Extended Stable Update for Desktop
Β The Extended Stable channel has been updated to 152.0.7977.152Β for Windows and Mac which will roll out over the coming days/weeks.
Β The Extended Stable channel has been updated to 152.0.7977.152Β for Windows and Mac which will roll out over the coming days/weeks.
Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:
xattr -cr /Applications/marktext.app
All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:
sha256sum -c SHA256SUMS.txt --ignore-missing
/ trigger when quick-inserting front matter by @Jocs in #4481_ prefix for private members via lint by @Jocs in #4535c++/h++ as aliases for the cpp code grammar by @Jocs in #4794\% as a comment by @Jocs in #4795$β¦$ (#5446) by @Jocs in https://github.com/marktext/marktext/pull/5449marktext on PATH on every platform by @Jocs in https://github.com/marktext/marktext/pull/5459any in .vue (#4257) by @Jocs in https://github.com/marktext/marktext/pull/5521Full Changelog: v0.19.0...v0.20.0
The Stable channel has been updated to 154.0.8037.97/.98 for Windows and Mac and 154.0.8037.97 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 11 security fixes. Please see the Chrome Security Page for more information.
[N/A][549995090] Critical CVE-2026-103628: Out of bounds write in WebGL. Reported by Google on 2026-08-21
[N/A][553114097] High CVE-2026-103626: Incorrect authorization in FileSystem. Reported by Google on 2026-08-26
[N/A][556268833] High CVE-2026-103621: Integer overflow in Compositing. Reported by Google on 2026-09-02
[TBD][557323166] High CVE-2026-103630: Use after free in FedCM. Reported by xinyang on 2026-09-04
[N/A][559893859] High CVE-2026-103625: Type confusion in V8. Reported by Google on 2026-09-11
[TBD][561660166] High CVE-2026-103624: Use after free in Contextual Tasks. Reported by xuanocto1221 on 2026-09-15
[N/A][562038679] High CVE-2026-103629: Integer overflow in Skia. Reported by Google on 2026-09-15
[TBD][565742179] High CVE-2026-103622: Use after free in SVG. Reported by xinyang on 2026-09-24
[TBD][565742180] High CVE-2026-103623: Use after free in MediaStream. Reported by xinyang on 2026-09-24
[TBD][567088927] High CVE-2026-103631: Buffer overflow in WebRTC. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28
[N/A][553147154] Medium CVE-2026-103627: Information leak in SVG. Reported by Google on 2026-08-26
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Changes in 8.4.0:
OBS-Studio-33.0.0-beta5-Sources.tar.gz: 5b8d65c0b2981aa779eaf5bae9739ba5681290f03025b9eddd40cf5da2eb566a
OBS-Studio-33.0.0-beta5-Ubuntu-26.04-x86_64-dbsym.ddeb: 6fd06d0ee256f560875622da516880b119083b725e9280a7105221d589128952
OBS-Studio-33.0.0-beta5-Ubuntu-26.04-x86_64.deb: db1fdfad893d4d20adb3f899bd8ee24cf26b6088e23764c5ffbfe3eef6ca6153
OBS-Studio-33.0.0-beta5-Windows-arm64-PDBs.zip: 8b5860e48349a7d90794ab61e8b42458f270ccc4aeb53c4aa6d1f0469335b9af
OBS-Studio-33.0.0-beta5-Windows-arm64.zip: 7a7b3c3759dfc49df65d1b4e14cc23ad6092f4f36d83e44ea2978ec9f54a3c9f
OBS-Studio-33.0.0-beta5-Windows-x64-Installer.exe: 7ee61670a7e8738b4753487d3c3e75f30c35ddbe2937cdb75eb31b86054c3cf9
OBS-Studio-33.0.0-beta5-Windows-x64-PDBs.zip: 643c1b735da59b40052887ec0b891bd2852d2bd47c87227f268e3da026a0a86f
OBS-Studio-33.0.0-beta5-Windows-x64.zip: 8de0d330582083bc3b429e7dbe01d1fbc995dfdeeb3229eedf454a2f931c6481
OBS-Studio-33.0.0-beta5-macOS-Apple-dSYMs.tar.xz: 5b0545a3724c2920b02aa3df07c76f39bec73b1b814fcf78d1cb53dbae52393f
OBS-Studio-33.0.0-beta5-macOS-Apple.dmg: e7d289a68ee27e0d21900f380fd3d0c2c4c5c48ec0e1661fe6b093258b07eaa5
OBS-Studio-33.0.0-beta5-macOS-Intel-dSYMs.tar.xz: f4192371f6bc9ab92f2403893eb3c945fda37585185b3bce31a6d4fdef7a7229
OBS-Studio-33.0.0-beta5-macOS-Intel.dmg: 33b5a80275eaa7331cb39a71d530e63d3937672c62d6c9fb5c48039490b255df
The Stable channel has been updated to 155.0.8059.26/.27 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
The Stable channel has been updated to 154.0.8037.92/.93 for Windows and Mac and 154.0.8037.92 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log
Security Fixes and Rewards
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
The Extended Stable channel has been updated to 152.0.7977.149Β for Windows and Mac which will roll out over the coming days/weeks.

