If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
Added
Changed
Fixed
IMAP:
APPEND and COPY/MOVE into another account's mailbox do not change the JMAP EmailDelivery state.
SEARCH RETURN with MIN or MAX alongside ALL returns only the minimum and maximum in ALL, and SAVE combined with MIN or MAX and ALL or COUNT saves only the minimum and maximum instead of every match.
iTIP: Merging a received update does not copy the VTIMEZONE definitions it carries, so an occurrence moved by an external organizer can reference a TZID (for example W. Europe Standard Time) the stored event no longer defines, and Apple Calendar shows both the original and the moved occurrence.
OAuth: Loopback redirect URIs without a path (for example http://127.0.0.1:45678) are not matched against registered loopback URIs on any port and are rejected by dynamic client registration.
WebDAV: PROPFINDallprop returns DAV:current-user-principal, so Windows Explorer shows every file and folder under the account name.
Donations are appreciated. There is now a PayPal option.
Changes from 2.8.3 to 2.8.4:
Updates:
Updated MPC Video Renderer to version 0.10.10.2618
Changes/additions:
MPCVR now has an improved HDR to SDR tonemapping algorithm
Replaced statusbar audio icon. It now also shows channel count.
Fixes:
Fixed a regression in 2.8.3 that could cause a hang when first showing seek preview
Fixed an issue that could shrink window size when exiting fullscreen from another monitor with different DPI
Fixed some issues with capture graph building
Several small fixes and improvements
Full changelog
Full list of all changes since start of this project.
Overview of features
A lot of people seem to be unaware of some of the awesome features that have been added to MPC-HC in the past years. Here is a list of useful options and features that everyone should know about:
Click to expand
Play HDR video
This requires using either MPC Video Renderer (MPCVR) or madVR.
These renderers can be selected here:
Options > Playback > Output
With other video renderers, the colors will be wrong!
MPCVR is included and is the recommended and default renderer for modern systems. MadVR needs to be installed separately. MPCVR also supports Dolby Vision. MadVR does not.
For optimal performance you should change the hardware decoder to D3D11 in LAV Video Decoder settings when using MPCVR on Windows 10/11, because this renderer uses DirectX11.
The installer of MPC-HC is very basic (and that will not change).
I therefore recommend using K-Lite Codec Pack. That includes MPC-HC and other essential components. It has a very advanced installation that can automatically create file associations, and helps you with easy configuration of important MPC-HC settings, such as preferred subtitle language(s). It also does automatic configuration of renderer and hardware decoding, for best performance and HDR support.
The Standard version should be sufficient for most people. Use Full version of you like to use MadVR.
Modern GUI Theme (Dark or Light) or the old classic theme
Options > Player > User Interface
It is also possible to change the height of the seekbar and size of the toolbar buttons.
Plus there are options to show audio/video details in the statusbar, such as codec and resolution.
Customizable toolbar buttons
You can add/remove/re-order the player buttons.
There are also several different toolbar designs to choose from.
Video preview on the seekbar
Options > Player > User Interface > Hover type
Ability to search for subtitles
Press D for manual search.
Or enable automatic search in: Options > Subtitles > Misc
Adjust playback speed
Menu > Play > Playback rate
The buttons in the player that control playback rate take a 2x step by default. This can be customized to smaller values (like 10%):
Options > Playback > Speed step
If you have 1000 IQ you can even do smart stuff like setting playback rate change to mouse right-click + scrollwheel:
Options > Player > Mouse
Adjusting playback speed works best with MPC Audio Renderer or SaneAR. These audio renderers have automatic pitch correction, while DirectSound does not.
Options > Playback > Output > Audio Renderer
MPC-HC can remember recently played files and also their playback position, so you can resume playback from when you left
Options > Player > History
You can quickly seek through a video with Ctrl + Mouse Scrollwheel.
You can jump to next/previous file in a folder by pressing PageUp/PageDown.
You can right-click on the framestep button to step backwards. Some other buttons also have right-click actions, such as closing file by right-clicking stop.
You can perform automatic actions at end of file. For example to go to next file or close player.
Options > Playback > After Playback (permanent setting)
Menu > Play > After Playback (for current file only)
A-B repeat
You can loop a segment of a video. Press [ and ] to set start and stop markers.
You can rotate/flip/mirror/stretch/zoom the video
Menu > View > Pan&Scan
This is also easily done with hotkeys (see below).
There are lots of keyboard hotkeys and mouse actions to control the player. They can be customized as well.
Options > Player > Keys
Tip: there is a search box above the table.
You can hide GUI elements even in windowed mode
Options > User Interface > Hide Windowed Controls
That hides most GUI elements during playback. To show them simply move your mouse to bottom of window.
You can even hide everything except the video by pressing 1 (restore normal view with 3).
You can seek inside the playlist by simply typing text (when playlist window has the mouse focus).
MPC-HC also supports Blu-ray playback.
Only limitation is that you need to use a decrypting tool.
And it also does not support Blu-ray menus, but you can use the navigate menu in the player to select the content to play.
Added ability to load a secondary subtitle file to view two different subtitle tracks/languages at same time.
You can stream videos directly from Youtube and many other video websites
Put yt-dlp.exe in the MPC-HC installation folder.
Then you can open website URLs in the player: Menu > File > Open File/URL
You can even download those videos: Menu > File > Save a copy
Tip: to be able to download in best quality with yt-dlp, it is recommended to also put ffmpeg.exe in the MPC-HC folder.
Several YDL configuration options are found here: Options > Advanced
This includes an option to specify the location of yt-dlp.exe in case you don't want to put it in MPC-HC folder.
Note 1: You also need to install Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)
Note 2: For optimal Youtube support you may also need to put deno.exe in same folder as yt-dlp.
Note 3: yt-dlp nightly build (very latest version made daily)
Note 4: yt-dlp windows7 compatible build
Besides all these (new) features, there have also been many bugfixes and internal improvements in the player in the past years that give better performance and stability. It also has updated internal codecs. Support was added for CUE sheets, WebVTT subtitles, etc.
