling devices and waking up your battery-powered Bluetooth sensors and trackers more often than they need to. Starting this release, the default for both the Bluetooth integration and ESPHome Bluetooth proxies is the new Auto mode, which switches to active scanning only when an integration actually needs it, and only on one scanner at a time. The result: around 95โ€“96% less battery used for Bluetooth scanning, while everything keeps working the way it did. The Bluetooth UI catches up too, labeling each adapter as Auto (active) or Auto (passive), and the device info dialog gained a Raw advertisement field for debugging. More on the default change in the backward-incompatible changes section.
  • Firmware version in the devices table. The Devices page gets a hidden-by-default Firmware column you can switch on from the table options, making it easy to check whether a firmware update actually landed without changing the default layout. Thanks, @markvp!
  • A friendlier ZHA group page. The ZHA group create and edit screens have been rebuilt around a compact, card-based layout that keeps your devices and group settings visible together, instead of one long table you had to scroll through. Thanks, @jpbede!
  • Search by label in more places. The data tables for helpersA helper is a virtual entity you create inside Home Assistant. It is not backed by a physical device. Helpers store values, track state, or do calculations that your automations and dashboards need. [Learn more], automations, scenes, and scripts now let you filter by labelLabels in Home Assistant allow grouping elements irrespective of their physical location or type. Labels can be assigned to areas, devices, entities, automations, scenes, scripts, and helpers. Labels can be used in automations and scripts as a target for actions. Labels can also be used to filter data. [Learn more], matching the search bar that devices and entities already had. Thanks, @ildar170975!
  • The backup encryption key is harder to miss. Home Assistant already creates a backupHome Assistant has built-in functionality to create files containing a copy of your configuration. This can be used to restore your Home Assistant as well as migrate to a new system. The backup feature is available for all installation types. [Learn more] automatically before every update, but that backup is only useful if you can still decrypt it. The Backup settings page has been reorganized to put your encryption key front and center, with a clear reminder to save it somewhere safe. Losing that key is one of the most painful ways to lose access to a backup, so we want to make sure you donโ€™t.
  • Color customization for graph cards. The statistics graph card and history graph card now let you pick a custom color per entity, both from the visual editor and in YAML. Thanks, @ildar170975!
  • Advanced mode is gone. The Advanced mode toggle on your user profile, and every feature that used to hide behind it, is now retired. We have been peeling away its gates release by release; this release finishes the job. A single toggle was never a great fit: it bundled unrelated features together and quietly suggested some parts of Home Assistant were only for โ€œadvancedโ€ users. Neither is true. Everything that used to live behind it is now simply available to everyone by default. More background in the Open Home Foundation roadmap.

A clearer view of your homeโ€™s energy

Two quality-of-life upgrades land in the energy dashboard this release. โšก

If you have a home battery, you can now hook up its state-of-charge sensor (the percentage one) right from Settings > Dashboards > Energy. Once it is set, the Battery node on the energy distribution card shows the current charge level alongside the energy flowing in and out, and a matching battery badge appears at the top of the energy panel so you can see at a glance how full your battery is, without leaving the dashboard. Thanks, @MindFreeze!

Screenshot of the energy distribution card showing the battery node with a 100% state-of-charge value.

The other addition is small but long-requested: you can now give your grid, solar, battery, gas, and water sources a custom name in the energy configuration. So instead of โ€œGrid consumptionโ€ and โ€œGrid returnโ€, you can call them โ€œMain meterโ€ and โ€œSolar exportโ€, or whatever makes sense for your home. The names flow through to the cards, charts, and statistics, making multi-source setups (like a separate EV meter or a second water tap) far easier to tell apart. Thanks, @karwosts!

Quick links between everything you care about

Home Assistant is full of things that are related to each other: a device has entities, those entities show up in automations and scripts, automations live in areas, areas have labels, and so on. Getting from one to the next used to mean a lot of back-and-forth between settings pages.

This release threads a generous set of quick links through those views so you can jump straight to the related thing, or create a new one without losing your place:

  • Device pages now bundle related automations, scriptsScripts are components that allow you to specify a sequence of actions to be executed by Home Assistant when turned on. [Learn more], and scenesScenes capture the states you want certain entities to be. For example, a scene can specify that light A should be turned on and light B should be bright red. [Learn more] into a single Related card (instead of three separate ones), and the existing quick links section gains shortcuts to all the other places that reference the device.
  • Area pages got the same treatment, with quick links into the tables and dashboards that already filter by that area in a single step.
  • From an entity, device, or area, you can now create a new automation or script with that target already wired into a trigger, condition, or action, no copy-pasting entity IDs required. (This piece rides on top of the purpose-specific triggers and conditions Labs preview, so enable it at Settings > System > Labs to see the option.)
  • Label navigation actions now include scenes and scripts alongside automations, so a label like โ€œmorning routineโ€ surfaces everything tagged with it, not just a subset.

Individually these are small. Together they make Home Assistant feel even more connected than it already was, with fewer detours between the pages. Thanks, @timmo001!

Screenshot of the new Add to dialog on a device page, offering shortcuts to create an automation as a trigger, condition, or action, a script, or a scene.

YAML linting inside the UI editors

A small quality-of-life improvement that should not go unnoticed. You donโ€™t need to know or use YAML to use Home Assistant, but if you like it, or want to dive into more specific use cases, we give you the power to do so.

The YAML code editors throughout the UI now show inline linting: missing colons, unmatched quotes, and yes, that one space too many or too few in your indentation (we know, we know ๐Ÿ˜…), are all highlighted as you type, right next to the line that causes them. No more saving, hitting an obscure error, and scrolling back to find the cause.

Screenshot of the YAML editor showing inline linting with an error highlighted on the offending line.

Patch releases

We also release patch releases for Home Assistant Core. These patch releases are released on a weekly basis (on Fridays) and contain bug fixes and small improvements.

2026.6.1 - June 5

2026.6.2 - June 9

Need help? Join the community

Home Assistant has a great community of users who are all more than willing to help each other out. So, join us!

Our very active Discord chat server is an excellent place to be, and donโ€™t forget to join our amazing forums.

Found a bug or issue? Please report it in our issue tracker to get it fixed! Or check our help page for guidance on more places you can go.

Are you more into email? Sign up for the Open Home Foundation Newsletter to get the latest news about features, things happening in our community, and other projects that support the Open Home straight into your inbox.

Backward-incompatible changes

We do our best to avoid making changes to existing functionality that might unexpectedly impact your Home Assistant installation. Unfortunately, sometimes it is inevitable.

We always make sure to document these changes to make the transition as easy as possible for you. This release has the following backward-incompatible changes:

Purpose-specific triggers (Labs)

The behavior options for the Labs purpose-specific triggers have been renamed to better match what they do: any is now each, and last is now all. The default is now each.

If you have automations that use these triggers from the Labs preview at Settings > System > Labs, open them in the automation editor and re-pick the behavior option. Any YAML you wrote against the old keys needs to be updated to the new names.

(@emontnemery - #172348)

Bluetooth

The default Bluetooth scanning mode has changed to Auto, which dynamically switches between active and passive scanning depending on what is happening. This saves around 95-96% of the battery used for Bluetooth scanning while keeping the same functionality for most setups.

If you run into issues after the upgrade, you can switch your Bluetooth adapter back to Active scanning. Go to Settings > Devices & services, open the Bluetooth integration, and select Configure on your adapter to change the scanning mode.

(@bdraco - #171985) (Bluetooth documentation)

Certificate Expiry

The error attribute on the certificate expiry sensor now returns a proper None value instead of the string "None" when there is no error.

If you use this attribute in templates, update your comparisons from == "None" to is none.

(@TomFilsell - #170878) (Certificate Expiry documentation)

ESPHome

The default Bluetooth proxy scanning mode for ESPHome devices is now Auto. Devices that were previously set to Active are automatically migrated to Auto, while devices set to Passive keep their setting.

If you need Active scanning for a specific device, change it back in the device options under Settings > Devices & services.

(@bdraco - #171996) (ESPHome documentation)

HDMI-CEC

Calling the turn_off action on HDMI-CEC switch or media player entities now sends the standard CEC standby command instead of a vendor-specific power-off command. This works more reliably across devices from different manufacturers.

If you relied on the previous behavior, you can send the original command using the hdmi_cec.send_command action with keypress 0x44 followed by 0x6c.

(@pattyland - #170206) (HDMI-CEC documentation)

IronOS

The uptime sensor for IronOS soldering irons has changed from a duration sensor (reporting seconds) to a timestamp sensor that reports when the device was started.

Update any automations or dashboards that read this sensor to work with the new timestamp format.

(@tr4nt0r - #169699) (IronOS documentation)

ONVIF

When you call the onvif.ptz action with continuous_duration: 0, the integration no longer sends a Stop command after the ContinuousMove. This lets you start a continuous movement and stop it later with a separate call.

If your automations rely on the camera stopping automatically, set continuous_duration to the desired duration in seconds.

(@yoxcu - #163173) (ONVIF documentation)

Shelly

Shelly devices used as Bluetooth scanners now support the new Auto scanning mode. Existing devices set to Active are automatically migrated to Auto for better battery and performance.

You can change the scanning mode back in the device options under Settings > Devices & services.

(@bdraco - #172008) (Shelly documentation)

SmartThings

The source attribute on SmartThings media players is now normalized to standard Home Assistant values. For example, D.IN is now reported as digital_input and BT as bluetooth.

If you use the source attribute in automations, dashboards, or templates, update them to match the new values.

(@felipecrs - #160034) (SmartThings documentation)

Template entities

The legacy template platform syntax under the individual platform keys has been removed. This syntax was deprecated in Home Assistant 2025.12 and has now reached the end of its 6-month deprecation period.

This affects the following platforms:

  • alarm_control_panel
  • binary_sensor
  • cover
  • fan
  • light
  • lock
  • sensor
  • switch
  • vacuum
  • weather

Move your template entities to the modern template: syntax. A step-by-step migration guide is available in the Removal of legacy template entities forum thread.

(@Petro31 - #169608, #169610, #169611, #169613, #169615, #169725, #169728, #169730, #169732, #169734) (Template documentation)

Tuya

The unit of measurement provided by the Tuya API now takes precedence over the default unit assigned by Home Assistant. This makes the reported value match what the Tuya app shows.

If your device reports an invalid or unexpected unit, please submit a bug report with the device details and the unit it reports and adjust it accordingly.

(@epenet - #170338) (Tuya documentation)

Velux

The deprecated velux.reboot_gateway action has been removed. Use the reboot button entity on your Velux gateway instead.

(@wollew - #169796) (Velux documentation)

If you are a custom integration developer and want to learn about changes and new features available for your integration: Be sure to follow our developer blog. The following changes are the most notable for this release:

All changes

Of course, there is a lot more in this release. You can find a list of all changes made here: Full changelog for Home Assistant Core 2026.6.

  •  

Ben Hutchings: FOSS activity in May 2026

2 Juni 2026 om 16:17

This was a particularly busy month for me in terms of Debian contributions.

It started with a week in Hamburg for the MiniDebConf. I talked to many colleagues face-to-face and worked on various bugs and maintenance tasks. Iโ€™m pleased to have finally found the time to reproduce and fix the boot-time crashes in the parallel port subsystem that have been reported many times recently.

A series of easily exploited kernel LPE (local privilege execution) issues were published this month, mostly with very little coordination with distributions. Salvatore and I had to upload fixes for these at roughly weekly intervals. All of these fixes needed to be applied to 4 different upstream branches (currently 5.10, 6.1, 6.12, and 7.0) and 7 Debian branches (including backports).