Firefox's biggest visual refresh in years is now available, with a modernized look across the browser toolbars, sidebar, menus and individual features, built with our updated design system. It also includes:
WebRTC video calls can now use hardware AV1 decoding on devices that support it, instead of always decoding AV1 video in software.
Firefox now shows a warning in the site information panel (the shield icon in the address bar) and in Settings when it has been set up to record its encryption keys, which could let other software on the computer read encrypted web traffic.

Firefox Suggest now offers suggestions in the address bar in Austria, Belgium, Czech Republic, Denmark, Finland, Hungary, Ireland, Luxembourg, Netherlands, Norway, Poland, Portugal, Slovakia, Spain, Sweden, and Switzerland. They can be controlled in the Firefox Suggest settings. Learn more.
Fixed video from phones and tablets appearing sideways or upside down in WebRTC calls.
Fixed the address bar searching for the typed text instead of opening the selected suggestion when a page was still loading, such as shortly after Firefox started.
Fixed some HDR videos encoded in 8-bit color formats looking dull and gray on Windows instead of displaying in HDR.
Improved audio and video synchronization when repeatedly changing the playback speed of videos, for example on YouTube.
Fixed the Vertical Tabs sidebar not reappearing when the cursor moves to the edge of the screen in full screen mode.
Fixed an issue on Windows where making a video full screen would leave the Windows taskbar showing over the video.
Various security fixes.
Pressing Tab now moves focus straight to the text field of the address bar and search bar instead of stopping on the search engine button first. The button can still be reached with Shift+Tab.
Amazon is no longer included as a built-in search engine. It can still be added as a custom search engine in the search settings. Learn more.
The updated sidebar is now enabled for everyone. Anyone still using the previous sidebar will keep a similar layout, with the panel switcher at the top of the sidebar. Additionally, the βShow sidebarβ option has been removed from Settings.
While we continue to refine the new design, the previous sidebar version can still be restored by setting sidebar.revamp to false in about:config. This also turns off vertical tabs. The preference will remain available until the end of 2027.
Web page alert(), confirm() and prompt() dialogs, the color and date pickers, and form autocomplete drop-downs now match the page's light or dark color scheme.
You can find information about policy updates and enterprise-specific bug fixes in the Firefox for Enterprise 157 Release Notes.
Firefox now supports the at-rule() function for @supports. This allows authors to detect browser support for specific at-rules, such as @supports at-rule(@scope).
Firefox now supports the chain value for the CSS overscroll-behavior property.
With the release of Firefox 157, we are pleased to welcome the developers who contributed their first code change to Firefox in this release, 21 of whom were brand new volunteers! Please join us in thanking each of these diligent and enthusiastic individuals, and take a look at their contributions:
Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:
xattr -cr /Applications/marktext.app
All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:
sha256sum -c SHA256SUMS.txt --ignore-missing
Full Changelog: v0.20.0-rc.6...v0.20.0-rc.7
P.S.: If you enjoy Dopamine, please consider donating via PayPal or buying me a coffee. Your support keeps the music going!
OBS-Studio-33.0.0-beta4-Sources.tar.gz: 71f33df72e454d53c0eb1e706441e2b24c475acc3ac259b8c071e9707ad10eb7
OBS-Studio-33.0.0-beta4-Ubuntu-26.04-x86_64-dbsym.ddeb: 9be1bbd516cb9b62be1adb381be44c026f197c9c206c90d06381d4eb6baf99d4
OBS-Studio-33.0.0-beta4-Ubuntu-26.04-x86_64.deb: 055db4d5cb1099b106d67645f84bc076ad1409836a0b603a35f393e1aa063a1d
OBS-Studio-33.0.0-beta4-Windows-arm64-PDBs.zip: a1e5095bd3b20bd3703cd2a2e97dc9735f5bb08513218d463edb1e9b88376d10
OBS-Studio-33.0.0-beta4-Windows-arm64.zip: c8bdbd9963e9bbdaf5e8ffaa7536ce6edd4ac583bec560fff69a5dee532ac111
OBS-Studio-33.0.0-beta4-Windows-x64-Installer.exe: 28323560c1585d51a290984777e980ef8788cd3210f150993ccbd9ee62484d8a
OBS-Studio-33.0.0-beta4-Windows-x64-PDBs.zip: 4825a54748ff65dde606537042df5b8eae634e89bb419eb93439907e97963268
OBS-Studio-33.0.0-beta4-Windows-x64.zip: 0a6d97ed2fb4d4c4cd3669eeaf063365e89ce72b602dc101659fc135f047359e
OBS-Studio-33.0.0-beta4-macOS-Apple-dSYMs.tar.xz: 58c55f934334a51e49b26baa627da34ee60909fbc74dc1c10e8f2469b6156c92
OBS-Studio-33.0.0-beta4-macOS-Apple.dmg: ecaba68924c83e96a300ba58412da04f0f469f331f88c10e7a74c6117e6e41f3
OBS-Studio-33.0.0-beta4-macOS-Intel-dSYMs.tar.xz: cadfe8423ba34900543a68b8a394c74efce632395260386c85c3d0ba6fb969cb
OBS-Studio-33.0.0-beta4-macOS-Intel.dmg: 47461ba641b88375da22f1fd74f476277ca5156fbbf54e0536b5f0eae487e2d5
Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:
xattr -cr /Applications/marktext.app
All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:
sha256sum -c SHA256SUMS.txt --ignore-missing
marktext on PATH on every platform by @Jocs in #5459any in .vue (#4257) by @Jocs in #5521Full Changelog: v0.20.0-rc.5...v0.20.0-rc.6
β
Welcome to the first beta for the 5.2 update! This new version has new effects and also has a big focus on performance, quality-of-life, and infrastructure improvements which prepare for the big 6.0 version that will be coming later. The two biggest changes are the new FileType plugin system and the rewritten high-precision layer rendering engine. There are also 8 new effects and very experimental support for running on Wine (Linux/Mac), which weβll get to later.