You should really take a few minutes to look through all the options pages if you are a new user or if you are upgrading from a very old version. Don't forget the advanced options page.
Subtitle downloads from OpenSubtitles may fail depending on time of day. This is due to our daily download quota being exceeded. Current amount of donations is barely enough to pay for the existing quota. So it is unlikely that quota can be increased and situation will get worse over time.
If you create an OpenSubtitles account and configure it in MPC-HC settings then you may be able to bypass the quota.
Options > Subtitles > Misc > Right-click on OpenSubtitles.com > Setup > Fill in username/password
Here’s another release, again nohing major. But there was one particular bug fix for the MP4 reader that fixes a potential loss of frames at the end of the end under certain, not too rare circumstances. Therefore I suggest everyone update.
You can download the source code or one of the packages. The Windows packages as well as the Linux AppImage are available already. The other Linux packages & the macOS disk image are still being built and will be available over the course of the next couple of hours.
mkvmerge: AVC/H.264: the stereo mode is now set from the frame packing arrangement SEI message in the video stream if neither the command line nor the container specifies one. This works for MP4, Matroska, AVC elementary stream and MPEG transport stream input and is already known during file identification. Implements the AVC part of #6309.
mkvmerge: HEVC/H.265: the stereo mode is now set from the frame packing arrangement SEI message in the video stream if neither the command line nor the container specifies one. This works for MP4, Matroska, HEVC elementary stream and MPEG transport stream input and is already known during file identification. Implements the HEVC part of #6309.
MKVToolNix GUI: multiplexer: added new actions to the tracks context menu for enabling/disabling all items belonging to the same source file as the selected item. Implements #6318.
Bug fixes
mkvmerge: MP4 reader: fixed losing video frames at the end of the file due to flushing the packetizers too early (when the first track ends instead of only when all tracks in the file have ended). Another byproduct is that BlockDuration attributes aren’t set for the last frame when they aren’t needed anymore. Fixes #6320.
MKVToolNix GUI: multiplexer: when identification fails due to an unrecognized or unsupported format, clicking the “Cancel” button in the error dialog shown no longer locks up the GUI in the state of “identification is still running”, which disabled most elements. Fixes #6298.
MKVToolNix GUI: chapter editor: when adding chapters mandatory elements set to their default values are removed in the underlying data structures. This restores consistency to how the chapter editor worked when copying values from the UI into them for the selected chapter. The result is that those elements won’t show up in saved XML/Matroska files even if they have never been selected in the UI. Fixes #6294.
macOS: GUI: fixed check boxes in lists such as the multiplexer’s track list being invisible on macOS 27 by patching the Qt bundled with the app. Patch by corticalcode, based on the fix J.D. Purcell proposed in QTBUG-150017. Fixes #6307.
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Note
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.20.2
New features / Improvements
Added form to directly create parts from info providers using a known ID (#1605)
Allow to paste files from clipboard into the URL field of attachments to upload them
Allow to create new attachments from an image in the clipboard
Added an "Export as CSV (formula escaped)" mode to avoid formula injection when importing CSVs into excels
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Anton Batishchev has announced the release of CobaltX 0.3, an updated build of the project's gaming-focused Linux distribution based on Arch Linux, with KDE Plasma 6, the Linux Zen kernel and a pre-installed gaming stack: "What's new in 0.3 'Fullscreened'? X Mode — a full-screen, controller-first game launcher....
Main changes between OpenWrt 25.12.5 and OpenWrt 25.12.6
Only the main changes are listed below. See the full changelog for details.
Security fixes
This release fixes several remotely triggerable vulnerabilities in core network
services that are enabled by default. Updating is strongly recommended.
uhttpd (web server, enabled by default with LuCI): uhttpd was updated to a newer version that fixes five published advisories, all reachable without authentication:
CVE-2026-102338 (High): memory-exhaustion denial of service caused by an unlimited number of HTTP request headers. GHSA-vhx4-3p5q-m59q
No CVE assigned (High): out-of-bounds write caused by a type confusion of the params field in POST /ubus/call/ requests. GHSA-2mpg-6wp5-435p
No CVE assigned (High): unlimited memory growth, because the URL path was leaked on every non-POST /ubus request. GHSA-83vv-qrc6-h3hx
No CVE assigned (Moderate): HTTP request smuggling (CL.0), because a keep-alive connection was reused while a request body was still unread. GHSA-c2wg-hcff-hqrm
No CVE assigned (Moderate): a leaked client reference on /ubus/subscribe/ could permanently block the listener. GHSA-wvgh-cm54-q6f6
Mbed TLS (default TLS library): update to 3.6.7, fixing multiple security vulnerabilities, including a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites (CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583, CVE-2026-50584, CVE-2026-50585, CVE-2026-50586, CVE-2026-50587, CVE-2026-50588, CVE-2026-50640, CVE-2026-50713, CVE-2026-54435, CVE-2026-54441). Mbed TLS is used by default, for example for HTTPS in uhttpd and in hostapd / wpa_supplicant.
hostapd / wpa_supplicant (WiFi):
No CVE assigned: fixes from the hostapd security advisory 2026-1 for missing validation when parsing multi-link (MLO, WiFi 7 / IEEE 802.11be) information. Invalid management frames sent without authentication could crash hostapd or wpa_supplicant or cause small memory corruption. In access point mode, only devices with WiFi 7 (802.11be) support are affected. In client mode, wpa_supplicant is affected in general. https://w1.fi/security/2026-1/
No CVE assigned (Moderate, CVSS 6.5): NULL pointer dereference in the APuP (Access Point Micro-Peering) beacon handling. A nearby attacker could crash hostapd by sending beacons from many spoofed BSSIDs. Only relevant if APuP is enabled (option apup, disabled by default). https://github.com/openwrt/openwrt/security/advisories/GHSA-78g5-4g76-r6jh
In builds using Mbed TLS, the check_cert_subject EAP server certificate check read uninitialized memory and could accept a certificate whose subject only matched as a prefix.
