Google Chrome Releases

Stable Channel Update for ChromeOS / ChromeOS Flex

2026-10-09T16:46:54.569-07:00

The Stable channel is being updated to OS version 16805.33.0 (Browser version 154.0.8037.151) for most ChromeOS devices.

If you find new issues, please let us know one of the following ways

File a bug
Visit our ChromeOS communities

General: Chromebook Help Community
Beta Specific: ChromeOS Beta Help Community

Report an issue or send feedback on Chrome

Interested in switching channels? Find out how.

Alon Bajayo,
Google ChromeOS

ChromeOS Vulnerability Rewards Program Reported Bug Fixes:

N/A

Other 3rd Party Security Fixes Included:

High Fixes mali_kbase: use-after-free write in delete_hoarded_chunks allows GPU-process to kernel memory corruption

High Fixes Potential StartArcVm unvalidated wayland_server field leads to crosvm sandbox weakening

Android Security fixes can be found here

Chrome Browser Security Fixes:

[$TBD] [562242429] High CVE-2026-95351 Use after free in Views Reported by [Xinyang Ge ] on 2026-09-15

[$TBD] [562151598] Critical CVE-2026-95310 Use after free in AdFilter Reported by [Xinyang Ge ] on 2026-09-15

[$TBD] [560439699] Critical CVE-2026-95356 Use after free in WindowDialog Reported by [Xinyang Ge ] on 2026-09-12

[$TBD] [560536735] High CVE-2026-95306 Type confusion in V8 on 2026-09-12

[$TBD] [560536731] High CVE-2026-95304 Out of bounds write in V8 on 2026-09-12

[$TBD] [560406548] High CVE-2026-95280 Race condition in V8 on 2026-09-11

[$1000.0] [559815527] High CVE-2026-95343 Use after free in WebAudio Reported by [HoneyBee] on 2026-09-10

[$TBD] [559682346] Medium CVE-2026-95333 Use after free in Metrics on 2026-09-10

[$TBD] [558764482] High CVE-2026-95365 Type confusion in IndexedDB Reported by [~~Anaconda~~ HoneyBee] on 2026-09-08

[$500.0] [557523002] High CVE-2026-95286 Type confusion in Bindings on 2026-09-05

[$TBD] [556576976] High CVE-2026-95318 Buffer overflow in Video on 2026-09-03

[$1000.0] [556535630] High CVE-2026-95338 Use after free in PDFium on 2026-09-03

[$TBD] [555299641] High CVE-2026-95335 Use after free in HID Reported by [WinD39 - Huynh Dinh Vu] on 2026-08-31

[$TBD] [554558320] High CVE-2026-95348 Use after free in Bluetooth on 2026-08-29

[$TBD] [553921181] Low CVE-2026-95305 UI misrepresentation in Chromoting on 2026-08-28

[$TBD] [553271219] Low CVE-2026-95364 Improper input validation in Passwords on 2026-08-26

[$TBD] [553268567] Low CVE-2026-95340 Incorrect authorization in PictureInPicture on 2026-08-26

[$TBD] [553136141] High CVE-2026-95277 Use after free in Views on 2026-08-26

[$TBD] [553130481] High CVE-2026-95373 Use after free in DevTools on 2026-08-26

[$TBD] [553129513] High CVE-2026-95282 Use after free in Platform on 2026-08-26

[$TBD] [553123003] Medium CVE-2026-95311 Free of non-heap memory in Fonts on 2026-08-26

[$TBD] [553116160] High CVE-2026-95274 Improper output encoding in DevTools on 2026-08-26

[$TBD] [552665794] Critical CVE-2026-95313 Use after free in Fullscreen Reported by [WinD39 - Huynh Dinh Vu] on 2026-08-26

[$TBD] [552023752] Low CVE-2026-95316 Unchecked return value in Performance on 2026-08-24

[$TBD] [550953039] High CVE-2026-95293 Uninitialized resource in GPU on 2026-08-22

[$TBD] [549911100] Medium CVE-2026-95289 Incorrect authorization in Scroll on 2026-08-21

[$TBD] [548611433] Medium CVE-2026-95344 Race condition in DevTools on 2026-08-18

[$2500.0] [548585299] Critical CVE-2026-95339 Use after free in ServiceWorker on 2026-08-18

[$TBD] [547832510] Medium CVE-2026-95312 Information leak in Passwords Reported by [[goes here]] on 2026-08-17

[$TBD] [547027738] Low CVE-2026-95342 Missing authorization in V8 Reported by [Hongwei Li, Zhun Wang, Ziyue Pan, Junmin Zhu, Saastha Vasan, and Wenbo Guo] on 2026-08-16

[$TBD] [545449081] Medium CVE-2026-95300 Missing authorization in DevTools on 2026-08-12

[$TBD] [543464436] Medium CVE-2026-95374 Incorrect authorization in Network Reported by [NH DEV] on 2026-08-06

[$TBD] [542926849] Medium CVE-2026-95275 Incorrect reference resolution in MediaStream on 2026-08-05