New FileType Plugin System
The original FileType plugin system dates back to 2005 with the v2.5 release. It has withstood the test of time in the sense that it still works and has provided a lot of value for a lot of people, but it has also noticeably aged poorly in ways that have prevented progress in other areas of the app. It was written at a time when .NET itself was just 3 years old and hitting its 2.0 release with generics and 64-bit support. The modern systems used in Paint.NET for component management and isolation were nowhere to be found back then. I had no clue that the projectβs longevity would stretch so far into the future, nor that so many plugins would be developed!
The old FileType plugin system is tightly coupled with the Document, Layer, and Surface classes which Paint.NET also uses internally for UI and rendering purposes. They only support the 32-bit BGRA UI8 pixel format and a flat list of bitmap layers. The new FileType system works through interfaces such as IFileTypeDocument<TPixel> and ILayer<TPixel>, along with a rich and strongly-typed imaging framework providing support for a wide variety of pixel formats, pooled bitmap allocation, scaling/interpolation, quantization/dithering, format conversion, color management, and more.
Decoupling the FileType system from the internal classes means that these two systems can now evolve independently, and internal details can be abstracted away from plugins. The new plugin system has been designed to support versioning, meaning that functionality can be added or changed in the programming interfaces that are provided to plugins while maintaining compatibility for plugins that have already been published. New layer types and topologies (e.g. layer folders) can be added without breaking existing plugins, new blend modes can be introduced, and bitmap layers can finally be migrated to a tiled storage system.
Note to plugin authors: In general, plugins should provide pixel data in the image fileβs original format without converting it to BGRA32. In other words, let Paint.NET handle the conversion, whether youβre supplying pixels as RGBA64, BGR24, or even an HDR format such as RGBA FP16. Paint.NET will figure out the best conversion for pixel format and color profile handling, and when expanded pixel format support is rolled out your plugin can automatically benefit from it. Note that plugins can query at runtime which pixel formats are supported and which are native, in case they do want to do the conversion themselves for whatever reason.
New Layer Rendering Engine
The old layer rendering engine has its roots going all the way back to the 1.0 release in 2004. Over the years it has migrated from C# to C for performance reasons, and then back to C# once the language and .NETβs JIT had finally caught up to (and surpassed!) the performance of the native C compilerβs code generation. However, it has no SIMD optimizations, it only has 8 bits per channel of precision (βUI8β), and the code was very messy and difficult to make changes to. Working with many layers can result in incorrect colors or banding artifacts as off-by-1 errors accumulate across multiple layers.Β
With 5.2, this has been completely rewritten and upgraded to use 32-bits of floating-point precision per channel (βFP32β). It is fully optimized for AVX2, AVX512, and even ARM64 NEON thanks to .NETβs new platform-agnostic intrinsics support. Because FP32 uses a lot more memory bandwidth than UI8, many tricks have been employed to optimize that to the point that there is no perceptible performance reduction from previous versions (the old renderer not using any SIMD also helps this comparison). The bottleneck is compute, not memory bandwidth, and performance really shines on CPUs with AVX512 support (e.g. AMD Zen 5) even with standard dual channel memory.
A driving factor behind this change was to prepare for future versions of Paint.NET that will expand pixel format support beyond BGRA UI8. In order to do this in a sane and maintainable manner, having a canonical pixel format became important so that each rendering kernel only needs to be written once. All of the rendering kernels can now operate exclusively on FP32 data, with high-performance format conversion and color transform kernels at the beginning and end of the rendering pipeline. This will make it much easier to add application-level support for RGBA UI16, RGBA FP16, and even RGBA FP32 β the layer rendering engine already supports it, the rest of the app just has to catch up.
New Effects
This release adds 8 new effects. These fill in the Artistic submenu, add some new dithering capabilities, two new distortion effects, and finally support for high-quality halftoning.
Examples of each new effect:
Original
Linocut
Mosaic
Pointilism
Stained Glass
Ordered Dither
Spherize
Waves
Halftone
Experimental Wine Support
NOTE: This is not for the faint of heart! It is very much experimental and targeted towards early adopters who arenβt afraid of missing functionality, performance issues, crashes, and wrestling with dependencies.