rpcd (LuCI backend, enabled by default with LuCI): two privilege escalation issues were fixed. They only matter on systems with additional LuCI users with limited (delegated) permissions:
LuCI applications and packages: several issues were fixed that let a logged-in user with limited (delegated) permissions run commands as root or store cross-site scripting (XSS) payloads. They only apply if the affected app is installed and the account/ACL in question exists:
ser2net / luci-app-ser2net (Critical, CVSS 9.9): a newline in a UCI option could add an extra ser2net connection that runs commands as root. GHSA-w6q2-vr4f-49x3
luci-app-lxc: path traversal and an ACL bypass allowed logged-in users without the LXC permission to get root access on the host (no advisory published).
luci-app-ddns / ddns-scripts: delegated DDNS users could run commands as root through the date format and other DDNS settings, which were passed to the shell without quoting (no advisory published).
luci-app-nut: delegated users could configure NUT notification commands that run as root. Write access is now limited to the admin user (no advisory published).
luci-app-adblock-fast (Moderate, CVSS 5.4): stored XSS in the status page through blocklist names. GHSA-q335-4c83-c88h
luci-app-https-dns-proxy (Moderate, CVSS 4.5): stored XSS in the status page through the resolver URL. GHSA-c6vf-395q-4jv6
luci-base: the URL path and user name are now escaped when logging, so crafted login requests can no longer inject text into the system log.
umdns (mDNS daemon, optional package): two out-of-bounds reads reachable by any host on the local network with crafted mDNS packets were fixed:
Many optional packages in the packages feed were also updated to new versions with
security fixes, among them curl 8.22.0, OpenSSH 10.6p1, unbound 1.26.1, BIND 9.20.29,
OpenVPN 2.7.7, strongSwan 6.0.7, HAProxy 3.2.21, expat 2.8.4, nghttp2 1.70.0,
libssh 0.12.2, c-ares 1.34.8, Tor 0.4.9.13, Knot DNS 3.5.7, PowerDNS 4.9.17,
PowerDNS Recursor 5.2.13, Exim 4.100.1, Python 3.13.15, Node.js 22.23.2, xz 5.8.3
and rsync 3.5.1. These packages are not part of the default images; update the
installed packages to get these fixes.
Beyond the issues listed above, this release fixes a number of further security
problems for which no CVE number or dedicated advisory was assigned. We strongly
recommend upgrading to the latest OpenWrt release and installing all available
package updates.
Important changes
WiFi: GCMP-256 and SAE-EXT-KEY are no longer offered by default
OpenWrt 25.12.0 to 25.12.5 offered the GCMP-256 pairwise cipher and, in some configurations, the SAE-EXT-KEY key management (SAE with a group-dependent hash, also called SAE-GDH) on WPA3 networks with WiFi 6 (HE) or WiFi 7 (EHT), but not in the way the Wi-Fi Alliance "WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide" describes it. This configuration caused connection problems, for example with Pixel 10 phones (#21486) and with 802.11r Fast Transition (#22200).
The WPA3 specification makes GCMP-256 and SAE-EXT-KEY mandatory for WiFi 7 and recommends them otherwise. When the configuration recommended by the Wi-Fi Alliance was enabled in the OpenWrt development branch, it turned out that about 15% of the client devices in use are not compatible with it. For example:
Some clients cannot connect when GCMP-256 is offered, already on WiFi 6, for example Nanoleaf devices, a Motorola/Unisoc phone and Linux laptops using iwd.
With 802.11r Fast Transition enabled, FT-SAE-EXT-KEY prevents some clients from connecting (for example a Samsung Galaxy Tab S10 FE) or makes them reboot shortly after connecting (for example a Poco X6).
Starting with 25.12.6, GCMP-256 and SAE-EXT-KEY are no longer offered by default in WPA3-Personal (sae) and WPA2/WPA3 mixed (sae-mixed) mode; only CCMP and plain SAE are offered. The old rsn_override option was removed.
We recommend using WPA3-Personal (sae) or WPA2/WPA3 mixed mode (sae-mixed). If some clients have problems with these modes, use the new WPA3-Personal Compatibility Mode (sae-compat, "WPA2-PSK/WPA3-SAE Compatibility Mode" in LuCI): WPA2 clients see a normal WPA2 network, while clients that support RSN overriding use WPA3.
Only enable GCMP-256 and SAE-EXT-KEY if you need them and if they do not cause problems with your clients. In LuCI, they are on the "Wireless Security" tab of the wireless network as "GCMP-256 pairwise cipher" and "SAE-EXT-KEY (SAE-GDH)". On the command line (replace default_radio0 with the name of your wifi-iface section):
uci set wireless.default_radio0.gcmp256='1'
uci set wireless.default_radio0.sae_ext_key='1'
uci commit wireless
wifi reload
gcmp256 offers GCMP-256 in addition to CCMP, but only if the WiFi driver supports GCMP-256. sae_ext_key offers SAE-EXT-KEY, and also FT-SAE-EXT-KEY when 802.11r is enabled.
DHCP client: the client identifier can be selected
Since OpenWrt 25.12.0, every device generates a random, UUID-based DUID on first boot and stores it in network.globals.dhcp_default_duid. The DHCPv6 client uses it as its DUID, and the DHCPv4 client sends it together with an interface-specific IAID as client identifier (DHCP option 61). This default follows the recommendation of RFC 4361 (https://www.rfc-editor.org/rfc/rfc4361) that DHCPv4 clients use the same DUID as DHCPv6, so the device is identified in the same way for DHCPv4 and DHCPv6. The UUID-based DUID format is defined in RFC 6355 (https://www.rfc-editor.org/rfc/rfc6355). OpenWrt 24.10 sent no client identifier with DHCPv4 and used a DUID-LL derived from the MAC address for DHCPv6. Some DHCP servers, including servers of some ISPs, do not work correctly with the new client identifier, and until now there was no way to go back to the old behavior.