  •  

Distribution Release: T2 Linux SDE 26.6

3 Juni 2026 om 14:10
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. T2 Linux SDE is an independently-developed open-source system development environment (or distribution build kit). It enables the creation of custom distributions with bleeding-edge technology. The project's latest release, version 26.6, polishes the KDE Plasma build and expands RISC-V support. "This T2/Linux release continues to polish our flagship KDE....
  •  

v5.47.1

3 Juni 2026 om 14:26

5.47.1 (2026-06-03)

๐Ÿ”ฅ Bug fix

  • deleteMany respects filters combined with relation (#25420)
  • improve i18n plugin translations (#22714)
  • resolve ajv ReDoS vulnerability by forcing ajv@8.18.0 (#26141)
  • admin: use ISO 639-1 da for Danish admin locale (#26322)
  • content-manager: documentId(s) shown for relation when entry title set to numeric field (#25622)
  • content-manager: guard repeatable field .map() crash on relationโ€ฆ (#26421)
  • content-manager: fix frontend validation if not using "draft and publish" (#25300)
  • core: skip session secret check for API-only apps (#26390)
  • data-transfer: preserve core store when config stage is excluded (#26484)
  • deps: upgrade koa-session to v7.0.2 (#26140)
  • homepage: homepage count-documents slow on large D&P tables (#26370)
  • i18n: preserve non-localized field inheritance (#26367)
  • strapi: preserve tsbuildinfo across develop restarts (#26264)
  • upgrade: simplify registry URL resolution (#25027)

๐Ÿ“š Documentation Changes

  • security: overhaul vulnerability reporting policy (#26393)

โš™๏ธ Chore

  • admin: remove punycode dependency (#26189)
  • deps: bump axios from 1.16.0 to 1.16.1 (#26456)
  • deps: bump express-rate-limit from 8.2.1 to 8.5.2 (#26457)
  • deps: bump @hono/node-server from 1.19.9 to 1.19.14 (#26458)
  • deps: bump qs from 6.15.0 to 6.15.2 (#26417)
  • deps: bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4 (#26256)
  • deps: bump hono from 4.11.9 to 4.12.23 (#26455)
  • deps: bump @tootallnate/once from 2.0.0 to 2.0.1 (#26218)
  • docs: migrate docusaurus config to typescript (#26471)
  • mcp: clarify registration lifecycle and simplify error messages (#26517)
  • upload: remove aiMetadataJobsCleanup cron job (#26442)

๐Ÿ’… Enhancement

  • core: lazy-load node-schedule and umzug at boot (#26267)
  • core: eliminate @strapi/typescript-utils from boot path (#26270)
  • core/core: lazy-load typescript-utils in Strapi and compile (#26266)
  • strapi: hash-cache peer-dep check; demote env-vars log to debug (#26269)
  • strapi: lazy-require worker-only deps in dev primary (#26268)

โค๏ธ Thank You

  •  

Emmanuel Kasper: Running Linux i386 binary (steamcmd) via debootstrap foreign chroot

3 Juni 2026 om 10:50

The Steam command line client, which I need to download the game data for the Doom3 BFG shooter, is only available as an Linux i386 binary. As my main home computer is an arm64 box, this could be an issue, but today we have no less than three different ways to run a Linux i386 binary on arm64: Fex, Box32/64 and the older qemu-user mode. According to the Box64 benchmarks, qemu-user is the slowest of the three. But since this is only to run a command line tool downloader, where network speed is the bottleneck, this doesnโ€™t matter a lot.

Running steamcmd outside of a chroot via qemu-user and dpkg multiarch support was failing me with the error i386-binfmt-P: Could not open '/lib/ld-linux.so.2': No such file or directory even after installing the i386 libc. So I went the way of qemu-user and a chroot environment, a bit more convoluted but I can run any i386 binaries there in the future.

Create a debian-i386 chroot environment via deboostrap:

$ sudo apt install qemu-user qemu-user-binfmt debootstrap
$ fakeroot debootstrap --foreign --arch=i386 debian-i386
$ sudo chroot debian-i386
# inside the chroot 
# /debootstrap/debootstrap --second-stage 
# exit

Add needed mounts to run binaries inside the chroot:

$ sudo mount --bind /dev/ debian-i386/dev/
$ sudo mount --bind /dev/pts debian-i386/dev/pts
$ sudo mount -t proc none  debian-i386/proc/

Install steamcmd in the chroot client:

$ sudo chroot debian-i386

# export LANG=C
# cat /etc/apt/sources.list
deb http://deb.debian.org/debian stable main contrib non-free
# apt update && apt install --yes steamcmd 
# useradd --create-home --shell /bin/bash steam
# su - steam
$ steamcmd 
... will download an updated version of the tool, and print a lot of tracing information

Steam> quit

From now on you can follow the Doom3 BFG instructions to download the game data.

Once you exit the chroot, the game data will be available at debian-i386/home/steam/

  •  

Lang leve Europa, lang leve Ferrari | POM S11E36

Claude gedraagt zich opeens als een paternalistische betweter en Google's Whoop-kloon roept de noodtoestand uit na drie glazen wijn, compleet met dagenlange strafpreken over een te zware fietssessie. Maar het echte verhaal gaat over Ferrari, dat met de elektrische Luce voor het eerst een vijfpersoonsauto maakt die er volgens half de wereld verschrikkelijk goedkoop uitziet, ontworpen door Jony Ive's LoveFrom voor 185 miljoen euro per jaar. Toch zit er een meesterplan achter: die bak van een half miljoen is niet voor de petrolheads maar voor Chinese miljonairs en techbro's die een auto als software zien. Ferrari verkoopt amper 13.000 auto's per jaar met een marge van 30 procent en houdt zijn exclusiviteit kunstmatig overeind via een loyaliteitsscore waar je bijna niet in komt. De conclusie: zo blijft Europa relevant, door je nostalgie overboord te kieperen en te maken wat techmiljonairs en Chinezen mooi vinden. Daarnaast de vraag waarom niemand een journalistieke deep dive ร  la Acquired voor het Nederlandse nieuws maakt, terwijl dat format elk luisterboek de grond in trapt. En het inzicht dat YouTube overdag groter is dan Netflix, podcasters de nieuwe tv-sterren zijn, en Jay Shetty een deal van 100 miljoen dollar tekende met Spotify en Netflix.

Wil je 18 september ook luisteren naar het verhaal van Steven Bartlett en zijn merk Steven.com? Tickets voor het Amsterdam Business Forum vind je op DenkProducties.nl

Meer te weten te komen over Carbon Equity? Lees dan verder op carbonequity.com

En interesse in het sponsoren van Podcast over Media? Laat dan hier je gegevens achter, dan komen we bij je terug.



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.pom.show

๐Ÿ’พ

  •  

v1.19.0

2 Juni 2026 om 23:49

New major features

Media-over-QUIC

  • support reading and publishing with Media-over-QUIC (#5815) Media-over-QUIC is a streaming protocol built upon cutting edge protocols (QUIC, HTTP3) and browser APIs (WebTransport, WebCodecs). It's slightly faster than WebRTC, has an advanced data recovery mechanism, it supports additional codecs (FLAC) and is less complicated to route. Check the documentation for instructions and details.

RTMP

  • support reading and writing FLAC (#5778) (#5789)

HLS

  • support reading and publishing FLAC (#5778) (#5791)

Fixes and improvements

General

  • Add user agent field to RTMP, RTSP, WebRTC, and HLS (#5753)
  • add --check-version command line flag (#5786) this allows to check whether a new version is available without upgrading.
  • use file name suffix for OS-specific code wherever possible (#5787)
  • fix two hot reloading cases (#5817) * reload SRT server when metrics server is reloaded * reload API server when RTMPS server is reloaded

RTSP

RTMP

HLS

WebRTC

  • make JavaScript internal variables private (#5804)
  • fix connectivity after network changes (#5097) (#5818)

RPI Camera

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.72.0 to v0.74.0
  • github.com/abema/go-mp4 updated from v1.5.0 to v1.6.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.3.2 to v2.4.0
  • github.com/bluenviron/gortmplib updated from v0.3.2 to v0.4.0
  • github.com/bluenviron/gortsplib/v5 updated from v5.5.3 to v5.5.4
  • github.com/bluenviron/mediacommon/v2 updated from v2.8.3 to v2.9.0
  • github.com/go-git/go-git/v5 updated from v5.19.0 to v5.19.1
  • github.com/matthewhartstonge/argon2 updated from v1.5.3 to v1.5.4
  • github.com/pion/ice/v4 updated from v4.2.5 to v4.2.7
  • github.com/pion/transport/v4 updated from v4.0.1 to v4.0.2
  • github.com/pion/webrtc/v4 updated from v4.2.12 to v4.2.14
  • golang.org/x/crypto updated from v0.51.0 to v0.52.0
  • golang.org/x/net updated from v0.54.0 to v0.55.0
  • golang.org/x/sys updated from v0.44.0 to v0.45.0
  • github.com/pion/dtls/v3 updated from v3.1.2 to v3.1.3
  • github.com/pion/sctp updated from v1.9.5 to v1.10.0
  • github.com/pion/srtp/v3 updated from v3.0.10 to v3.0.11
  • github.com/pion/stun/v3 updated from v3.1.2 to v3.1.4
  • github.com/pion/turn/v5 updated from v5.0.3 to v5.0.7
  • github.com/quic-go/webtransport-go v0.10.0 added
  • golang.org/x/sync v0.20.0 added
  • github.com/dunglas/httpsfv v1.1.0 added
  • github.com/bluenviron/mediamtx-rpicamera updated from v2.5.7 to v2.6.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  

Stable Channel Update for Desktop

5 Juni 2026 om 00:27

The Chrome team is delighted to announce the promotion of Chrome 149 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.

Chrome 149.0.7827.53 (Linux)ย 149.0.7827.53/54ย Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 149.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenโ€™t yet fixed.


This update includes 429 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.


[$97000][498904293] Critical CVE-2026-10881: Out of bounds read and write in ANGLE. Reported by Anonymous on 2026-04-02

[$43000][503420443] Critical CVE-2026-10882: Use after free in Network. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-17

[$5000][503768143] Critical CVE-2026-10883: Out of bounds write in ANGLE. Reported by Maher Azzouzi on 2026-04-17

[N/A][503617302] Critical CVE-2026-10884: Use after free in Chromecast. Reported by Google on 2026-04-17

[N/A][504072665] Critical CVE-2026-10885: Use after free in Chrome for iOS. Reported by Google on 2026-04-18

[TBD][505096898] Critical CVE-2026-10886: Use after free in FileSystem. Reported by Andrew Boni on 2026-04-21

[N/A][505204771] Critical CVE-2026-10887: Use after free in Chromoting. Reported by Google on 2026-04-22

[N/A][505815080] Critical CVE-2026-10888: Use after free in Cast Streaming. Reported by Google on 2026-04-23

[N/A][513003797] Critical CVE-2026-10889: Out of bounds read in ANGLE. Reported by Google on 2026-05-14

[N/A][513136593] Critical CVE-2026-10890: Use after free in Cast. Reported by Google on 2026-05-14

[N/A][513160681] Critical CVE-2026-10891: Use after free in GFX. Reported by Google on 2026-05-14

[N/A][513165325] Critical CVE-2026-10892: Out of bounds write in GPU. Reported by Google on 2026-05-14

[N/A][513231432] Critical CVE-2026-10893: Use after free in Chromoting. Reported by Google on 2026-05-14

[N/A][513445101] Critical CVE-2026-10894: Use after free in Printing. Reported by Google on 2026-05-15

[N/A][513454018] Critical CVE-2026-10895: Use after free in Ozone. Reported by Google on 2026-05-15