Iβve recently made major progress getting Paint.NET working on top of Wine, which means Paint.NET can now finally run on Linux and Mac. This was first made available as part of 5.2 Alpha (build 9739) and has now been moved into its own package that you can download from a separate GitHub page with its own Releases page and Issues tracker. Updates will be independent(-ish) of the main Windows packages, at least for the foreseeable future. Each new Windows release will be accompanied by a corresponding Wine release so that it doesnβt fall behind in functionality.
Whatβs coming in 6.0?
The next big update will introduce a new .PDN file format that will finally enable the ability to add new features to the document and layering systems. High bit-depth pixel formats, new blend modes, and layer folders are planned to be the first use of this. Later on, features such as adjustment layers, text layers, and HDR are also planned (to name just a few).
Change Log
Changes since 5.2 Alpha (build 9739) (sorry, I forgot to cross-post it to the blog):
Download and Install
This build is available via the built-in updater as long as you have opted-in to pre-release updates. From within Settings -> Updates, enable βAlso check for pre-release (beta) versions of Paint.NETβ and then click on the Check Now button. You can also use the links below to download an offline installer or portable ZIP.

You can also download the installer here (for any supported CPU and OS), which is also where you can find downloads for offline installers, portable ZIPs, and deployable MSIs.
For the experimental builds for Wine, you can go here to download them.
β
Β The Stable channel has been updated to 155.0.8059.12/.13 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
The Extended Stable channel has been updated to 152.0.7977.140Β for Windows and Mac which will roll out over the coming days/weeks.
The Chrome team is delighted to announce the promotion of Chrome 154 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.
Chrome 154.0.8037.57 (Linux)Β 154.0.8037.57/.58Β Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 154.
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 108 security fixes. Please see the Chrome Security Page for more information.
[$5,000][551573368] Critical CVE-2026-95350: Buffer overflow in ANGLE. Reported by Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, Pan Zhenpeng of STAR Labs SG Pte. LTd. on 2026-08-24
[$2,500][530045332] Critical CVE-2026-95357: Out of bounds write in GPU. Reported by Anymous on 2026-07-01
[TBD][548585299] Critical CVE-2026-95339: Use after free in ServiceWorker. Reported by Andrew Boni on 2026-08-18
[TBD][551708184] Critical CVE-2026-95281: Buffer overflow in ANGLE. Reported by Muhammad Alifa Ramdhan of STAR Labs SG Pte. Ltd. on 2026-08-24
[TBD][552665794] Critical CVE-2026-95313: Use after free in Fullscreen. Reported by WinD39 - Huynh Dinh Vu on 2026-08-26
[N/A][553172761] Critical CVE-2026-95349: Buffer overflow in WebGL. Reported by Google on 2026-08-27
[TBD][556435507] Critical CVE-2026-95284: Buffer overflow in ANGLE. Reported by Muhammad Alifa Ramdhan (STARLABS SG) on 2026-09-03
[TBD][556576992] Critical CVE-2026-95322: Out of bounds write in GPU. Reported by David Sievers (@loknop) on 2026-09-03
[N/A][559320837] Critical CVE-2026-95329: Out of bounds write in WebGL. Reported by Google on 2026-09-09
[TBD][560439699] Critical CVE-2026-95356: Use after free in WindowDialog. Reported by Xinyang Ge on 2026-09-12
[TBD][562151598] Critical CVE-2026-95310: Use after free in AdFilter. Reported by Xinyang Ge on 2026-09-16
[$5,000][540265100] High CVE-2026-95301: Missing authorization in Extensions. Reported by OGINOME Tomohito on 2026-07-29
[$5,000][543471693] High CVE-2026-95291: UI misrepresentation in SecurityIndicators. Reported by NH DEV on 2026-08-07
[N/A][508462481] High CVE-2026-95355: Incorrect authorization in Navigation. Reported by Google on 2026-05-01
[N/A][517661385] High CVE-2026-95315: Use after free in Aura. Reported by Google on 2026-05-29
[N/A][520516206] High CVE-2026-95298: Use after free in Browser. Reported by Google on 2026-06-05
[N/A][534997484] High CVE-2026-95372: Use after free in Chromecast. Reported by Google on 2026-07-15
[N/A][537857253] High CVE-2026-95324: Uninitialized resource in GPU. Reported by Google on 2026-07-22
[N/A][543141419] High CVE-2026-95283: Buffer overflow in Tint. Reported by Google on 2026-08-06
[TBD][550953039] High CVE-2026-95293: Uninitialized resource in GPU. Reported by TienPA - NGS Holdings on 2026-08-22
[N/A][553116160] High CVE-2026-95274: Improper output encoding in DevTools. Reported by Google on 2026-08-26
[N/A][553129513] High CVE-2026-95282: Use after free in Platform. Reported by Google on 2026-08-26
[N/A][553130481] High CVE-2026-95373: Use after free in DevTools. Reported by Google on 2026-08-26
[N/A][553136141] High CVE-2026-95277: Use after free in Views. Reported by Google on 2026-08-26