OpenWrt 25.12.6 adds the new per-interface option sendclientid:
auto (default): use the client ID configured with the clientid option, else the default DUID of the device, else the MAC address. This is the behavior of 25.12.0 to 25.12.5 and follows RFC 4361.
global: always use the default DUID of the device, even if clientid is set.
hardware: use the MAC address of the interface (DHCPv4) or a DUID-LL derived from it (DHCPv6).
none (DHCPv4 only): do not send a client identifier at all.
We recommend keeping the default auto, which matches the behavior of OpenWrt 25.12.5. Only if the DHCP server of your ISP does not work with it, switch back to the behavior of OpenWrt 24.10 by setting none on the DHCPv4 interface and hardware on the DHCPv6 interface:
uci set network.wan.sendclientid='none'
uci set network.wan6.sendclientid='hardware'
uci commit network
service network reload
In LuCI, the option is called "Preferred client ID" and is on the "Advanced Settings" tab of the interface (Network → Interfaces → Edit). Select "None" for the DHCPv4 interface (wan) and "Hardware address" for the DHCPv6 interface (wan6). Note that the DHCP server sees a changed client identifier as a new client, so you may get a different IPv4 address or IPv6 prefix.
kernel: add support for FudanMicro FM25G01B/FM25G02B SPI-NAND (fixes a boot loop on new revisions of Keenetic KN-1812 / Netcraze NC-1812) and HeYangTek HYF1GQ4UDACAE SPI-NAND (found on some Keenetic KN-3411 units)
mediatek: MT7986 - correct the system timer rate, fixing clock drift (e.g. NTP running at the +500 ppm limit on the GL.iNet GL-MT6000)
mediatek (filogic): Cudy devices with DDR3 RAM - run the RAM at its rated speed of 1866 MT/s
mediatek (filogic): JioRouter AX6000 JIDU6101 - fix silently failing sysupgrade (SPI-NAND writes) and the U-Boot environment layout
mediatek (filogic): Keenetic / Netcraze devices - fix NMBM reserved block count, fixing boot on some units
mpc85xx: Freescale P2020RDB - switch to DSA (see "Upgrading" below); TP-Link TL-WDR4900 v1 - the WiFi on/off switch now works; Enterasys WS-AP3715i - fix boot and allow access to the U-Boot environment
mvebu: Turris MOX - fix sysupgrade, squashfs boot and USB 2.0 device detection; WiFi (mwifiex SDIO) and Bluetooth drivers are now included in the image
qualcommax: ASUS RT-AX89X - use LAN1 instead of the SFP port in failsafe mode (#23633)
qualcommbe: ipq95xx - check the image metadata on sysupgrade
realtek: D-Link DGS-1210-28P/MP - fix fan control
rockchip: NanoPi R3S (1 GB) - fix the PCIe link to the RTL8111H Ethernet chip
sunxi: H5 boards (e.g. NanoPi NEO 2) - fix USB
airoha: new PCS implementation, Ethernet LRO and HW-GRO support, many Ethernet driver fixes, AN7583 USB/PCIe PHY support, updated pin controller driver and thermal settings
WiFi fixes and improvements
The WPA3 defaults were reworked to follow the WPA3 specification and deployment guide:
GCMP-256 and SAE-EXT-KEY are no longer offered by default in sae and sae-mixed mode (see "Important changes" above)
Beacon protection is now enabled by default on supported devices when management frame protection (PMF / 802.11w) is enabled
SAE now offers the groups 19, 20 and 21 by default
New WPA3-Personal Compatibility Mode (sae-compat): WPA2 clients see a normal WPA2 network, while clients that support RSN overriding use WPA3
New transition_disable option to tell clients to stop falling back to older security modes on a WPA3-only network
On 6 GHz, SAE uses H2E only, and WPA2-only configurations are automatically switched to WPA3 so the radio comes up
LuCI shows the new options in the wireless settings and hides encryption modes that are not allowed on 6 GHz
WiFi client (wpa_supplicant) with WPA-Enterprise: fix EAP inner methods such as EAP-MSCHAPV2 (#24086), fix server certificate checks (altsubject_match, domain_match, domain_suffix_match), and accept the old priv_key / priv_key_pwd option names again, so EAP-TLS client configurations from 24.10 work again (#22599)
hostapd: fix EAP-TLS client mode with Mbed TLS 3.6.3 and newer
wifi-scripts: restore 802.11ad (60 GHz) support
wifi-scripts: the multicast_to_unicast option works again
hostapd: restore Link Measurement Report handling; beacon reports via ubus support the reporting detail parameter and include the raw report data
mac80211: update to 6.18.55 with many upstream fixes for ath10k, ath11k, iwlwifi, rtw88 and other drivers
ath9k: reset the hardware on init again, fixing problems on some devices
rtw88 (USB/SDIO): use a longer TX report timeout, fixing repeated "failed to get tx report from firmware" warnings in access point mode
mt76: backport fixes from Linux 6.18.55
iwinfo: fix corrupt scan results when wpa_supplicant is running; add new device IDs
iw: show RSN Override elements in scan results
Network and service improvements
DHCP client: new per-interface option sendclientid to choose the DHCPv4/DHCPv6 client identifier (see "Important changes" above)
ppp: on-demand dialing (demand option) works again. It was broken since the update to ppp 2.5.0 (#24454).
uhttpd: stricter and more robust HTTP parsing, lower latency (TCP_NODELAY), can bind to addresses that are not yet configured, and supports SNI-based redirects
umdns: many robustness fixes
L2TP: fix heavy packet fragmentation, seen for example with batman-adv over an L2TP tunnel over IPv4
Mobile broadband: uqmi and umbim now report the DNS servers in ifstatus also with peerdns disabled; support for the Quectel EG120K-EA modem (qmi_wwan); NCM support for Fibocom FG621-EA modems (e.g. ASUS 4G-AX56, TP-Link TL-MR500 v1)
adb: fix RSA authentication with Mbed TLS
Other changes
LuCI: new optional theme luci-theme-footstrap; the optional luci-mod-dashboard got live charts and a configurable layout; new apps luci-app-librespeed and luci-app-weechat
Core component updates
Linux kernel: update from 6.12.94 to 6.12.112
OpenSSL: update from 3.5.7 to 3.5.9 (multiple security fixes, see above)
Mbed TLS: update from 3.6.6 to 3.6.7 (multiple security fixes, see above)
wolfSSL: update from 5.9.1 to 5.9.4 (multiple security fixes, see above)
mac80211: update from 6.18.26 to 6.18.55
wireless-regdb: update from 2026.05.30 to 2026.09.03
nilfs-utils: update from 2.2.12 to 2.2.17
ca-certificates: update from 20260601 to 20260816 (refreshed root CA bundle)
wireguard-tools: update from 1.0.20250521 to 1.0.20260223
uhttpd, rpcd, umdns, odhcp6c and iwinfo: updated to newer upstream versions
Upgrading to 25.12.6
Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.