[N/A][513514692] Critical CVE-2026-10896: Use after free in Chrome for iOS. Reported by Google on 2026-05-15

[N/A][513543143] Critical CVE-2026-10897: Out of bounds write in GPU. Reported by Google on 2026-05-15

[N/A][513946753] Critical CVE-2026-10898: Stack buffer overflow in GPU. Reported by Google on 2026-05-17

[N/A][516653777] Critical CVE-2026-10899: Use after free in Ozone. Reported by Google on 2026-05-26

[N/A][516878683] Critical CVE-2026-10900: Use after free in Passwords. Reported by Google on 2026-05-26

[N/A][516957738] Critical CVE-2026-10901: Use after free in Passwords. Reported by Google on 2026-05-27

[N/A][517046249] Critical CVE-2026-10902: Use after free in Ozone. Reported by Google on 2026-05-27

[$11000][503422316] High CVE-2026-10903: Use after free in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-17

[$8000][506855825] High CVE-2026-10904: Inappropriate implementation in V8. Reported by 303f06e3 on 2026-04-27

[$5000][487357841] High CVE-2026-10905: Use after free in Network. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-25

[$3000][503420438] High CVE-2026-10906: Use after free in WebAuthentication. Reported by Weipeng Jiang (@Krace) of VRI on 2026-04-17

[$2000][489071023] High CVE-2026-10907: Out of bounds write in ANGLE. Reported by sweetchip on 2026-03-02

[$2000][505045913] High CVE-2026-10908: Use after free in FullScreen. Reported by Mihnea Nicolau on 2026-04-21

[$1000][508092644] High CVE-2026-10909: Use after free in Dawn. Reported by whiter@xuanyusec on 2026-04-30

[$500][508811477] High CVE-2026-10910: Type Confusion in V8. Reported by Mufeed VH from Winfunc Research (winfunc.com) on 2026-05-02

[N/A][495819067] High CVE-2026-10911: Insufficient validation of untrusted input in Media. Reported by Google on 2026-03-24

[N/A][496614553] High CVE-2026-10912: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-03-26

[N/A][497450927] High CVE-2026-10913: Use after free in ANGLE. Reported by Google on 2026-03-29

[N/A][497574371] High CVE-2026-10914: Use after free in ANGLE. Reported by Google on 2026-03-30

[N/A][497612174] High CVE-2026-10915: Use after free in Core. Reported by Google on 2026-03-30

[N/A][497643690] High CVE-2026-10916: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-03-30

[N/A][497929481] High CVE-2026-10917: Insufficient validation of untrusted input in Media. Reported by Google on 2026-03-30

[N/A][498259721] High CVE-2026-10918: Use after free in Viz. Reported by Google on 2026-03-31

[N/A][498872764] High CVE-2026-10919: Use after free in ANGLE. Reported by Google on 2026-04-02

[N/A][498977444] High CVE-2026-10920: Insufficient validation of untrusted input in WebShare. Reported by Google on 2026-04-02

[N/A][499159695] High CVE-2026-10921: Integer overflow in Dawn. Reported by Google on 2026-04-03

[N/A][499164652] High CVE-2026-10922: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-04-03

[N/A][499423683] High CVE-2026-10923: Use after free in WebAppInstalls. Reported by Google on 2026-04-04

[N/A][500055357] High CVE-2026-10924: Integer overflow in Chromecast. Reported by Google on 2026-04-06

[N/A][500071763] High CVE-2026-10925: Out of bounds write in Skia. Reported by Google on 2026-04-06

[N/A][500075522] High CVE-2026-10926: Use after free in Cast. Reported by Google on 2026-04-06

[N/A][500090141] High CVE-2026-10927: Out of bounds read in Dawn. Reported by Google on 2026-04-06

[N/A][500124367] High CVE-2026-10928: Script injection in Headless. Reported by Google on 2026-04-06

[N/A][500429259] High CVE-2026-10929: Heap buffer overflow in ANGLE. Reported by Google on 2026-04-07

[N/A][500472605] High CVE-2026-10930: Out of bounds read in ANGLE. Reported by Google on 2026-04-07

[TBD][501115599] High CVE-2026-10931: Use after free in FileSystem. Reported by asjidkalam on 2026-04-10

[N/A][501335606] High CVE-2026-10932: Use after free in UI. Reported by Google on 2026-04-10

[N/A][501557633] High CVE-2026-10933: Use after free in Audio. Reported by Google on 2026-04-11

[N/A][501594107] High CVE-2026-10934: Use after free in Autofill. Reported by Google on 2026-04-11

[N/A][501898683] High CVE-2026-10935: Inappropriate implementation in V8. Reported by Google on 2026-04-12

[N/A][502439789] High CVE-2026-10936: Type Confusion in V8. Reported by Google on 2026-04-14

[N/A][502651056] High CVE-2026-10937: Inappropriate implementation in Passwords. Reported by Google on 2026-04-14

[N/A][502681591] High CVE-2026-10938: Insufficient validation of untrusted input in Input. Reported by Google on 2026-04-14

[N/A][503502607] High CVE-2026-10939: Use after free in WebRTC. Reported by Google on 2026-04-17

[N/A][503879873] High CVE-2026-10940: Race in Codecs. Reported by Google on 2026-04-17

[N/A][503958940] High CVE-2026-10941: Out of bounds memory access in Skia. Reported by Google on 2026-04-18

[N/A][504104263] High CVE-2026-10942: Insufficient validation of untrusted input in UI. Reported by Google on 2026-04-18

[TBD][504194151] High CVE-2026-10943: Use after free in WebRTC. Reported by Rayyan Kadar on 2026-04-20

[N/A][504215814] High CVE-2026-10944: Insufficient policy enforcement in Autofill. Reported by Google on 2026-04-19

[N/A][504417768] High CVE-2026-10945: Use after free in PDF. Reported by Google on 2026-04-20

[N/A][504587797] High CVE-2026-10946: Heap buffer overflow in Media. Reported by Google on 2026-04-20

[N/A][504597736] High CVE-2026-10947: Use after free in WebRTC. Reported by Google on 2026-04-20

[N/A][504599749] High CVE-2026-10948: Use after free in WebRTC. Reported by Google on 2026-04-20

[N/A][504644843] High CVE-2026-10949: Heap buffer overflow in Video. Reported by Google on 2026-04-20

[N/A][505123022] High CVE-2026-10950: Insufficient policy enforcement in Autofill. Reported by Google on 2026-04-21

[N/A][505191883] High CVE-2026-10951: Use after free in Autofill. Reported by Google on 2026-04-22

[N/A][505231370] High CVE-2026-10952: Use after free in Chrome for iOS. Reported by Google on 2026-04-22

[N/A][506147564] High CVE-2026-10953: Use after free in Core. Reported by Google on 2026-04-24

[N/A][506150628] High CVE-2026-10954: Use after free in Actor. Reported by Google on 2026-04-24

[N/A][506374676] High CVE-2026-10955: Type Confusion in ANGLE. Reported by Google on 2026-04-25

[N/A][506375731] High CVE-2026-10956: Use after free in MimeHandlerView. Reported by Google on 2026-04-25

[N/A][506377279] High CVE-2026-10957: Use after free in Glic. Reported by Google on 2026-04-25

[N/A][507251069] High CVE-2026-10958: Use after free in Chrome for iOS. Reported by Google on 2026-04-28

[N/A][507258648] High CVE-2026-10959: Use after free in Input. Reported by Google on 2026-04-28

[N/A][507258786] High CVE-2026-10960: Uninitialized Use in Codecs. Reported by Google on 2026-04-28

[N/A][508281950] High CVE-2026-10961: Use after free in Chrome for iOS. Reported by Google on 2026-04-30

[N/A][511006880] High CVE-2026-10962: Type Confusion in Media. Reported by Google on 2026-05-08

[N/A][511218177] High CVE-2026-10963: Integer overflow in V8. Reported by Google on 2026-05-08

[N/A][511228272] High CVE-2026-10964: Integer overflow in V8. Reported by Google on 2026-05-08

[N/A][511290038] High CVE-2026-10965: Integer overflow in DevTools. Reported by Google on 2026-05-08

[N/A][511713779] High CVE-2026-10966: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-05-10

[N/A][511714900] High CVE-2026-10967: Use after free in SurfaceCapture. Reported by Google on 2026-05-10

[N/A][511758373] High CVE-2026-10968: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-10

[N/A][511765713] High CVE-2026-10969: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-10

[N/A][512772489] High CVE-2026-10970: Insufficient validation of untrusted input in InterestGroups. Reported by Google on 2026-05-13

[N/A][513005991] High CVE-2026-10971: Insufficient validation of untrusted input in Printing. Reported by Google on 2026-05-14

[N/A][513006660] High CVE-2026-10972: Use after free in Ozone. Reported by Google on 2026-05-14

[N/A][513042859] High CVE-2026-10973: Uninitialized Use in Dawn. Reported by Google on 2026-05-14

[N/A][513135862] High CVE-2026-10974: Insufficient validation of untrusted input in ANGLE. Reported by Google on 2026-05-14

[N/A][513154132] High CVE-2026-10975: Use after free in WebRTC. Reported by Google on 2026-05-14

[N/A][513249847] High CVE-2026-10976: Uninitialized Use in Dawn. Reported by Google on 2026-05-14

[N/A][513340227] High CVE-2026-10977: Uninitialized Use in Skia. Reported by Google on 2026-05-14

[N/A][513394258] High CVE-2026-10978: Use after free in Chromoting. Reported by Google on 2026-05-15

[N/A][513468021] High CVE-2026-10979: Out of bounds read in ANGLE. Reported by Google on 2026-05-15

[N/A][513713927] High CVE-2026-10980: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-05-16

[N/A][513762354] High CVE-2026-10981: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-05-16

[N/A][513774197] High CVE-2026-10982: Use after free in WebXR. Reported by Google on 2026-05-16

[N/A][513947609] High CVE-2026-10983: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-17

[N/A][514022635] High CVE-2026-10984: Inappropriate implementation in Accessibility. Reported by Google on 2026-05-17

[N/A][514082801] High CVE-2026-10985: Out of bounds read in Skia. Reported by Google on 2026-05-17

[N/A][514744613] High CVE-2026-10986: Integer overflow in Media. Reported by Google on 2026-05-19

[N/A][515431687] High CVE-2026-10987: Integer overflow in V8. Reported by Google on 2026-05-21

[N/A][515465685] High CVE-2026-10988: Use after free in Views. Reported by Google on 2026-05-21

[N/A][516311623] High CVE-2026-10989: Inappropriate implementation in V8. Reported by Google on 2026-05-25

[$4000][506311914] Medium CVE-2026-10990: Use after free in Glic. Reported by Weipeng Jiang (@Krace) of VRI on 2026-04-25

[$3000][503553614] Medium CVE-2026-10991: Use after free in V8. Reported by Alisa Esage (@alisaesage) on 2026-04-17

[$2000][493534964] Medium CVE-2026-10992: Insufficient data validation in Animation. Reported by heapracer (@heapracer) on 2026-03-17

[$2000][504160794] Medium CVE-2026-10993: Heap buffer overflow in Skia. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-04-19

[$2000][504820809] Medium CVE-2026-10994: Uninitialized Use in ANGLE. Reported by Mufeed VH from Winfunc Research (winfunc.com) on 2026-04-21

[$2000][505371980] Medium CVE-2026-10995: Heap buffer overflow in TabStrip. Reported by Sven Dysthe (@svn-dys) on 2026-04-22

[TBD][40051700] Medium CVE-2026-10996: Inappropriate implementation in Workers. Reported by Jayateertha Guruprasad on 2024-12-23