[N/A][554558320] High CVE-2026-95348: Use after free in Bluetooth. Reported by Google on 2026-08-29
[TBD][555299641] High CVE-2026-95335: Use after free in HID. Reported by WinD39 - Huynh Dinh Vu on 2026-09-01
[TBD][556535630] High CVE-2026-95338: Use after free in PDFium. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722) on 2026-09-03
[TBD][556576976] High CVE-2026-95318: Buffer overflow in Video. Reported by alex.laboirie on 2026-09-03
[TBD][557523002] High CVE-2026-95286: Type confusion in Bindings. Reported by @bean5oup on 2026-09-05
[TBD][558764482] High CVE-2026-95365: Type confusion in IndexedDB. Reported by HoneyBee on 2026-09-08
[TBD][559815527] High CVE-2026-95343: Use after free in WebAudio. Reported by HoneyBee on 2026-09-11
[N/A][560406548] High CVE-2026-95280: Race condition in V8. Reported by Google on 2026-09-12
[TBD][560536731] High CVE-2026-95304: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-12
[TBD][560536735] High CVE-2026-95306: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-12
[N/A][561997427] High CVE-2026-95299: Use after free in GPU. Reported by Google on 2026-09-15
[TBD][562242429] High CVE-2026-95351: Use after free in Views. Reported by Xinyang Ge on 2026-09-16
[N/A][495529018] Medium CVE-2026-95287: Missing authorization in Navigation. Reported by Google on 2026-03-23
[N/A][497204165] Medium CVE-2026-95366: Use of released resource in Core. Reported by Google on 2026-03-28
[N/A][497212105] Medium CVE-2026-95382: Improper input validation in Auth. Reported by Google on 2026-03-28
[N/A][497603247] Medium CVE-2026-95381: Improper input validation in Printing. Reported by Google on 2026-03-30
[N/A][500127519] Medium CVE-2026-95331: Out of bounds write in ANGLE. Reported by Google on 2026-04-06
[N/A][501648493] Medium CVE-2026-95297: Missing authorization in Contextual Tasks. Reported by Google on 2026-04-11
[N/A][502179319] Medium CVE-2026-95375: Incorrect authorization in BrowserTag. Reported by Google on 2026-04-13
[N/A][502242455] Medium CVE-2026-95302: Incorrect authorization in WebAPKs. Reported by Google on 2026-04-13
[N/A][511791538] Medium CVE-2026-95362: Cross-site request forgery in DevTools. Reported by Google on 2026-05-10
[N/A][513049042] Medium CVE-2026-95369: Inappropriate implementation in XML. Reported by Google on 2026-05-14
[N/A][513134076] Medium CVE-2026-95376: Externally controlled reference in DevTools. Reported by Google on 2026-05-14
[N/A][513162143] Medium CVE-2026-95359: Uninitialized resource in GPU. Reported by Google on 2026-05-14
[N/A][513992281] Medium CVE-2026-95294: UI misrepresentation in Browser. Reported by Google on 2026-05-17
[N/A][514019137] Medium CVE-2026-95337: UI misrepresentation in Messages. Reported by Google on 2026-05-17
[N/A][514059630] Medium CVE-2026-95346: UI misrepresentation in Chromoting. Reported by Google on 2026-05-17
[N/A][514072284] Medium CVE-2026-95320: Missing authorization in Navigation. Reported by Google on 2026-05-17
[N/A][514487499] Medium CVE-2026-95317: Incorrect authorization in MediaCapture. Reported by Google on 2026-05-19
[N/A][516404074] Medium CVE-2026-95345: Use after free in Actor. Reported by Google on 2026-05-25
[N/A][517163294] Medium CVE-2026-95330: Improper state validation in Downloads. Reported by Google on 2026-05-27
[N/A][517417437] Medium CVE-2026-95370: Inappropriate implementation in NFC. Reported by Google on 2026-05-28
[N/A][517442714] Medium CVE-2026-95303: Incomplete cleanup in SmartCard. Reported by Google on 2026-05-28
[N/A][517584808] Medium CVE-2026-95360: Race condition in Editing. Reported by Google on 2026-05-28
[N/A][517596255] Medium CVE-2026-95295: Information leak in Mobile. Reported by Google on 2026-05-28
[N/A][517730821] Medium CVE-2026-95276: Improper input validation in Themes. Reported by Google on 2026-05-29
[N/A][517802696] Medium CVE-2026-95314: Incorrect authorization in HID. Reported by Google on 2026-05-29
[N/A][520504291] Medium CVE-2026-95371: Missing authorization in Views. Reported by Google on 2026-06-05
[N/A][522061704] Medium CVE-2026-95353: Use after free in Bindings. Reported by Google on 2026-06-10
[N/A][522344883] Medium CVE-2026-95363: UI misrepresentation in FileSystem. Reported by Google on 2026-06-10
[N/A][523719002] Medium CVE-2026-95341: Improper input validation in Desktop. Reported by Google on 2026-06-14
[N/A][524582798] Medium CVE-2026-95354: Use after free in Verifier. Reported by Google on 2026-06-16
[N/A][526550688] Medium CVE-2026-95384: Race condition in Transactions Platform. Reported by Google on 2026-06-22
[N/A][532962621] Medium CVE-2026-95336: Information leak in Transactions Platform. Reported by Google on 2026-07-09
[N/A][536161355] Medium CVE-2026-95290: Missing authorization in NFC. Reported by Google on 2026-07-18
[N/A][536648933] Medium CVE-2026-95325: Use after free in ANGLE. Reported by Google on 2026-07-19