For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.
Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.
Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. fc0c518
Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. cd8dcfe
DHCP client identifier: Since 25.12.0, the DHCP clients identify the device with a UUID-based DUID instead of the MAC address. If your ISP's DHCP server has problems with this, set the new sendclientid option to get the behavior of OpenWrt 24.10 back, see "Important changes" above.
bcm53xx devices with NAND flash: Since 24.10, sysupgrade lost the configuration on these devices. This is fixed in 25.12.6, but because the fix is in the firmware that does the flashing, the upgrade to 25.12.6 loses the configuration one last time. Back up your configuration before upgrading and restore it afterwards. 67b18c1
Freescale P2020RDB: The switch was converted from swconfig to DSA. The configuration cannot be migrated, so upgrade without keeping the settings (sysupgrade -n).
TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in OpenWrt 25.12.1 to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).
Meraki MX60: Direct sysupgrade to 25.12.6 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.
Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).
Known issues
Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations. #22344
qualcommax/ipq50xx: Ethernet ports do not work. #25975
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The Synex distribution is based on Debian "Stable" and is available in several desktop editions. The project's latest snapshot, version 26.10.17, updates the base system and includes a COSMIC flavour running version 1.10.0 of the COSMIC desktop. "The COSMIC edition moves to version 1.10.0, accumulating the changes from....
Another SCS Fan Day Experience has come to an end, and what a fantastic time it has been! We were delighted to welcome 15 fans from all around the world to our offices in Prague for the fifth edition of this special event, bringing together members of our #BestCommunityEver who share a passion for our games and the worlds we create.
Throughout the day, our guests had the opportunity to explore our offices, meet some of our colleagues, and get a closer look at their work on Euro Truck Simulator 2 and American Truck Simulator. It was a wonderful opportunity to share stories, exchange ideas, and give our visitors a glimpse into everyday life at SCS Software, while also offering them a sneak peek at some of the exciting projects we have been working on.
Of course, no SCS Fan Day Experience would be complete without plenty of time to talk about our games! We loved seeing our guests get involved, share their thoughts, and enjoy spending time with members of our team. Events like these remind us how special our community is and how much it means to have such passionate players supporting our work from all corners of the globe.
A huge thank you to everyone who joined us for SCS Fan Day Experience Vol. 5! We hope you enjoyed your time with us in Prague as much as we enjoyed having you here. Your enthusiasm, curiosity, and support mean a lot to us, and we’re truly grateful to have had the opportunity to meet you all in person.
We're already looking forward to hosting another Fan Day and meeting even more of you! Don't forget to give our X/Twitter, Instagram, Facebook, Bluesky, and TikTok a follow, as you'll receive news from any upcoming events straight to your feed, or subscribe to our newsletter to stay informed. Until next time, keep on truckin'!
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. FunOS, an Ubuntu-based Linux distribution featuring the lightweight JWM window manager, has been updated to version 26.10. The new release expands the Broadcom wireless support and resolves screen blanking issues: "The FunOS team is proud to announce the release of FunOS 26.10, built on top of Ubuntu 26.10....
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Tony George has announced the availability of an updated version of Asmi Linux, an Ubuntu-based distribution with a customised Xfce desktop and "Asmi Settings", a custom-built system configuration utility. It is based on the newly-released Ubuntu 26.10: "Asmi Linux 26.10, based on Ubuntu 26.10 'Stonking Stingray', is now....
Fixed a crash in the browser migration code on Windows when the plugin path contained unicode characters [Warchamp7] (#552)
Fixed incorrect paths in the virtual camera install scripts [Fenrir] (#14028)
Hid the warning icon in the plugin manager for Legacy plugins [Warchamp7] (#14030)
Fixed leftover Replay Buffer hotkey code that was causing errors when switching profiles [prgmitchell] (#14014)
Fixed an issue where the browser local file handler could be invoked from a remote page served over an insecure context [Warchamp7] (#552)
Developer Info: Fixed an issue where building libobs with core modules disabled would fail [PatTheMav] (#14035)
Release Candidate 1 Changes
Fixed audio monitoring on browser sources briefly being enabled every time in Beta 1-6 [prgmitchell] (#14003)
Fixed browser sources appearing blank on refresh in Beta 1-6 [WizardCM] (#14003)
Fixed local network requests failing in browser sources in Beta 1-6 [WizardCM] (#14009)
Fixed Plugin Manager showing third-party plugins as missing when OBS is launched in Safe Mode in Beta 1-6 [Warchamp7] (#14001)
Fixed Plugin Manager removal button sometimes not removing missing plugins from the Plugin Manager in Beta 1-6 [Warchamp7] (#14008)
Fixed the Missing Encoders popup not showing in taskbar [Warchamp7] (#14010)
Fixed profile import failing on paths with a trailing slash [Ushkalovk] (#13863)
Developer Info: Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
Developer Info: Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
Beta 6 Changes
Fixed a crash during certain actions involving groups in Beta 1-5 [prgmitchell] (#13978)
Fixed scripting not working on macOS in Beta 1-5 [PatTheMav] (#13976)
Fixed game capture hooks not updating in Beta 1-5 [Warchamp7] (#13968)
Fixed clock Lua script not working in Beta 1-5 [RytoEX] (#13974)
Changed Safe Mode to not start WebSocket Server [FiniteSingularity/RytoEX] (#13984)
Removed support for FFmpeg 6.x and 7.x [RytoEX] (#13964)
Fixed duplicate "Save Replay" hotkey entries when switching profiles in Beta 1-4 [xtfo] (#13943)
Fixed warning dialogs on macOS not rendering rich text in Beta 1-4 [Warchamp7] (#13949)
Fixed source icon state appearing inverted in Beta 1-4 [Warchamp7] (#13953)
Fixed audio monitoring settings not saving in Beta 1-4 [Warchamp7] (#13951)
Fixed missing encoder check showing missing encoders in an output mode that is not currently selected in Beta 1-4 [Warchamp7] (#13950)
Fixed Windows updater not updating game capture and virtual camera in some cases in Beta 1-4 [Warchamp7] (#13939)
Beta 4 Changes
Fixed a CI and packaging issue. There are no application changes since Beta 1.