[TBD][464217867] Medium CVE-2026-10997: Insufficient policy enforcement in Extensions. Reported by djallalakira@gmail.com on 2025-11-28

[TBD][486536242] Medium CVE-2026-10998: Out of bounds read in Media. Reported by Ameen Basha M K on 2026-02-22

[TBD][489369089] Medium CVE-2026-10999: Out of bounds memory access in ANGLE. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-04

[TBD][492374380] Medium CVE-2026-11000: Use after free in Fonts. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-13

[N/A][493691489] Medium CVE-2026-11001: Incorrect security UI in Payments. Reported by Google on 2026-03-18

[TBD][494740162] Medium CVE-2026-11002: Use after free in Autofill. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-21

[TBD][494823867] Medium CVE-2026-11003: Use after free in WebRTC. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2026-03-21

[TBD][494823889] Medium CVE-2026-11004: Out of bounds read in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-22

[TBD][495052581] Medium CVE-2026-11005: Out of bounds read in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-22

[N/A][495489174] Medium CVE-2026-11006: Out of bounds read in Dawn. Reported by Google on 2026-03-23

[N/A][495834228] Medium CVE-2026-11007: Insufficient validation of untrusted input in WebView. Reported by Google on 2026-03-24

[N/A][495864099] Medium CVE-2026-11008: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-03-24

[N/A][496233132] Medium CVE-2026-11009: Use after free in USB. Reported by Google on 2026-03-25

[TBD][496266444] Medium CVE-2026-11010: Use after free in WebShare. Reported by David Sievers on 2026-03-26

[N/A][496702621] Medium CVE-2026-11011: Insufficient policy enforcement in Password Manager. Reported by Google on 2026-03-26

[N/A][497000161] Medium CVE-2026-11012: Use after free in Serial. Reported by Google on 2026-03-27

[N/A][497056412] Medium CVE-2026-11013: Insufficient validation of untrusted input in Network. Reported by Google on 2026-03-28

[N/A][497058611] Medium CVE-2026-11014: Insufficient policy enforcement in Extensions. Reported by Google on 2026-03-28

[TBD][497183443] Medium CVE-2026-11015: Out of bounds read in WebGPU. Reported by Yuma Takeuchi on 2026-03-29

[N/A][497278395] Medium CVE-2026-11016: Insufficient validation of untrusted input in Network. Reported by Google on 2026-03-28

[N/A][497336872] Medium CVE-2026-11017: Inappropriate implementation in Link Preview. Reported by Google on 2026-03-29

[N/A][497342466] Medium CVE-2026-11018: Insufficient policy enforcement in Actor. Reported by Google on 2026-03-29

[N/A][497344640] Medium CVE-2026-11019: Inappropriate implementation in Payments. Reported by Google on 2026-03-29

[N/A][497440270] Medium CVE-2026-11020: Inappropriate implementation in Extensions. Reported by Google on 2026-03-29

[N/A][497487755] Medium CVE-2026-11021: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-03-29

[N/A][497532918] Medium CVE-2026-11022: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-03-29

[N/A][497538899] Medium CVE-2026-11023: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-03-29

[N/A][497591594] Medium CVE-2026-11024: Stack buffer overflow in Skia. Reported by Google on 2026-03-30

[N/A][497595264] Medium CVE-2026-11025: Insufficient policy enforcement in Navigation. Reported by Google on 2026-03-30

[N/A][497599683] Medium CVE-2026-11026: Insufficient policy enforcement in Extensions. Reported by Google on 2026-03-30

[N/A][497604407] Medium CVE-2026-11027: Insufficient validation of untrusted input in Glic. Reported by Google on 2026-03-30

[N/A][497627277] Medium CVE-2026-11028: Use after free in Media. Reported by Google on 2026-03-30

[N/A][497651688] Medium CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop. Reported by Google on 2026-03-30

[N/A][497722502] Medium CVE-2026-11030: Use after free in Network. Reported by Google on 2026-03-30

[N/A][497748760] Medium CVE-2026-11031: Insufficient validation of untrusted input in Password Manager. Reported by Google on 2026-03-30

[N/A][497831111] Medium CVE-2026-11032: Insufficient data validation in Password Manager. Reported by Google on 2026-03-30

[N/A][497926664] Medium CVE-2026-11033: Uninitialized Use in WebML. Reported by Google on 2026-03-30

[N/A][497934980] Medium CVE-2026-11034: Insufficient validation of untrusted input in Tab Group Sync. Reported by Google on 2026-03-30

[N/A][497936421] Medium CVE-2026-11035: Insufficient validation of untrusted input in Custom Tabs. Reported by Google on 2026-03-30

[N/A][497964917] Medium CVE-2026-11036: Inappropriate implementation in DOM. Reported by Google on 2026-03-30

[N/A][497971287] Medium CVE-2026-11037: Out of bounds write in Codecs. Reported by Google on 2026-03-31

[N/A][498080391] Medium CVE-2026-11038: Insufficient validation of untrusted input in Subresource Integrity. Reported by Google on 2026-03-31

[N/A][498204112] Medium CVE-2026-11039: Uninitialized Use in Skia. Reported by Google on 2026-03-31

[N/A][498371085] Medium CVE-2026-11040: Use after free in ANGLE. Reported by Google on 2026-04-01

[N/A][498700369] Medium CVE-2026-11041: Insufficient validation of untrusted input in Media. Reported by Google on 2026-04-01

[N/A][498720094] Medium CVE-2026-11042: Use after free in Views. Reported by Google on 2026-04-01

[N/A][498721316] Medium CVE-2026-11043: Out of bounds write in ANGLE. Reported by Google on 2026-04-01

[N/A][498724803] Medium CVE-2026-11044: Integer overflow in ANGLE. Reported by Google on 2026-04-01

[N/A][498727111] Medium CVE-2026-11045: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-04-01

[N/A][498728857] Medium CVE-2026-11046: Insufficient validation of untrusted input in Media. Reported by Google on 2026-04-01

[N/A][498768132] Medium CVE-2026-11047: Insufficient validation of untrusted input in Base. Reported by Google on 2026-04-02

[N/A][498808432] Medium CVE-2026-11048: Inappropriate implementation in Extensions. Reported by Google on 2026-04-02

[N/A][498815068] Medium CVE-2026-11049: Use after free in Password Manager. Reported by Google on 2026-04-02

[N/A][498818402] Medium CVE-2026-11050: Use after free in V8. Reported by Google on 2026-04-02

[TBD][498828605] Medium CVE-2026-11051: Out of bounds read in ANGLE. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-02

[N/A][498834967] Medium CVE-2026-11052: Type Confusion in GPU. Reported by Google on 2026-04-02

[N/A][498841456] Medium CVE-2026-11053: VULNERABILITY in WebRTC. Reported by Google on 2026-04-02

[N/A][498845284] Medium CVE-2026-11054: Use after free in WebRTC. Reported by Google on 2026-04-02

[N/A][498881735] Medium CVE-2026-11055: Use after free in ANGLE. Reported by Google on 2026-04-02

[N/A][498887785] Medium CVE-2026-11056: Insufficient validation of untrusted input in SiteIsolation. Reported by Google on 2026-04-02

[N/A][498951946] Medium CVE-2026-11057: Uninitialized Use in Skia. Reported by Google on 2026-04-02

[N/A][498986406] Medium CVE-2026-11058: Integer overflow in CredentialProvider. Reported by Google on 2026-04-02

[N/A][498991983] Medium CVE-2026-11059: Use after free in Blink. Reported by Google on 2026-04-02

[N/A][499018355] Medium CVE-2026-11060: Use after free in Media. Reported by Google on 2026-04-02

[N/A][499031961] Medium CVE-2026-11061: Out of bounds read in ANGLE. Reported by Google on 2026-04-02

[N/A][499033012] Medium CVE-2026-11062: Insufficient policy enforcement in Extensions. Reported by Google on 2026-04-02

[N/A][499051067] Medium CVE-2026-11063: Insufficient validation of untrusted input in WebNN. Reported by Google on 2026-04-02

[N/A][499075743] Medium CVE-2026-11064: Uninitialized Use in GPU. Reported by Google on 2026-04-02

[N/A][499093536] Medium CVE-2026-11065: Use after free in ANGLE. Reported by Google on 2026-04-03

[N/A][499124128] Medium CVE-2026-11066: Insufficient validation of untrusted input in ANGLE. Reported by Google on 2026-04-03

[N/A][499140183] Medium CVE-2026-11067: Uninitialized Use in Dawn. Reported by Google on 2026-04-03

[N/A][499194333] Medium CVE-2026-11068: Use after free in WebSockets. Reported by Google on 2026-04-03

[N/A][499213367] Medium CVE-2026-11069: Insufficient validation of untrusted input in Cast. Reported by Google on 2026-04-03

[N/A][499225384] Medium CVE-2026-11070: Insufficient validation of untrusted input in Chromoting. Reported by Google on 2026-04-03

[N/A][499227659] Medium CVE-2026-11071: Use after free in Base. Reported by Google on 2026-04-03

[N/A][499238195] Medium CVE-2026-11072: Use after free in WebView. Reported by Google on 2026-04-03

[N/A][499365904] Medium CVE-2026-11073: Use after free in WebGL. Reported by Google on 2026-04-03

[TBD][499587071] Medium CVE-2026-11074: Use after free in WebRTC. Reported by boboliverfrancishoward@gmail.com on 2026-04-05

[TBD][499659070] Medium CVE-2026-11075: Out of bounds read in V8. Reported by JunYoung Park(@candymate) of KAIST Hacking Lab on 2026-04-06

[N/A][499784386] Medium CVE-2026-11076: Type Confusion in CSS. Reported by Google on 2026-04-05

[TBD][499908918] Medium CVE-2026-11077: Out of bounds read in Dawn. Reported by Anonymous on 2026-04-06

[TBD][499917177] Medium CVE-2026-11078: Insufficient validation of untrusted input in FileSystem. Reported by Eran Rom of Palo Alto Networks on 2026-04-06

[N/A][500028989] Medium CVE-2026-11079: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-04-06

[N/A][500032538] Medium CVE-2026-11080: Use after free in WebView. Reported by Google on 2026-04-06

[N/A][500076131] Medium CVE-2026-11081: Policy bypass in Canvas. Reported by Google on 2026-04-06

[N/A][500079715] Medium CVE-2026-11082: Use after free in GPU. Reported by Google on 2026-04-06

[N/A][500095743] Medium CVE-2026-11083: Inappropriate implementation in Password Manager. Reported by Google on 2026-04-06

[N/A][500124500] Medium CVE-2026-11084: Inappropriate implementation in Password Manager. Reported by Google on 2026-04-06

[N/A][500132379] Medium CVE-2026-11085: Integer overflow in GPU. Reported by Google on 2026-04-06

[N/A][500140111] Medium CVE-2026-11086: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-04-07

[N/A][500140149] Medium CVE-2026-11087: Uninitialized Use in ANGLE. Reported by Google on 2026-04-07

[N/A][500144879] Medium CVE-2026-11088: Integer overflow in ANGLE. Reported by Google on 2026-04-07

[N/A][500154880] Medium CVE-2026-11089: Uninitialized Use in Media. Reported by Google on 2026-04-07

[N/A][500161302] Medium CVE-2026-11090: Uninitialized Use in ANGLE. Reported by Google on 2026-04-07

[N/A][500162791] Medium CVE-2026-11091: Inappropriate implementation in Dawn. Reported by Google on 2026-04-07

[N/A][500170887] Medium CVE-2026-11092: Insufficient policy enforcement in DevTools. Reported by Google on 2026-04-07

[N/A][500172365] Medium CVE-2026-11093: Insufficient validation of untrusted input in Printing. Reported by Google on 2026-04-07