[TBD][542926849] Medium CVE-2026-95275: Incorrect reference resolution in MediaStream. Reported by Zabith Mohammed (@nmzabith) on 2026-08-05
[TBD][543464436] Medium CVE-2026-95374: Incorrect authorization in Network. Reported by NH DEV on 2026-08-07
[N/A][545449081] Medium CVE-2026-95300: Missing authorization in DevTools. Reported by Google on 2026-08-12
[TBD][545879261] Medium CVE-2026-95321: UI misrepresentation in Payments. Reported by jodyritonga on 2026-08-13
[TBD][546438368] Medium CVE-2026-95323: UI misrepresentation in Chromium. Reported by Wihdatu Nuuro Ahmadi on 2026-08-14
[N/A][546639650] Medium CVE-2026-95332: Use of uninitialized variable in Tint. Reported by Google on 2026-08-14
[N/A][547832510] Medium CVE-2026-95312: Information leak in Passwords. Reported by Google on 2026-08-17
[TBD][548611433] Medium CVE-2026-95344: Race condition in DevTools. Reported by @bean5oup on 2026-08-18
[TBD][549911100] Medium CVE-2026-95289: Incorrect authorization in Scroll. Reported by Vu Van Tien (@n0_Be3r) on 2026-08-21
[TBD][550181232] Medium CVE-2026-95347: Use after free in Updater. Reported by a45hif on 2026-08-21
[N/A][553123003] Medium CVE-2026-95311: Free of non-heap memory in Fonts. Reported by Google on 2026-08-26
[N/A][553141660] Medium CVE-2026-95358: Incorrect authorization in Mobile. Reported by Google on 2026-08-26
[TBD][559682346] Medium CVE-2026-95333: Use after free in Metrics. Reported by sean geofrey on 2026-09-10
[$500][423956129] Low CVE-2026-95307: UI misrepresentation in ExtensionsMenu. Reported by Hafiizh on 2025-06-11
[N/A][497094708] Low CVE-2026-95285: Missing authorization in WebView. Reported by Google on 2026-03-28
[N/A][497344014] Low CVE-2026-95278: Missing authorization in WakeLock. Reported by Google on 2026-03-29
[N/A][502077689] Low CVE-2026-95327: Information leak in Networking. Reported by Google on 2026-04-13
[N/A][513403696] Low CVE-2026-95334: Incorrect reference resolution in WebProtect. Reported by Google on 2026-05-15
[N/A][513714849] Low CVE-2026-95308: Integer overflow in Metrics. Reported by Google on 2026-05-16
[N/A][513781838] Low CVE-2026-95292: Incorrect authorization in Safebrowsing. Reported by Google on 2026-05-16
[N/A][513791872] Low CVE-2026-95352: Incorrect authorization in DevTools. Reported by Google on 2026-05-16
[N/A][514012689] Low CVE-2026-95279: UI misrepresentation in Omnibox. Reported by Google on 2026-05-17
[N/A][514524620] Low CVE-2026-95367: Information leak in DataTransfer. Reported by Google on 2026-05-19
[N/A][517192965] Low CVE-2026-95385: Inappropriate implementation in PlatformIntegration. Reported by Google on 2026-05-27
[N/A][522413520] Low CVE-2026-95368: Incorrect authorization in DevTools. Reported by Google on 2026-06-10
[N/A][523765972] Low CVE-2026-95319: Use after free in Printing. Reported by Google on 2026-06-14
[N/A][533041383] Low CVE-2026-95326: Incomplete cleanup in Bluetooth. Reported by Google on 2026-07-09
[N/A][533074595] Low CVE-2026-95309: UI misrepresentation in Mobile. Reported by Google on 2026-07-09
[N/A][533095855] Low CVE-2026-95361: Confused deputy in DevTools. Reported by Google on 2026-07-09
[N/A][533102653] Low CVE-2026-95288: UI misrepresentation in Mobile. Reported by Google on 2026-07-09
[N/A][534579660] Low CVE-2026-95380: Type confusion in V8. Reported by Google on 2026-07-14
[TBD][547027738] Low CVE-2026-95342: Missing authorization in V8. Reported by Hongwei Li, Zhun Wang, Ziyue Pan, Junmin Zhu, Saastha Vasan, and Wenbo Guo on 2026-08-16
[TBD][551296612] Low CVE-2026-95296: Missing authorization in Core. Reported by Quyα»n SΖ‘n (@zer0qs1337) on 2026-08-23
[N/A][552023752] Low CVE-2026-95316: Unchecked return value in Performance. Reported by Google on 2026-08-24
[N/A][553148673] Low CVE-2026-95328: Confused deputy in Mobile. Reported by Google on 2026-08-26
[N/A][553268567] Low CVE-2026-95340: Incorrect authorization in PictureInPicture. Reported by Google on 2026-08-27
[N/A][553271219] Low CVE-2026-95364: Improper input validation in Passwords. Reported by Google on 2026-08-27
[N/A][553921181] Low CVE-2026-95305: UI misrepresentation in Chromoting. Reported by Google on 2026-08-28
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
Fixed the NVDA screen reader not announcing address bar buttons when the mouse pointer moves over them. (Bug 2069276)
Fixed elements inside a link not showing their CSS :active styles while being clicked. (Bug 2067272)
Fixed Firefox becoming unresponsive on some pages that use CSS anchor positioning. (Bug 2070171)
Fixed Firefox windows on macOS 27 immediately returning to maximized after being restored by double-clicking the title bar. (Bug 2066632)
Fixed Firefox leaking system handles on Windows as content processes were started and stopped. (Bug 2069644)
Pressing Tab now moves focus straight to the text field of the address bar and search bar instead of stopping on the search engine button first. The button can still be reached with Shift+Tab.