Beta 3 Changes
Fixed a CI issue. There are no application changes since Beta 1.
Beta 2 Changes
Fixed a versioning issue. There are no application changes since Beta 1.
33.0 New Features
Updated CEF from 127/6533 to 150/7871 [WizardCM] (#13900)
This is a massive update to the underlying framework used for browser sources and docks from the July 2024 release to September 2026
All of this work is on the backend and should be invisible to users. Please be sure to report any new weirdness or problems you run into with browser sources!
Complete overhaul to plugin loading [FiniteSingularity/PatTheMav] (#13594)
First-party plugins are now in a new folder named core
Third-party plugins have an updated installation location and folder structure
Existing third-party plugins will continue to load from the legacy locations until OBS Studio 34.0
Added a startup error if obs-transitions failed to load [notr1ch] (#13321)
Improved file splitting for Hybrid MP4/MOV [derrod] (#13386)
Fixed outputs getting stuck running when a bad rescale output resolution is set [suogesi] (#13375)
Fixed monitoring icon state getting desynced when using third-party tools or websockets [prgmitchell] (#13822)
Fixed potential crash when shader cache file is invalid [notr1ch] (#13538)
Fixed a potential crash on Linux when USB mic is removed [R0te/RytoEX] (#13922)
Fixed a potential crash when renaming a source with the Add Source window open [Warchamp7] (#13800)
Fixed a potential deadlock during video/audio tasks [exeldro] (#13579)
Fixed an issue with B-frame offset calculation in AMF that could cause streams to disconnect [lexano-ivs] (#13762)
Fixed PipeWire screencast sources being duplicated in studio mode [tytan652] (#13673)
Fixed a potential crash when switching off a newly created profile [Warchamp7] (#13182)
Fixed a source toolbar crash when source type is missing [Penwy] (#13539)
33.0 Developer Information
Added frontend event and output signal for replay buffer saving [Penwy] (#8955)
Added guidance regarding the theme system to the top of all theme files [Warchamp7] (#13733)
Added ability to set a file extension filter for OBS_PATH_FILE_SAVE path types [FiniteSingularity] (#10190)
Added obs_frontend_is_safe_mode for first-party plugins
Third-party plugins are not loaded at all in Safe Mode
Added versions to Flatpak plugin extension point [tytan652] (#13735)
Added obs_canvas_video_active() to check if the video of a canvas is active [exeldro] (#13110)
The minimum supported versions of Visual Studio, Windows SDK, and clang-format have been increased. Previous versions may continue to work, but will no longer be tested/supported. It is recommended that build environments are kept up-to-date with the project's toolchain.
Changed Windows builds to use Visual Studio 2026 and SDK 26100 [RytoEX] (#13543)
Changed clang-format version used to 22.1.3 [PatTheMav] (#13549)
Changed obs_canvas_reset_video() to allow resetting a canvas's video when any other canvas's video is active, but not its own video [exeldro] (#13110)
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. IceWhale Technology has released an updated build of ZimaOS, an independently-developed, Linux-based operating system for personal servers and network-attached storage (NAS) computers. The new ZimaOS 1.8.0 brings improvements to its Gallery module: "ZimaOS 1.8.0. New: added a Gallery feature that supports adding photo sources and browsing photos and....
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The Voyager Live project has published a new release, version 26.10. The new release is offered in two editions, one with Flatpak and one with Snap package support. "I present to you Voyager 26.10, based on Ubuntu 'Stonking Stingray'. Two standard editions are offered - one based on....
We’re excited to share a closer look at three new editions of the DAF XG+ coming to Euro Truck Simulator 2 with the 1.62 Update! Featuring distinctive paint jobs, exclusive exterior accessories, and specially designed interiors, the Emerald, Sapphire, and 30 Years in Czechia Editions each bring their own unique character to the road.
Whether you prefer the elegant look of deep green, the striking appearance of sapphire blue, or a special edition celebrating three decades of DAF in the Czech Republic, there is plenty to discover. Let’s take a closer look at what these new configurations have to offer!
DAF XG+ 30 Years in Czechia Edition
The DAF XG+ 30 Years in Czechia Edition celebrates DAF’s 30-year presence in the Czech Republic with a special design inspired by the brand’s heritage. Its traditional royal orange paint job is complemented by unique anniversary logos, creating a distinctive appearance that pays tribute to this milestone.
The exterior features exclusive details, including a black air intake grille with painted trim, a matching black sunshield, and a choice of black or original roof lights. The truck also receives a unique black DAF badge, linked to the engine power configuration, with the option to switch back to the original silver version. An additional black anniversary badge beneath the side XG+ badge adds another special touch.
The wheel setup also received dedicated attention, with exclusive rear wheel covers and black wheel nuts with matching caps. Completing the exterior look is an illuminated DAF logo.
Inside the cab, drivers can enjoy an exclusive Czech 30th Anniversary interior, designed specifically for the XG+ cab. The new seats feature embroidered DAF 30 logos and premium upholstery, combining black leather or high-quality Alcantara fabric accents with detailed orange diamond-pattern stitching.
The upper bunk also receives special treatment, featuring Alcantara upholstery with a subtle grey pattern inspired by the Czech flag. Together, these details create a distinctive interior that celebrates the anniversary while maintaining the premium feel of the DAF XG+.