[N/A][500174874] Medium CVE-2026-11094: Use after free in Codecs. Reported by Google on 2026-04-07

[N/A][500293394] Medium CVE-2026-11095: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-04-07

[N/A][500296311] Medium CVE-2026-11096: Out of bounds read in WebRTC. Reported by Google on 2026-04-07

[N/A][500311718] Medium CVE-2026-11097: Inappropriate implementation in WebView. Reported by Google on 2026-04-07

[N/A][500315455] Medium CVE-2026-11098: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-04-07

[N/A][500414865] Medium CVE-2026-11099: Vulnerability in Skia. Reported by Google on 2026-04-07

[N/A][500416901] Medium CVE-2026-11100: Use after free in File Input. Reported by Google on 2026-04-07

[N/A][500443031] Medium CVE-2026-11101: Uninitialized Use in Dawn. Reported by Google on 2026-04-07

[N/A][500468338] Medium CVE-2026-11102: Inappropriate implementation in Isolated Web Apps. Reported by Google on 2026-04-07

[N/A][500483038] Medium CVE-2026-11103: Inappropriate implementation in Installer. Reported by Google on 2026-04-07

[N/A][500501226] Medium CVE-2026-11104: Uninitialized Use in ANGLE. Reported by Google on 2026-04-08

[N/A][500505339] Medium CVE-2026-11105: Insufficient validation of untrusted input in WebUI. Reported by Google on 2026-04-08

[N/A][500508725] Medium CVE-2026-11106: Inappropriate implementation in Media. Reported by Google on 2026-04-08

[N/A][500510384] Medium CVE-2026-11107: Inappropriate implementation in Downloads. Reported by Google on 2026-04-08

[N/A][500517053] Medium CVE-2026-11108: Inappropriate implementation in NFC. Reported by Google on 2026-04-08

[N/A][500524833] Medium CVE-2026-11109: Uninitialized Use in ANGLE. Reported by Google on 2026-04-08

[N/A][500528864] Medium CVE-2026-11110: Uninitialized Use in ANGLE. Reported by Google on 2026-04-08

[N/A][500530720] Medium CVE-2026-11111: Out of bounds read in ANGLE. Reported by Google on 2026-04-08

[N/A][500541413] Medium CVE-2026-11112: Insufficient validation of untrusted input in Chromoting. Reported by Google on 2026-04-08

[N/A][500560764] Medium CVE-2026-11113: Insufficient validation of untrusted input in ANGLE. Reported by Google on 2026-04-08

[N/A][501360342] Medium CVE-2026-11114: Use after free in Device Trust. Reported by Google on 2026-04-10

[N/A][501370283] Medium CVE-2026-11115: Use after free in Updater. Reported by Google on 2026-04-10

[N/A][501376612] Medium CVE-2026-11116: Use after free in Chromoting. Reported by Google on 2026-04-10

[N/A][501403820] Medium CVE-2026-11117: Use after free in Views. Reported by Google on 2026-04-10

[N/A][501424047] Medium CVE-2026-11118: Use after free in WebRTC. Reported by Google on 2026-04-10

[N/A][501461853] Medium CVE-2026-11119: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-04-10

[N/A][501467566] Medium CVE-2026-11120: Insufficient validation of untrusted input in Enterprise Reporting. Reported by Google on 2026-04-10

[N/A][501483855] Medium CVE-2026-11121: Insufficient validation of untrusted input in Skia. Reported by Google on 2026-04-10

[N/A][501485453] Medium CVE-2026-11122: Inappropriate implementation in Keyboard. Reported by Google on 2026-04-10

[N/A][501505198] Medium CVE-2026-11123: Uninitialized Use in ANGLE. Reported by Google on 2026-04-10

[N/A][501511299] Medium CVE-2026-11124: Heap buffer overflow in Skia. Reported by Google on 2026-04-10

[N/A][501517520] Medium CVE-2026-11125: Use after free in Compositing. Reported by Google on 2026-04-10

[N/A][501528031] Medium CVE-2026-11126: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-04-10

[N/A][501535295] Medium CVE-2026-11127: Inappropriate implementation in WebAPKs. Reported by Google on 2026-04-10

[N/A][501541341] Medium CVE-2026-11128: Insufficient validation of untrusted input in Web Share. Reported by Google on 2026-04-10

[N/A][501541962] Medium CVE-2026-11129: Inappropriate implementation in Extensions. Reported by Google on 2026-04-10

[N/A][501546443] Medium CVE-2026-11130: Use after free in Media. Reported by Google on 2026-04-11

[N/A][501561644] Medium CVE-2026-11131: Use after free in Autofill. Reported by Google on 2026-04-11

[N/A][501597365] Medium CVE-2026-11132: Policy bypass in Paint. Reported by Google on 2026-04-11

[N/A][501606085] Medium CVE-2026-11133: Insufficient policy enforcement in Paint. Reported by Google on 2026-04-11

[N/A][501640084] Medium CVE-2026-11134: Insufficient data validation in Media. Reported by Google on 2026-04-11

[N/A][501644835] Medium CVE-2026-11135: Insufficient policy enforcement in Autofill. Reported by Google on 2026-04-11

[TBD][501646327] Medium CVE-2026-11136: Use after free in Canvas. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po) on 2026-04-11

[N/A][501647943] Medium CVE-2026-11137: Uninitialized Use in ANGLE. Reported by Google on 2026-04-11

[N/A][501650354] Medium CVE-2026-11138: Uninitialized Use in ANGLE. Reported by Google on 2026-04-11

[N/A][501650594] Medium CVE-2026-11139: Policy bypass in Paint. Reported by Google on 2026-04-11

[N/A][501659253] Medium CVE-2026-11140: Insufficient validation of untrusted input in Chromecast. Reported by Google on 2026-04-11

[N/A][501667839] Medium CVE-2026-11141: Uninitialized Use in Audio. Reported by Google on 2026-04-11

[N/A][501668745] Medium CVE-2026-11142: Policy bypass in Paint. Reported by Google on 2026-04-11

[N/A][501674219] Medium CVE-2026-11143: Heap buffer overflow in Extensions. Reported by Google on 2026-04-11

[N/A][501676175] Medium CVE-2026-11144: Use after free in Media. Reported by Google on 2026-04-11

[N/A][501683745] Medium CVE-2026-11145: Race in Geolocation. Reported by Google on 2026-04-11

[N/A][501709220] Medium CVE-2026-11146: Insufficient validation of untrusted input in Chromoting. Reported by Google on 2026-04-11

[N/A][501731689] Medium CVE-2026-11147: Use after free in WebML. Reported by Google on 2026-04-11

[N/A][501738451] Medium CVE-2026-11148: Inappropriate implementation in Payments. Reported by Google on 2026-04-11

[N/A][501739206] Medium CVE-2026-11149: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-04-11

[N/A][501740299] Medium CVE-2026-11150: Inappropriate implementation in XML. Reported by Google on 2026-04-11

[N/A][501740323] Medium CVE-2026-11151: Insufficient validation of untrusted input in Password Manager. Reported by Google on 2026-04-11

[N/A][501762953] Medium CVE-2026-11152: Object lifecycle issue in Dawn. Reported by Google on 2026-04-11

[N/A][501779840] Medium CVE-2026-11153: Side-channel information leakage in Forms. Reported by Google on 2026-04-12

[N/A][501789156] Medium CVE-2026-11154: Use after free in Dawn. Reported by Google on 2026-04-12

[N/A][501801823] Medium CVE-2026-11155: Insufficient policy enforcement in CSS. Reported by Google on 2026-04-12

[N/A][501810226] Medium CVE-2026-11156: Inappropriate implementation in CSS. Reported by Google on 2026-04-12

[N/A][501823385] Medium CVE-2026-11157: Script injection in Accessibility. Reported by Google on 2026-04-12

[N/A][501844153] Medium CVE-2026-11158: Insufficient validation of untrusted input in Downloads. Reported by Google on 2026-04-12

[N/A][501861921] Medium CVE-2026-11159: Uninitialized Use in Skia. Reported by Google on 2026-04-12

[N/A][501862016] Medium CVE-2026-11160: Out of bounds read in Input. Reported by Google on 2026-04-12

[N/A][501920294] Medium CVE-2026-11161: Insufficient data validation in DataTransfer. Reported by Google on 2026-04-12

[N/A][502035074] Medium CVE-2026-11162: Insufficient policy enforcement in CSS. Reported by Google on 2026-04-13

[N/A][502072755] Medium CVE-2026-11163: Use after free in Messages. Reported by Google on 2026-04-13

[N/A][502089411] Medium CVE-2026-11164: Use after free in Blink. Reported by Google on 2026-04-13

[N/A][502099949] Medium CVE-2026-11165: Use after free in WebMIDI. Reported by Google on 2026-04-13

[N/A][502118936] Medium CVE-2026-11166: Inappropriate implementation in SVG. Reported by Google on 2026-04-13

[N/A][502228856] Medium CVE-2026-11167: Inappropriate implementation in WebView. Reported by Google on 2026-04-13

[N/A][502256049] Medium CVE-2026-11168: Insufficient policy enforcement in Extensions. Reported by Google on 2026-04-13

[N/A][502285273] Medium CVE-2026-11169: Inappropriate implementation in XML. Reported by Google on 2026-04-13

[N/A][502322596] Medium CVE-2026-11170: Inappropriate implementation in Chromoting. Reported by Google on 2026-04-13

[N/A][502322843] Medium CVE-2026-11171: Integer overflow in Blink. Reported by Google on 2026-04-13

[TBD][502328201] Medium CVE-2026-11172: Incorrect security UI in Contact Picker. Reported by mochazril.ti@gmail.com on 2026-04-14

[N/A][502337304] Medium CVE-2026-11173: Out of bounds write in V8. Reported by Google on 2026-04-14

[N/A][502348223] Medium CVE-2026-11174: Insufficient policy enforcement in Site Isolation. Reported by Google on 2026-04-14

[N/A][502368088] Medium CVE-2026-11175: Incorrect security UI in Messages. Reported by Google on 2026-04-14

[N/A][502371717] Medium CVE-2026-11176: Inappropriate implementation in Media. Reported by Google on 2026-04-14

[TBD][502449864] Medium CVE-2026-11177: Use after free in Omnibox. Reported by gevakun on 2026-04-14

[N/A][502501810] Medium CVE-2026-11178: Policy bypass in WebView. Reported by Google on 2026-04-14

[N/A][502615170] Medium CVE-2026-11179: Inappropriate implementation in ORB. Reported by Google on 2026-04-14

[N/A][502631225] Medium CVE-2026-11180: Policy bypass in SVG. Reported by Google on 2026-04-14

[N/A][502633299] Medium CVE-2026-11181: Inappropriate implementation in Media Session. Reported by Google on 2026-04-14

[N/A][502651014] Medium CVE-2026-11182: Inappropriate implementation in SVG. Reported by Google on 2026-04-14

[N/A][502768780] Medium CVE-2026-11183: Out of bounds read in GWP-ASan. Reported by Google on 2026-04-15

[N/A][502777516] Medium CVE-2026-11184: Insufficient policy enforcement in Actor. Reported by Google on 2026-04-15

[N/A][502784366] Medium CVE-2026-11185: Use after free in V8. Reported by Google on 2026-04-15

[N/A][502805170] Medium CVE-2026-11186: Inappropriate implementation in CSS. Reported by Google on 2026-04-15

[N/A][502819675] Medium CVE-2026-11187: Insufficient policy enforcement in Glic. Reported by Google on 2026-04-15

[N/A][502959826] Medium CVE-2026-11188: Use after free in USB. Reported by Google on 2026-04-15