Reference link to 156.0 release notes.
Below are development builds with the latest fixes and improvements. Please test them thoroughly and report problems immediately, so that any regressions can be fixed in time for next stable release.
Latest development build: 2.8.2.56 (October 7th 2026)
Latest stable release build: 2.8.2
https://github.com/clsid2/mpc-hc/releases/tag/2.8.2
Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:
xattr -cr /Applications/marktext.app
All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:
sha256sum -c SHA256SUMS.txt --ignore-missing
$β¦$ (#5446) by @Jocs in #5449Full Changelog: v0.20.0-rc.4...v0.20.0-rc.5
Β The Stable channel has been updated to 153.0.8010.52/.53 for Windows and Mac andΒ 153.0.8010.52 toΒ Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the LogΒ
Security Fixes and Rewards
[TBD][500417361] Critical CVE-2026-93374: Use after free in Dawn. Reported by Florian Schweitzer on 2026-04-08 [N/A][548085797] Critical CVE-2026-93372: Buffer overflow in WebGL. Reported by Google on 2026-08-17 [$3,000][550839154] High CVE-2026-93375: Incorrect reference resolution in Tracing. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-08-22 [TBD][541707261] High CVE-2026-93382: Use after free in PDFium. Reported by WinD39 - Huynh Dinh Vu on 2026-08-02 [N/A][553130676] High CVE-2026-93387: Improper state validation in Skia. Reported by Google on 2026-08-26 [N/A][553132214] High CVE-2026-93373: Use after free in Extensions. Reported by Google on 2026-08-26 [TBD][556853443] High CVE-2026-93381: Buffer overflow in PDFium. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722) on 2026-09-03 [TBD][560039872] High CVE-2026-93379: Incorrect authorization in ORB. Reported by OGINOME Tomohito on 2026-09-11 [N/A][560121552] High CVE-2026-93377: Type confusion in V8. Reported by Google on 2026-09-11 [N/A][498411599] Medium CVE-2026-93380: Race condition in FileSystem. Reported by Google on 2026-04-01 [N/A][511832293] Medium CVE-2026-93384: Server-side request forgery in Omnibox. Reported by Google on 2026-05-10 [N/A][515493668] Medium CVE-2026-93383: Information leak in Permissions. Reported by Google on 2026-05-22 [N/A][520521197] Medium CVE-2026-93376: Out of bounds read in DataTransfer. Reported by Google on 2026-06-05 [N/A][540051167] Medium CVE-2026-93378: Missing authorization in Storage. Reported by Google on 2026-07-28 [N/A][553136980] Medium CVE-2026-93385: Information leak in Paint. Reported by Google on 2026-08-26 [N/A][513996595] Low CVE-2026-93386: UI misrepresentation in WebAppInstalls. Reported by Google on 2026-05-17
Β The Extended Stable channel has been updated to 152.0.7977.134Β for Windows and Mac which will roll out over the coming days/weeks.
Updates:
Changes/additions:
Fixes:
Builds are unsigned (no Apple Developer ID). After dragging MarkText into Applications, clear the quarantine flag once:
xattr -cr /Applications/marktext.app
All artifacts are listed with their SHA-256 in SHA256SUMS.txt. Verify with:
sha256sum -c SHA256SUMS.txt --ignore-missing
Full Changelog: v0.20.0-rc.3...v0.20.0-rc.4
The Stable channel has been updated to 154.0.8037.44/.45 for Windows. as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.
You can find more details about early Stable releases here.
Interested in switching release channels? Β Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Srinivas Sista
Google Chrome
The Stable channel has been updated to 153.0.8010.47/.48 for Windows and Mac andΒ 153.0.8010.47Β for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the LogΒ
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but havenβt yet fixed.
This update includes 42 security fixes. Please see the Chrome Security Page for more information.