DAF XG+ Emerald Edition
For drivers who appreciate a refined and distinctive appearance, the DAF XG+ Emerald Edition introduces a striking Forest Dawn green paint job. This rich colour is complemented by a collection of exclusive exterior details and interior finishes, creating a cohesive look throughout the truck.
The exterior features a grille with painted trim, a coloured sunshield, and a white DAF logo. An exclusive Emerald side badge further distinguishes this edition from the standard DAF XG+.
The attention to detail continues around the cab, with a black door handle featuring a painted accent, black side window trim, and a unique chassis side skirt with matching painted details for the 4x2 chassis configuration.
Inside, the Emerald Edition features an exclusive interior designed to complement its green exterior. Drivers will find dedicated floor mats and a distinctive diamond-pattern design inspired by emeralds, featured on the mattress and upper bunk. Specially designed curtains complete the interior, adding another layer of character to this edition.
DAF XG+ Sapphire Edition
Completing the trio is the DAF XG+ Sapphire Edition, featuring a Sapphire Blue paint job.
The Sapphire Edition features a distinctive black DAF logo, side window trim, and a painted chassis side skirt on the 4x2 chassis. These details give the truck its own identity while maintaining the premium atmosphere of the DAF XG+.
Three Editions, One DAF XG+
Each of these three new DAF XG+ editions brings something different to the road. The 30 Years in Czechia Edition celebrates an important milestone with heritage-inspired styling and anniversary details, while the Emerald and Sapphire Editions focus on distinctive colours and coordinated accessories.
Whether you’re drawn to the anniversary details of the 30 Years in Czechia Edition or the elegant colours of the Emerald and Sapphire Editions, these new configurations offer plenty of ways to make your DAF XG+ stand out on the road. We hope you’ll enjoy discovering these new editions and making them your own when they arrive with the 1.62 Update!
As always, we’d love to hear which of these three editions is your favourite. Make sure to give our X/Twitter, Instagram, Facebook, Bluesky, and TikTok a follow, as you'll receive news from any upcoming updates straight to your feed, or subscribe to our newsletter to stay informed. Until next time, happy trucking!
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Last but not least, Lubuntu, an official Ubuntu flavour which uses the Lightweight Qt Desktop Environment (LXQt), has also been updated to version 26.10: "Thanks to the hard work from our contributors, Lubuntu 26.10 has been released. With the code name 'Stonking Stingray', Lubuntu 26.10 is the 31st....
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Kubuntu, a desktop Linux distribution that combines the power of Ubuntu with the KDE Plasma desktop, has reached version 26.10: "Kubuntu 26.10, code-named 'Stonking Stingray', is out today, released on the same day as the Ubuntu 26.10 base. It is an interim release, supported with security updates and....
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Ubuntu Kylin, a community edition of Ubuntu optimised for users in China and featuring a custom desktop called UKUI, has been upgraded to version 26.10: "On October 15, 2026, the Kylin team officially released Ubuntu Kylin 26.10, which will be supported for 9 months. Based on the Linux....
OpenCode 1 now stays on the 1.x release line: update checks use only the npm opencode-ai latest version, so 1.x installs are never offered a 2.x build as a regular update.
Upgrading to OpenCode 2 remains a separate, explicit choice through the 2.0 offer in /update or opencode upgrade --major.
Fix upgrades for installs managed by yarn.
Skip 1.x updates for Homebrew Core installs, which now track OpenCode 2, and check tap and Chocolatey availability before offering an update.
The install script refuses to install 2.x versions.
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Ubuntu Unity is a community edition of Ubuntu featuring Canonical's former desktop environment, Unity. The project's 26.10 release focuses on maintenance and bug fixes: "Ubuntu Unity 26.10 'Stonking Stingray' is out. This release was focused mostly on maintenance, packaging updates, adaptation to general changes in Ubuntu 26.10 and....
The Extended Stable channel has been updated to 152.0.7977.169for Windows and Mac which will roll out over the coming days/weeks.
Security Fixes
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
1.15.0 opens the plugin system up: plugins can add UI in most places of the app, hear and stop most actions, and use accounts and API keys through the server without seeing them, and users can install their own plugins once an admin has reviewed the code. Opening folders and messages is faster, with far fewer re-renders and requests. Calendars get default reminders, notifications can be muted per folder or account, and every sign-in is now remembered unless the admin shows the Remember me box.