[TBD][503197481] Medium CVE-2026-11189: Insufficient validation of untrusted input in DevTools. Reported by lebr0nli of National Yang Ming Chiao Tung University, Dept. of CS, Security and Systems Lab on 2026-04-16

[N/A][503375371] Medium CVE-2026-11190: Insufficient policy enforcement in Extensions. Reported by Google on 2026-04-16

[N/A][503392431] Medium CVE-2026-11191: Out of bounds memory access in ANGLE. Reported by Google on 2026-04-16

[N/A][503490678] Medium CVE-2026-11192: Insufficient validation of untrusted input in Password Manager. Reported by Google on 2026-04-17

[N/A][503642586] Medium CVE-2026-11193: Insufficient policy enforcement in Password Manager. Reported by Google on 2026-04-17

[N/A][503719488] Medium CVE-2026-11194: Inappropriate implementation in Network. Reported by Google on 2026-04-17

[N/A][503865896] Medium CVE-2026-11195: Inappropriate implementation in MHTML. Reported by Google on 2026-04-17

[N/A][503879106] Medium CVE-2026-11196: Type Confusion in XML. Reported by Google on 2026-04-17

[TBD][504073872] Medium CVE-2026-11197: Insufficient policy enforcement in Workers. Reported by VEZEKA on 2026-04-19

[N/A][504395300] Medium CVE-2026-11198: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-04-20

[N/A][504572664] Medium CVE-2026-11199: Insufficient validation of untrusted input in WebRTC. Reported by Google on 2026-04-20

[N/A][504579798] Medium CVE-2026-11200: Inappropriate implementation in WebRTC. Reported by Google on 2026-04-20

[TBD][505068950] Medium CVE-2026-11201: Use after free in ServiceWorker. Reported by Weipeng Jiang (@Krace) of VRI on 2026-04-22

[N/A][505144022] Medium CVE-2026-11202: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-04-22

[N/A][505192638] Medium CVE-2026-11203: Policy bypass in GPU. Reported by Google on 2026-04-22

[N/A][505200733] Medium CVE-2026-11204: Inappropriate implementation in Signin. Reported by Google on 2026-04-22

[N/A][505290253] Medium CVE-2026-11205: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-04-22

[TBD][505427216] Medium CVE-2026-11206: Policy bypass in ServiceWorker. Reported by David Bors, Catalin Iovita on 2026-04-23

[N/A][506127858] Medium CVE-2026-11207: Insufficient validation of untrusted input in Autofill. Reported by Google on 2026-04-24

[N/A][506387278] Medium CVE-2026-11208: Use after free in Codecs. Reported by Google on 2026-04-25

[N/A][506391032] Medium CVE-2026-11209: Insufficient policy enforcement in Passwords. Reported by Google on 2026-04-25

[N/A][506473226] Medium CVE-2026-11210: Insufficient policy enforcement in Safe Browsing. Reported by Google on 2026-04-25

[N/A][506629455] Medium CVE-2026-11211: Integer overflow in V8. Reported by Google on 2026-04-26

[N/A][507216833] Medium CVE-2026-11212: Insufficient policy enforcement in DevTools. Reported by Google on 2026-04-28

[N/A][507382702] Medium CVE-2026-11213: Insufficient validation of untrusted input in Reading Mode. Reported by Google on 2026-04-28

[N/A][508257850] Medium CVE-2026-11214: Inappropriate implementation in Chrome for iOS. Reported by Google on 2026-04-30

[N/A][513446116] Medium CVE-2026-11215: Inappropriate implementation in Cronet. Reported by Google on 2026-05-15

[$3000][474583539] Low CVE-2026-11216: Incorrect security UI in File Input. Reported by Azza Tegar Naufal Ataullah on 2026-01-10

[$3000][487564032] Low CVE-2026-11217: Insufficient policy enforcement in Fenced Frames. Reported by Tianyi Hu on 2026-02-25

[$2000][476862276] Low CVE-2026-11218: Inappropriate implementation in PlatformIntegration. Reported by Han Liu (Xiโ€™an Jiaotong University, School of Cyber Science and Engineering)
on 2026-01-19

[$2000][480074849] Low CVE-2026-11219: Insufficient data validation in Navigation. Reported by Bharat (mrnoob)ย  on 2026-01-30

[$2000][487300831] Low CVE-2026-11220: Insufficient validation of untrusted input in Navigation. Reported by Tianyi Hu on 2026-02-24

[$1500][492211919] Low CVE-2026-11221: Insufficient validation of untrusted input in PointerLock. Reported by mihalis.haatainen@bountyy.fi on 2026-03-12

[$1000][458442542] Low CVE-2026-11222: Incorrect security UI in Tab Strip. Reported by Hafiizh on 2025-11-07

[$1000][494800494] Low CVE-2026-11223: Insufficient validation of untrusted input in Network. Reported by Tianyi Hu on 2026-03-21

[$500][502461760] Low CVE-2026-11224: Use after free in Chromoting. Reported by David Bors, Catalin Iovita on 2026-04-14

[$500][503346647] Low CVE-2026-11225: Incorrect security UI in WebUI. Reported by Tareq Ahamed - itztrq on 2026-04-16

[N/A][385662278] Low CVE-2026-11226: Insufficient policy enforcement in PreviewTab. Reported by Google on 2020-03-05

[TBD][448421954] Low CVE-2026-11227: Incorrect security UI in Tab Hover Cards. Reported by Hafiizh on 2025-10-01

[TBD][454484864] Low CVE-2026-11228: Incorrect security UI in File Input. Reported by Umar Farooqย  on 2025-10-23

[TBD][482713603] Low CVE-2026-11229: Insufficient policy enforcement in Enterprise. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-02-08

[N/A][493225428] Low CVE-2026-11230: Use after free in Extensions. Reported by Google on 2026-03-16

[N/A][495840862] Low CVE-2026-11231: Inappropriate implementation in Safe Browsing. Reported by Google on 2026-03-24

[N/A][495981782] Low CVE-2026-11232: Inappropriate implementation in TabGroups. Reported by Google on 2026-03-25

[N/A][496088449] Low CVE-2026-11233: Insufficient validation of untrusted input in FoldableAPIs. Reported by Google on 2026-03-25

[N/A][496095145] Low CVE-2026-11234: Insufficient policy enforcement in FoldableAPIs. Reported by Google on 2026-03-25

[N/A][496419374] Low CVE-2026-11235: Insufficient validation of untrusted input in Compositing. Reported by Google on 2026-03-26

[N/A][496427030] Low CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth. Reported by Google on 2026-03-26

[N/A][496617698] Low CVE-2026-11237: Insufficient validation of untrusted input in Media. Reported by Google on 2026-03-26

[N/A][496705691] Low CVE-2026-11238: Inappropriate implementation in DevTools. Reported by Google on 2026-03-26

[N/A][497025738] Low CVE-2026-11239: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-03-27

[N/A][497030032] Low CVE-2026-11240: Insufficient validation of untrusted input in Loader. Reported by Google on 2026-03-27

[N/A][497203741] Low CVE-2026-11241: Insufficient validation of untrusted input in Cast. Reported by Google on 2026-03-28

[N/A][497385823] Low CVE-2026-11242: Insufficient validation of untrusted input in Plugins. Reported by Google on 2026-03-29

[N/A][497394061] Low CVE-2026-11243: Incorrect security UI in Downloads. Reported by Google on 2026-03-29

[N/A][497609145] Low CVE-2026-11244: Insufficient validation of untrusted input in WebAuthentication. Reported by Google on 2026-03-30

[N/A][497610654] Low CVE-2026-11245: Inappropriate implementation in Payments. Reported by Google on 2026-03-30

[N/A][497660733] Low CVE-2026-11246: Insufficient validation of untrusted input in IndexedDB. Reported by Google on 2026-03-30

[N/A][497865734] Low CVE-2026-11247: Insufficient policy enforcement in CustomTabs. Reported by Google on 2026-03-30

[N/A][497946941] Low CVE-2026-11248: Policy bypass in Google Lens. Reported by Google on 2026-03-30

[N/A][497989379] Low CVE-2026-11249: Use after free in Network. Reported by Google on 2026-03-31

[N/A][498281224] Low CVE-2026-11250: Inappropriate implementation in DevTools. Reported by Google on 2026-03-31

[N/A][498301853] Low CVE-2026-11251: Insufficient validation of untrusted input in Password Manager. Reported by Google on 2026-03-31

[N/A][498373018] Low CVE-2026-11252: Policy bypass in Content Settings. Reported by Google on 2026-04-01

[N/A][498397912] Low CVE-2026-11253: Race in Permissions. Reported by Google on 2026-04-01

[N/A][498405554] Low CVE-2026-11254: Inappropriate implementation in Permissions. Reported by Google on 2026-04-01

[N/A][498417152] Low CVE-2026-11255: Insufficient validation of untrusted input in Storage Access API. Reported by Google on 2026-04-01

[N/A][498856565] Low CVE-2026-11256: Out of bounds read in GPU. Reported by Google on 2026-04-02

[N/A][499051898] Low CVE-2026-11257: Inappropriate implementation in Browser. Reported by Google on 2026-04-02

[N/A][499078161] Low CVE-2026-11258: Inappropriate implementation in File System Access. Reported by Google on 2026-04-02

[N/A][499215943] Low CVE-2026-11259: Insufficient validation of untrusted input in Cast. Reported by Google on 2026-04-03

[N/A][499257860] Low CVE-2026-11260: Policy bypass in Permissions. Reported by Google on 2026-04-03

[N/A][499262832] Low CVE-2026-11261: Insufficient validation of untrusted input in PDF. Reported by Google on 2026-04-03

[N/A][499386363] Low CVE-2026-11262: Use after free in TabStrip. Reported by Google on 2026-04-03

[N/A][500044225] Low CVE-2026-11263: Insufficient policy enforcement in WebAuthentication. Reported by Google on 2026-04-06

[N/A][500099106] Low CVE-2026-11264: Policy bypass in Content Security Policy. Reported by Google on 2026-04-06

[N/A][500262869] Low CVE-2026-11265: Insufficient data validation in Autofill. Reported by Google on 2026-04-07

[N/A][500521311] Low CVE-2026-11266: Policy bypass in SafeBrowsing. Reported by Google on 2026-04-08

[N/A][500528267] Low CVE-2026-11267: Insufficient policy enforcement in Extensions. Reported by Google on 2026-04-08

[N/A][500528706] Low CVE-2026-11268: Uninitialized Use in ANGLE. Reported by Google on 2026-04-08

[N/A][500551122] Low CVE-2026-11269: Inappropriate implementation in Extensions. Reported by Google on 2026-04-08

[N/A][501504245] Low CVE-2026-11270: Inappropriate implementation in UI. Reported by Google on 2026-04-10

[N/A][501685207] Low CVE-2026-11271: Incorrect security UI in Passwords. Reported by Google on 2026-04-11

[N/A][501747321] Low CVE-2026-11272: Insufficient validation of untrusted input in Reading List. Reported by Google on 2026-04-11

[N/A][501757688] Low CVE-2026-11273: Insufficient validation of untrusted input in Omnibox. Reported by Google on 2026-04-11

[N/A][501760514] Low CVE-2026-11274: Inappropriate implementation in DOM Distiller. Reported by Google on 2026-04-11

[N/A][501763121] Low CVE-2026-11275: Insufficient policy enforcement in Page Info. Reported by Google on 2026-04-11

[N/A][501780338] Low CVE-2026-11276: Inappropriate implementation in Cast. Reported by Google on 2026-04-12

[N/A][501839664] Low CVE-2026-11277: Insufficient policy enforcement in Chrome for iOS. Reported by Google on 2026-04-12