[N/A][556870863] Critical CVE-2026-91726: Out of bounds read in WebGL. Reported by Google on 2026-09-03 [TBD][557320614] Critical CVE-2026-91721: Use after free in Internals. Reported by xinyang on 2026-09-04 [TBD][558456602] Critical CVE-2026-91749: Use after free in Workers. Reported by WinD39 - Huynh Dinh Vu on 2026-09-08 [$1,500][552283275] High CVE-2026-91724: Use after free in Input. Reported by Hafiizh on 2026-08-25 [$1,000][556715288] High CVE-2026-91728: Integer overflow in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-03 [N/A][516780835] High CVE-2026-91734: Incorrect authorization in Core. Reported by Google on 2026-05-26 [N/A][516893912] High CVE-2026-91727: Incorrect reference resolution in Extensions. Reported by Google on 2026-05-26 [N/A][516947138] High CVE-2026-91743: Race condition in Core. Reported by Google on 2026-05-27 [N/A][520019273] High CVE-2026-91744: Race condition in PlatformIntegration. Reported by Google on 2026-06-04 [N/A][521486621] High CVE-2026-91712: Race condition in Extensions. Reported by Google on 2026-06-08 [N/A][521559611] High CVE-2026-91748: Race condition in Extensions. Reported by Google on 2026-06-09 [N/A][523470135] High CVE-2026-91720: Uninitialized resource in ANGLE. Reported by Google on 2026-06-13 [N/A][523554372] High CVE-2026-91731: Type confusion in Compositing. Reported by Google on 2026-06-13 [N/A][540016074] High CVE-2026-91747: Use after free in Skia. Reported by Google on 2026-07-28 [N/A][540021213] High CVE-2026-91733: Improper state validation in Skia. Reported by Google on 2026-07-28 [TBD][546413288] High CVE-2026-91741: Type confusion in CacheStorage. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-14 [TBD][547815507] High CVE-2026-91709: Type confusion in ServiceWorker. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17 [TBD][549225472] High CVE-2026-91717: Missing authorization in Android. Reported by jodyritonga on 2026-08-20 [N/A][552416113] High CVE-2026-91735: Incorrect authorization in WebUI. Reported by Google on 2026-08-25 [N/A][553115724] High CVE-2026-91708: Race condition in Network. Reported by Google on 2026-08-26 [N/A][553121008] High CVE-2026-91736: Use after free in DOM. Reported by Google on 2026-08-26 [N/A][553122373] High CVE-2026-91740: Uninitialized resource in Skia. Reported by Google on 2026-08-26 [N/A][553132148] High CVE-2026-91710: Use after free in WebAppInstalls. Reported by Google on 2026-08-26 [N/A][553133215] High CVE-2026-91718: Use after free in Core. Reported by Google on 2026-08-26 [N/A][554558368] High CVE-2026-91716: Use after free in Auth. Reported by Google on 2026-08-29 [N/A][556260782] High CVE-2026-91746: Integer overflow in Compositing. Reported by Google on 2026-09-02 [TBD][557206809] High CVE-2026-91729: Use after free in DigitalCredentials. Reported by sean geofrey on 2026-09-04 [TBD][558036280] High CVE-2026-91737: Use after free in PDF. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722) on 2026-09-06 [TBD][558342353] High CVE-2026-91711: Out of bounds write in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [TBD][558367547] High CVE-2026-91715: Type confusion in ServiceWorker. Reported by Cristian Di Nicola (@crih.exe) on 2026-09-07 [N/A][558734727] High CVE-2026-91745: Use after free in V8. Reported by Google on 2026-09-08 [TBD][474131239] Medium CVE-2026-91723: Race condition in WebAppInstalls. Reported by Luan Herrera (@lbherrera_) on 2026-01-07 [TBD][511062248] Medium CVE-2026-91732: Missing authorization in AppManifest. Reported by pakhunov.anton.n on 2026-05-08 [N/A][513858387] Medium CVE-2026-91742: Confused deputy in PriceTracking. Reported by Google on 2026-05-16 [N/A][517710554] Medium CVE-2026-91714: Observable discrepancy in Fonts. Reported by Google on 2026-05-29 [N/A][518032534] Medium CVE-2026-91725: Observable discrepancy in CSS. Reported by Google on 2026-05-29 [N/A][521951328] Medium CVE-2026-91739: Missing authorization in Transactions Platform. Reported by Google on 2026-06-09 [N/A][523715133] Medium CVE-2026-91713: Missing authorization in Browser. Reported by Google on 2026-06-14 [N/A][536450979] Medium CVE-2026-91738: Improper input validation in ANGLE. Reported by Google on 2026-07-19 [TBD][543640868] Medium CVE-2026-91730: Incomplete cleanup in GetUserMedia. Reported by Keita Sode and Daisuke Hatakeyama (SYZD Research) on 2026-08-07 [TBD][554953456] Medium CVE-2026-91722: Use after free in Input. Reported by TIENPA on 2026-08-31 [TBD][542115030] Low CVE-2026-91719: Code injection in XML. Reported by Zabith Mohammed (@nmzabith) on 2026-08-03
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Β The Extended Stable channel has been updated to 152.0.7977.130 for Windows and Mac which will roll out over the coming days/weeks.