Notifications: Folders and whole accounts can be muted from the folder context menu. A muted folder or account sends no push notifications and shows a muted mark in the sidebar (#1169, thanks @xnilsit)
Calendar: Each calendar has default reminders, set in calendar management. New events start on them, an event that switches back to the defaults picks up the current ones, and the event popover lists every reminder (#1209, thanks @rich0)
Calendar: Each reminder can be a notification or an email (#1209, thanks @rich0)
Accounts: Shared mail accounts can be hidden from the sidebar, from their context menu or under Settings > Layout (#1228, thanks @chodid)
Mail: The prompt before deleting several messages can be turned off (#1225, thanks @mmomjian)
UI: In Mountain View, several messages of a conversation can be open at once, the compose window stays open while reading other mail, and the selection is kept while reading a message (#1222, #1229, #1231, thanks @mmomjian)
UI: Ctrl+K opens a command palette, and a notifications panel collects plugin notifications and app errors
Admin: "Custom From Address" under Admin > Policy turns off the free-text sender address in the composer, so users can only send as their identities
Admin: Without a configured SESSION_SECRET, one is generated on first start and kept in data/admin-state. Keep that folder on a persistent volume
Plugins: Users can install their own plugins from Settings > Plugins when the admin allows uploads. The server reads the manifest and code itself, the admin reviews the actual code in the Plugins tab before approving, and the approval is checked again on every start. Settings lists in plain words what each plugin may do
Plugins: Plugins can add UI to the message list, reader, composer, sidebar, top bar, calendar, contacts, tasks, files and settings, and pages of their own with a navigation entry. Every area has its own permission
Plugins: Plugins are told about sign-in, navigation, mail, folder, calendar, contact, task, file, template, identity, filter, preference and theme changes, and can stop most of them
Plugins: Plugins can read messages and folders, move and archive messages, open a filled-in composer or a reply, edit the message being written, save drafts, read and change events and tasks, and manage templates, signatures and the out-of-office reply
Plugins: Users connect accounts for plugins in a dialog the plugin can't read, and plugins use those accounts and admin-set API keys through the server without seeing them
Plugins: The UI kit gives plugins the app's own controls and dialogs, plus side panels, detail rows, colour dots, labelled check boxes and a change preview
Plugins: Marketplace installs check the extension directory's signature
Changes
Login: The Remember me box is hidden by default and every sign-in is remembered. Set LOGIN_SHOW_REMEMBER_ME=true to show the box again
Performance: Opening a message, switching folders and searching render much less. Message rows, the folder sidebar and the reading pane only redraw what changed, a visited folder reopens without reloading, and a message starts loading when the mouse is pressed on it
Performance: Login loads the mailboxes and first page once instead of twice, the mail view's code loads while the login form is shown, and large HTML messages open with one request instead of two
Performance: Search results show before their highlighted excerpts arrive, and the list stays on screen while a search runs
Fixes
Send: Attachments stay sendable after the server's upload time limit runs out (#1243, thanks @lemourin)
Send: Uploads over 10 MB that pass through the server, such as office documents saved from the editor, are no longer cut off
Login: The sign-in response stays small enough for proxies when OIDC tokens are large, so logins on a subdomain no longer fail with a 502 (#1237, thanks @kadogams)
Login: Lite reloads into the login page instead of a missing route
Mail: The storage quota counts against the soft limit when the server sets one (#1242, thanks @somus)
Mail: The All mail and All unread views leave out a server's own "all" mailbox (#1241, thanks @somus)
Mail: Contacts, filters, calendars and files are only offered for shared accounts that support them (#1239, thanks @somus)
Mail: User folders named like system folders, such as "Spam reports", get the plain folder icon (#1235, thanks @dlrudie)
Mail: ISO timestamps are no longer offered as verification codes (#1236, thanks @mmomjian)
Mail: Shift-click selects the rows shown between the two ends instead of messages in other conversations from that time span (#1230, thanks @mmomjian)
Mail: The message list no longer reorders or repaints when switching accounts, and the loading skeleton no longer flickers after a reload or account switch
Mail: In Mountain View, a message opens together with its conversation, and threads open as a conversation on the phone (#1223, #1224, thanks @mmomjian)
Identities: A new identity is created without blank signatures (#1240, thanks @somus)
Composer: A cell range pasted from Excel becomes a table instead of an image (#1233, thanks @soringabrielalbu)
Composer: Text typed under the signature stays when the signature is swapped or removed, and picking a From address without a signature removes the old one
Composer: Dropped files no longer insert their path into the message body
Composer: The top and bottom bar buttons are easier to hit on a phone
Calendar: Invitations and replies carry the sender's Message-ID
Contacts: The contact name stays readable when the detail pane is narrow
UI: The iOS app gets its full screen height back after resuming (#1226, thanks @mmomjian)
UI: An attachment's download and menu buttons show when the keyboard reaches them
Plugins: A message is never sent when a plugin that checks it before sending fails or does not answer, and plugins can no longer block or stall sign-out
Plugins: Privileged plugins need a signed bundle, plugin network access is limited to the origins in the manifest, plugin bundles are only served to signed-in users, and slot plugins only get messages, events or contacts with the matching read permission
Plugins: Plugin and theme packages are checked the same way on every install path, marketplace bundles whose id differs from the directory entry are refused, and Theme API v2 themes install from the admin page and the marketplace
Plugins: A deleted or disabled theme is no longer forced, an extension keeps its admin state on re-upload, and a plugin's stored data is cleared when the admin removes it
Plugins: Plugins start once on every page, get their default settings, follow setting and language changes without a reload, and lay out right-to-left in Arabic, Hebrew and Persian
Plugins: Actions a plugin stopped are no longer reported as done
Plugins: Plugin buttons and panels fold away in narrow composers, toolbars and phone layouts instead of overlapping, and plugin frames keep the app's theme in dark mode
Translations: The new plugin, calendar reminder and notification strings are translated, and "composer" and the certificate subject are no longer translated as a music composer and an email subject
The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. The Ubuntu Cinnamon project has published version 26.10, code name 'Stonking Stingray', which features the Cinnamon 6.6.9 desktop. release notes list the desktop updates: "It’s that time again. I am happy to announce that Ubuntu Cinnamon 26.10 'Stonking Stingray' has been released. A lot of the changes are....
The Stable channel has been updated to 155.0.8059.84/.85 for Windows andMac and 155.0.8059.84 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 10 security fixes. Please see the Chrome Security Page for more information.
[N/A][568719351] Critical CVE-2026-110922: Use after free in Prerender. Reported by Xinyang Ge on 2026-10-02 [N/A][567638392] High CVE-2026-110913: Memory corruption in DOM. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29 [N/A][568831769] High CVE-2026-110919: Use after free in V8. Reported by Xinyang Ge on 2026-10-02 [N/A][568937999] High CVE-2026-110918: Memory corruption in Core. Reported by Google on 2026-10-03 [TBD][569038297] High CVE-2026-110917: Memory corruption in SVG. Reported by C0rk1 on 2026-10-03 [N/A][569286602] High CVE-2026-110921: Use after free in V8. Reported by Xinyang Ge on 2026-10-05 [N/A][569659194] High CVE-2026-110920: Memory corruption in V8. Reported by Xinyang Ge on 2026-10-05 [N/A][501886301] Medium CVE-2026-110916: Improper input validation in Desktop. Reported by Google on 2026-04-12 [N/A][556272421] Medium CVE-2026-110915: Use after free in Compositing. Reported by Google on 2026-09-02 [N/A][563194341] Medium CVE-2026-110914: Memory corruption in Workers. Reported by Google on 2026-09-18
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.
Log in