[N/A][501859865] Low CVE-2026-11278: Inappropriate implementation in CustomTabs. Reported by Google on 2026-04-12

[N/A][501878477] Low CVE-2026-11279: Out of bounds read in DevTools. Reported by Google on 2026-04-12

[N/A][501892820] Low CVE-2026-11280: Insufficient validation of untrusted input in Signin. Reported by Google on 2026-04-12

[N/A][501900366] Low CVE-2026-11281: Integer overflow in Chromoting. Reported by Google on 2026-04-12

[N/A][502023400] Low CVE-2026-11282: Policy bypass in Sandbox. Reported by Google on 2026-04-13

[N/A][502069297] Low CVE-2026-11283: Policy bypass in Shortcuts. Reported by Google on 2026-04-13

[N/A][502073069] Low CVE-2026-11284: Side-channel information leakage in PerformanceAPIs. Reported by Google on 2026-04-13

[N/A][502090914] Low CVE-2026-11285: Insufficient policy enforcement in Chrome for iOS. Reported by Google on 2026-04-13

[N/A][502110170] Low CVE-2026-11286: Insufficient validation of untrusted input in Wallet. Reported by Google on 2026-04-13

[N/A][502173136] Low CVE-2026-11287: Insufficient validation of untrusted input in Navigation. Reported by Google on 2026-04-13

[N/A][502231588] Low CVE-2026-11288: Policy bypass in CSS. Reported by Google on 2026-04-13

[N/A][502239897] Low CVE-2026-11289: Side-channel information leakage in Paint. Reported by Google on 2026-04-13

[N/A][502264647] Low CVE-2026-11290: Integer overflow in WebView. Reported by Google on 2026-04-13

[N/A][502346855] Low CVE-2026-11291: Policy bypass in Android Autofill. Reported by Google on 2026-04-14

[N/A][502358901] Low CVE-2026-11292: Policy bypass in Blink. Reported by Google on 2026-04-14

[TBD][502362260] Low CVE-2026-11293: Use after free in Input. Reported by Weipeng Jiang (@Krace) of VRI on 2026-04-14

[N/A][502403953] Low CVE-2026-11294: Inappropriate implementation in Passwords. Reported by Google on 2026-04-14

[N/A][502444677] Low CVE-2026-11295: Inappropriate implementation in WebView. Reported by Google on 2026-04-14

[N/A][502493950] Low CVE-2026-11296: Inappropriate implementation in ImageCapture. Reported by Google on 2026-04-14

[N/A][502502017] Low CVE-2026-11297: Insufficient validation of untrusted input in Reader Mode. Reported by Google on 2026-04-14

[N/A][502503860] Low CVE-2026-11298: Insufficient policy enforcement in Chrome for iOS. Reported by Google on 2026-04-14

[TBD][502598424] Low CVE-2026-11299: Out of bounds read in Fonts. Reported by sharadboni@gmail.com on 2026-04-14

[N/A][503614310] Low CVE-2026-11300: Inappropriate implementation in Permissions. Reported by Google on 2026-04-17

[N/A][504180386] Low CVE-2026-11301: Out of bounds read in LiveCaption. Reported by Google on 2026-04-19

[N/A][504196549] Low CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS. Reported by Google on 2026-04-19

[N/A][504416752] Low CVE-2026-11303: Use after free in PDFium. Reported by Google on 2026-04-20

[N/A][504418475] Low CVE-2026-11304: Use after free in PDFium. Reported by Google on 2026-04-20

[N/A][504545544] Low CVE-2026-11305: Use after free in PDFium. Reported by Google on 2026-04-20

[N/A][504548949] Low CVE-2026-11306: Use after free in PDFium. Reported by Google on 2026-04-20

[N/A][504551617] Low CVE-2026-11307: Use after free in PDFium. Reported by Google on 2026-04-20

[N/A][505945112] Low CVE-2026-11308: Inappropriate implementation in Extensions. Reported by Google on 2026-04-24

[N/A][506392934] Low CVE-2026-11309: Insufficient policy enforcement in History. Reported by Google on 2026-04-25


We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.



Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Srinivas Sista

Google Chrome

  •  

Distribution Release: Clonezilla Live 3.3.2-31

2 Juni 2026 om 20:13
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Clonezilla Live is a Debian-based live CD containing Clonezilla, a partition and disk cloning software. The project's latest announcement brings Clonezilla Live up to date with Debian's "Unstable" repository: "Stable Clonezilla Live 3.3.2-31 released. This release of Clonezilla live includes major enhancements and bug fixes. Enhancements and changes....
  •  

Minecraft 26.2-pre-3 (snapshot) Released

2 Juni 2026 om 13:48
26.2 Pre-Release 3 (known as 26.2-pre-3 in the launcher) is the third pre-release for Java Edition 26.2, released on June 2, 2026. Full changelog: https://minecraft.wiki/Java_Edition_26.2-pre-3
  •  

Ben Hutchings: FOSS activity in 2025

2 Juni 2026 om 16:17

This was a particularly busy month for me in terms of Debian contributions.

It started with a week in Hamburg for the MiniDebConf. I talked to many colleagues face-to-face and worked on various bugs and maintenance tasks. Iโ€™m pleased to have finally found the time to reproduce and fix the boot-time crashes in the parallel port subsystem that have been reported many times recently.

A series of easily exploited kernel LPE (local privilege execution) issues were published this month, mostly with very little coordination with distributions. Salvatore and I had to upload fixes for these at roughly weekly intervals. All of these fixes needed to be applied to 4 different upstream branches (currently 5.10, 6.1, 6.12, and 7.0) and 7 Debian branches (including backports).

  •  

American Truck Simulator: 1.60 Update Open Beta

Door: David
2 Juni 2026 om 09:42

Weโ€™re excited to share that the 1.60 Open Beta forย American Truck Simulatorย is now available for players to try out. If you decide to join the beta, weโ€™d really appreciate it if you report any bugs or issues you encounter in theย appropriate section of our official forums.

Your feedback plays a huge role in helping us improve the game, and we truly value the time and effort you put into testing these new features and changes. Now, letโ€™s dive into what you can expect in the 1.60 Open Beta update:

Game Radio

With Update 1.60, we are introducing Game Radio, a brand-new in-game radio system designed to make every drive feel more immersive and authentic. Rather than just playing music, Game Radio gives you five stations with their own distinct sounds, identities, and moods, each one built to shape the atmosphere of your journey in a different way.

At launch, players can tune into Rust FM, Escape, PUMP IT!, Pop Gear, and Roadio, spanning guitar-driven rock and American roots music to electronic, pop, and lo-fi. Each station features carefully curated tracks, handpicked to hold up across many hours on the road. Escape is also the only stream-safe station at launch, designed to help content creators avoid copyright claims.

Game Radio also introduces a new in-game widget displaying station info, track titles, and artist names while driving. Players can customize widget behavior through the Widget Options menu (F6). This update also brings a range of improvements to the existing radio and music player systems.

Game Radio arrives with its musical foundation in place, with more planned for future updates. You can find out more information about Game Radio in our dedicated blog post.

Improved Material System

The Improved Material System significantly improves the lighting and visual quality of vehicle interiors in selected trucks. Its main focus is to enhance how interior materials react to light, which will result in a more readable, detailed, and visually pleasing cabin environment.


During the development of Project Road Trip, we implemented a wide range of visual and technical improvements. One of the most significant changes was a redesign of the materials used in vehicle interiors. As a result, it makes differences between materials such as leather, fabric, plastic, and metal far more apparent, even in low-light conditions. The new solution uses multiple variants of dynamic cubemaps, allowing all materials to reflect their surroundings more naturally and respond to ambient light in a more realistic way.


The entire system was designed from the start with the interiors of trucks in both games in mind, so the base games and their existing fleets will gradually benefit from these improvements as well. The first trucks to benefit from the Improved Material System in ATS will be the Mack Anthem and the Western Star 49X. With future updates, we will gradually add this technology for other trucks across both games.ย You can read more about this feature here.

Light Tweaks

We have carried out minor adjustments to the global lighting, primarily focused on exposure and contrast balancing, along with subtle visual refinements for bad weather conditions. The work mainly consisted of smoothing out and polishing the overall visuals to achieve a more consistent and refined look.

Players' Company Paint Jobs

After over a year of development as a passion project for the ATS community, players are now able to customize their trucks and trailers with a brand-new collection of company-themed paint jobs inspired by the selectable company identities available when creating a driver profile. These designs bring a more cohesive and professional visual style to your fleet while fitting naturally into the world of ATS.

One of the biggest focuses during development was ensuring that every paint job feels unique, depending on the type of trailer it is applied to. Rather than simply using one design across all trailer models, our teams carefully adapted each company's paint scheme to match the shapes and details of different trailer types. Whether youโ€™re hauling cargo with a tanker, transporting materials in a dumper, or pulling a traditional box trailer, each variant features its own tailored details and layout. You can find out more in our blog here.

Job Details Widget

Based on feedback from our #BestCommunityEver and upcoming widget designs, the Job Details Widget will be introduced with the 1.60 update. Its primary purpose will be to enable a new, more immediate, and concise way of displaying the relevant job info. Also,ย in response to community feedback, the GPS will now display the estimated arrival day and time, along with the remaining travel time and distance.

Once added, you'll be able to enable the Job Details Widget through the Widget Options menu (F6). The widget will display key job information, including cargo type and weight, delivery location, job income (colour-highlighted), and the remaining time to complete the job, so players will have this info available immediately without the necessity to pause the game. You can read more about the feature here.

Expanded Rest Mechanic

This new feature gives players greater control over their rest periods by allowing them to choose how long they want to sleep and exactly when they want to wake up, instead of being limited to a predefined rest duration.

Alongside this change, the Fatigue system will now be split into two separate values: Rest State and Mandatory Break, each represented by its own icon in the UI.

The Rest State, symbolised by a bed icon, will now gradually deplete rather than recover over time. Extended periods of driving will steadily reduce the Rest State, while resting will restore it at a faster rate.

The Mandatory Break system, indicated by a "P" icon along with the remaining hours before a required stop, will function more strictly. In American Truck Simulator, drivers can stay on the road for up to 14 hours before they must take a mandatory break, requiring 10 consecutive hours of rest afterward.ย You can read more about this feature here.

Changelog:

Vehicles

  • Players' Company Paint Jobs

Visual

  • Improved Material System
  • Light Tweaks

Sound

  • Game Radio

UI/UX

  • Job Details Widget
  • Expanded Rest Mechanic

Enjoy all the new additions, but please remember: It's only an open beta, not a stable public version, so you may encounter bugs, instability, or crashes. It's completely okay if you want to wait for the final release. But if you're interested in helping us to get there faster, we'd appreciate all of your feedback on our forum and your bug reports in the dedicated section.

Please check our modding wiki to get details pertaining to mods for the game.

If you wish to participate in this Open Beta, you can find this version in the Experimental Beta branch on Steam. The way to access it is as follows: Steam client โ†’ LIBRARY โ†’ right-click on American Truck Simulator โ†’ Properties โ†’ Betas tab โ†’ Beta Participation drop-down menu โ†’ public_beta. No password is required. Sometimes you will have to restart your Steam client to see the correct branch name there.

  •  

v1.5.0

2 Juni 2026 om 03:43

Changelog

  • 3cf10d8 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob
  • cd3f2ff chore(deps): bump github.com/Azure/go-ntlmssp from 0.1.0 to 0.1.1
  • deda805 chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2
  • 325ab6e chore(deps): bump the dev-dependencies group with 19 updates
  • fbe2a4b chore(deps): bump the dev-dependencies group with 7 updates
  • 2ed8b78 chore(deps): bump the dev-dependencies group with 9 updates
  • e4fa31c chore: fix sidecar flag in runtests to correctly pass test option
  • db3478d chore: update go package dependencies
  • 861c5f5 feat: add bucket metrics tag when request specifies a bucket
  • d1fba07 feat: add custom route and middleware options
  • 8ae566d feat: add new ErrNoSpaceLeftOnDevice API error for ENOSPC errors
  • 20939bd feat: extract gateway runtime into embeddable package
  • 9f786b3 feat: global error refactoring
  • cb609e4 feat: replace webui client-side name filter with server-side prefix filter
  • d2fa265 feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums
  • e6aa9de fix: apply CORS middleware to admin CreateBucket route
  • 8d5b2be fix: check PutObjectTagging/LegalHold/Retention permissions on PutObject,CopyObject and CreateMultipartUpload
  • e137e8d fix: connection early termination resulting in internal error
  • a5fc7c1 fix: decode URL hash in webui before parsing bucket/prefix
  • 5774702 fix: enforce required SignedHeaders validation for SigV4 requests
  • 0e165ed fix: expose x-amz-storage-class in CORS response headers
  • 4ef090d fix: fix empty ownership control rules panic
  • fe3cfbf fix: forward slash url encoded used as bucket/key separator
  • ed1ad6b fix: honor explicit public bucket policy deny
  • 2c0844a fix: ignore implicit directories for Get/HeadObject
  • cd0b4e6 fix: normalize object keys during bucket policy evaluation
  • e69d073 fix: reject SigV2 requests
  • eecc1a7 fix: reject invalid PostObject keys
  • 27971f2 fix: remove unsigned chunk reader caching
  • d498d48 fix: replace misleading webui CORS error toast with generic network error message
  • dd27c6c fix: scoutfs multipart alignment check for last part
  • bb3cdd9 fix: skip integration tests not compatible in sidecar
  • 5cb5541 fix: store object multipart upload metadata compressed

  •  

Amin Bandali: Free software activities in May 2026

1 Juni 2026 om 04:30

Hello and welcome to my May 2026 free software activities report. A lot's been going on in my life offline so I took a bit of a hiatus from doing these reports, but I've had a fairly productive month of May so I thought it'd be nice to do another one for this month.

GNU & FSF

  • GNU Emacs:
    • ffs-0.2.2: I finally polished and published my ffs package for GNU Emacs on GNU ELPA. Many thanks to Protesilaos for rounds of code review and feedback for improving and polishing the package in preparation for submission to GNU ELPA.
    • bug#81101: Trying to visit https://www.emacswiki.org in EWW I noticed it fails with a Somebody wants you to give them money error due to the anti-bot challenge being served with a HTTP 402 (Payment Required) response. So I landed a patch 12eec781ed6 to no longer do that. Thanks to Emacs comaintainer Sean Whitton for reviewing and approving my proposed patch.
    • bug#81107: I noticed that in EWW, unlike <input type="submit"> HTML buttons, <button> elements were not tab-stoppable, leading to poorer usability and accessibility. So I landed a patch ec3d662de0b to fix that. Thanks to Emacs comaintainer Eli Zaretskii for reviewing, providing feedback, and accepting my proposed change.
    • Emacs Chat with Sacha Chua: I joined Sacha for a new episode of her Emacs Chat podcast, where we talked about Emacs and life. I gave a quick tour of my Emacs configuration, discussing at length my configurations for EXWM (Emacs X Window Manager) among other topics like Emacs's facility for visually indicating buffer boundaries in the fringe by setting indicate-buffer-boundaries and my convenience configuration macros.
  • maintainers@: I started the next long-overdue round of emails to GNU package maintainers to confirm the contact information we have on file for them and get a brief status update about their packages. Emails are sent in small batches to keep the workload of handling the responses manageable for assistant GNUisances.
  • GNU Spotlight: I prepared and sent the May GNU Spotlight to the FSF campaigns team for publication on the FSF's community blog and the monthly Free Software Supporter newsletter.

Debian

I've begun the work toward updating the Jami package in Debian unstable again, which means I need to package new releases of its direct and indirect dependencies. For OpenDHT, I need to update RESTinio, and to do that I first need to package expected-lite and sobjectizer for Debian:

  • #1120837: ITP: expected-lite โ€“ expected objects for C++11 and later
  • #1137609: ITP: sobjectizer โ€“ C++ implementation of Actor, Publish-Subscribe, and CSP models

I've been working on packaging both and hope to have them uploaded to the archive in the next days and weeks.

That's it for this month's report.

Take care, and so long for now.

  •  

Distribution Release: MocaccinoOS 26.06

1 Juni 2026 om 21:30
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The MocaccinoOS development team has announced the release of MocaccinoOS 26.06, the latest version of the project's set of Gentoo-based Linux distributions featuring a number of popular desktop environments and a custom package manager called "Luet". This release provides a new live image with the COSMIC desktop and....
  •  

5.4.1

1 Juni 2026 om 22:03

Note

UpSnap is, and always will be, free and open source software.

If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.

The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.

Changelog

Features

Others

  •  

ATS 1.60: Players' Company Paint Jobs

Door: David
1 Juni 2026 om 17:00

Today, weโ€™re excited to share more details about a feature coming to American Truck Simulator in Update 1.60 - Playersโ€™ Company Paint Jobs!

For quite some time, our teams have wanted to expand and improve the way players can represent their in-game trucking companies. After over a year of development as a passion project created especially for the ATS community, weโ€™re happy to finally reveal the results.

With Update 1.60, players will be able to customize their trucks and trailers with a brand-new collection of company-themed paint jobs inspired by the selectable company identities available when creating a driver profile. These designs bring a more cohesive and professional visual style to your fleet while still fitting naturally into the world of American Truck Simulator.

One of the biggest focuses during development was ensuring that every paint job feels unique, depending on the type of trailer it is applied to. Rather than simply stretching one design across all trailer models, our teams carefully adapted each company's paint scheme to match the specific shapes and details of different trailer types.

Whether youโ€™re hauling cargo with a tanker, transporting material in a dumper, or pulling a traditional box trailer, each variant features its own tailored details and layout. Our designers paid close attention to every surface, curve, and accessory to make sure the final result feels authentic and visually balanced across the entire fleet.

Players familiar with the feature in Euro Truck Simulator 2 will also feel right at home with the customization options included in ATS. Every company paint job comes with four pre-made color presets, giving players multiple styles to choose from right away while maintaining a consistent company identity.

We canโ€™t wait for you to hit the road with your newly branded fleet when Update 1.60 arrives for American Truck Simulator. Whether youโ€™re starting a brand-new company or giving your current operation a fresh identity, we hope these new paint jobs help make your journeys feel even more personal.

Until then, be sure to stay connected with us on our social media channels on X/Twitter, Facebook, BlueSky, YouTube, and Instagram, and by subscribing to our newsletter so you donโ€™t miss any future updates! Stay safe and happy truckin'!

  •  

Distribution Release: Linux Lite 8.0

1 Juni 2026 om 13:49
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Jerry Bezencon has announced the release of Linux Lite 8.0, an Ubuntu-based distribution which makes getting set up and started easy for beginners. "Linux Lite 8.0 final is now available for download. Series 8 represents 14 years of community-driven purpose culminating in Linux Lite's largest development cycle ever:....
  •  

Distribution Release: Network Security Toolkit 44-15105

1 Juni 2026 om 11:56
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Ron Henderson has announced the release of Network Security Toolkit (NST) 44-15105, a major new version of the project's Fedora-based Linux distribution featuring a collection of best-of-breed, open-source network security applications: "We are pleased to announce the latest NST release - NST 44 SVN:15105. Based on Fedora 44....
  •  

DistroWatch Weekly, Issue 1175

1 Juni 2026 om 02:04
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. This week in DistroWatch Weekly:
Review: The PineTab2 with various operating systems
News: Canonical is shutting down Ubuntu's Pastebin, Murena nears 100k users
Questions and answers: Less commonly shared pieces of advice
Released last week: Rhino Linux 2026.1, MX Linux 25.2, AlmaLinux 10.2 and 9.8, IPFire 2.29 Core 202, OviOS Linux....
  •  

Dopamine 3.0.5

Door: digimezzo
31 Mei 2026 om 21:51

Added

  • Added an Adwaita theme, because GNU/Linux deserves some love.
  • Added Windows taskbar media controls accessible by hovering over the app icon in the taskbar
  • Added a "Refresh now" button to the main menu
  • Added ReplayGain support
  • Added option to show album name on the now playing page
  • Added possibility to edit the album cover

Changed

  • Discord Rich Presence says "Listening to" instead of "Playing"
  • Improved scaling of different parts of the user interface
  • Updated the Czech translation
  • Updated the German translation
  • Updated the Hebrew translation
  • Updated the Russian translation
  • Updated the Vietnamese translation

Fixed

  • Saving a rating to an MP3 file could create an ID3v1 tag, causing genres to be stored and displayed as their numeric ID3v1 code (e.g. "Eurodance" becoming "54")
  • It is not possible to edit songs from the Songs screen
  • There is no scroll bar in the smart playlist editor
  • Loop one does not work correctly when using gapless or crossfading playback
  • When exiting Dopamine, the Discord status doesn't disappear.
  • It's not always clear when Dopamine is refreshing the collection

P.S.: If you enjoy Dopamine, please consider donating via PayPal or buying me a coffee. Your support keeps the music going!

  •  

Amin Bandali: Thinking about life - chat with Protesilaos

23 Mei 2026 om 19:30

In the recent weeks I've been engaging Prot as a coach to help review my new ffs package for GNU Emacs as I worked on preparing it for inclusion in GNU ELPA, as well as discussing other Emacs- and life-related topics.

UPDATE 2026-05-23 22:39:15 -0400: Prot also published an article about our session on his website: https://protesilaos.com/commentary/2026-05-23-life-issues-and-philosophy-amin-bandali/

In our nearly 2-hour conversation, we discussed at length and in depth various aspects of life in the current times. For instance, feeling overwhelmed in the face of innumerable things happening at once, with technology changing our perception and making events feel proximate and imminent.

We talked about seasonality and rhythms in life, including in relation to burnout and knowing our own limitations, and descriptive vs prescriptive thinking when reflecting on the expectations we may place on our self when comparing our self to others through the lens of our necessarily-incomplete impressions and glimpses of their lives. We discussed absence or loss as a dual to presence or persistence in the process of life. How with our memories and through embodying the philosophy and teachings of departed loved ones their essence and legacy continues to live on within us. But also loss in the sense of us losing parts of our self in life-defining moments while preserving other parts and gaining new ones, being liberated of some of the burdens of our past self and in effect becoming someone else in the process.

In being true to our self, we talked about humans as multi-faceted beings and the importance of expressing and giving a voice to these different aspects of our self, and keeping alive that child-like sense of awe and wonder. To live a life where the pace and rhythms of our environment are in sync with our internal rhythms, and to not give others undue power over us or our happiness through trying to live according to their prescribed standards or expectations.

I also learned more about Prot's practical philosophy of situational awareness in life, not merely as a means for survival, but also as a way of appreciating all of the beauty that surrounds us, and a method for gaining the knowledge and skills to apply what we learn from patterns in one area of life to other areas.

We concluded our session with a mention to the concept of sanctity, to set aside a sacred time or place for our self wherein no distractions are allowed, where we can unwind, rest, and recharge for whatever comes next.

Here is the video recording of our session, which I share with Prot's permission:

You can view or download the full-resolution video from the Internet Archive.

Like Prot, I am invigorated and inspired to live a full, honest life. To do my best, do what I do in earnest, and make the best of what I have.

Take care, and so long for now.

  •  
โŒ