[$5000.0] [540265100] High CVE-2026-95301 Missing authorization in Extensions on 2026-07-29

[$TBD] [537857253] High CVE-2026-95324 Uninitialized resource in GPU on 2026-07-22

[$TBD] [536648933] Medium CVE-2026-95325 Use after free in ANGLE on 2026-07-19

[$TBD] [536161355] Medium CVE-2026-95290 Missing authorization in NFC on 2026-07-17

[$TBD] [534997484] High CVE-2026-95372 Use after free in Chromecast on 2026-07-14

[$TBD] [534579660] Low CVE-2026-95380 Type confusion in V8 on 2026-07-13

[$TBD] [533095855] Low CVE-2026-95361 Confused deputy in DevTools on 2026-07-09

[$TBD] [533041383] Low CVE-2026-95326 Incomplete cleanup in Bluetooth on 2026-07-09

[$TBD] [532962621] Medium CVE-2026-95336 Information leak in Transactions Platform on 2026-07-09

[$TBD] [524582798] Medium CVE-2026-95354 Use after free in Verifier on 2026-06-16

[$TBD] [523719002] Medium CVE-2026-95341 Improper input validation in Desktop on 2026-06-13

[$TBD] [522413520] Low CVE-2026-95368 Incorrect authorization in DevTools on 2026-06-10

[$TBD] [522344883] Medium CVE-2026-95363 UI misrepresentation in FileSystem on 2026-06-10

[$TBD] [522061704] Medium CVE-2026-95353 Use after free in Bindings on 2026-06-09

[$TBD] [520516206] High CVE-2026-95298 Use after free in Browser on 2026-06-05

[$TBD] [517802696] Medium CVE-2026-95314 Incorrect authorization in HID on 2026-05-29

[$TBD] [517730821] Medium CVE-2026-95276 Improper input validation in Themes on 2026-05-28

[$TBD] [517661385] High CVE-2026-95315 Use after free in Aura on 2026-05-28

[$TBD] [517584808] Medium CVE-2026-95360 Race condition in Editing on 2026-05-28

[$TBD] [517442714] Medium CVE-2026-95303 Incomplete cleanup in SmartCard on 2026-05-28

[$TBD] [517417437] Medium CVE-2026-95370 Inappropriate implementation in NFC on 2026-05-28

[$TBD] [517163294] Medium CVE-2026-95330 Improper state validation in Downloads on 2026-05-27

[$TBD] [516404074] Medium CVE-2026-95345 Use after free in Actor on 2026-05-25

[$TBD] [514524620] Low CVE-2026-95367 Information leak in DataTransfer on 2026-05-18

[$TBD] [514487499] Medium CVE-2026-95317 Incorrect authorization in MediaCapture on 2026-05-18

[$TBD] [514072284] Medium CVE-2026-95320 Missing authorization in Navigation on 2026-05-17

[$TBD] [514059630] Medium CVE-2026-95346 UI misrepresentation in Chromoting on 2026-05-17

[$TBD] [513992281] Medium CVE-2026-95294 UI misrepresentation in Browser on 2026-05-17

[$TBD] [513791872] Low CVE-2026-95352 Incorrect authorization in DevTools on 2026-05-16

[$TBD] [513781838] Low CVE-2026-95292 Incorrect authorization in Safebrowsing on 2026-05-16

[$TBD] [513714849] Low CVE-2026-95308 Integer overflow in Metrics on 2026-05-15

[$TBD] [513403696] Low CVE-2026-95334 Incorrect reference resolution in WebProtect on 2026-05-14

[$TBD] [513134076] Medium CVE-2026-95376 Externally controlled reference in DevTools on 2026-05-14

[$TBD] [513049042] Medium CVE-2026-95369 Inappropriate implementation in XML on 2026-05-13

[$TBD] [511791538] Medium CVE-2026-95362 Cross-site request forgery in DevTools on 2026-05-10

[$TBD] [502179319] Medium CVE-2026-95375 Incorrect authorization in BrowserTag on 2026-04-13

[$TBD] [502077689] Low CVE-2026-95327 Information leak in Networking on 2026-04-13

[$TBD] [501648493] Medium CVE-2026-95297 Missing authorization in Contextual Tasks on 2026-04-11

[$TBD] [497603247] Medium CVE-2026-95381 Improper input validation in Printing on 2026-03-29

[$TBD] [497344014] Low CVE-2026-95278 Missing authorization in WakeLock on 2026-03-28

[$TBD] [497212105] Medium CVE-2026-95382 Improper input validation in Auth on 2026-03-28

[$TBD] [497204165] Medium CVE-2026-95366 Use of released resource in Core on 2026-03-28

[$TBD] [495529018] Medium CVE-2026-95287 Missing authorization in Navigation on 2026-03-23

[$500.0] [423956129] Low CVE-2026-95307 UI misrepresentation in ExtensionsMenu on 2025-06-10

[$TBD] [565328105] High CVE-2026-102321 Type confusion in V8 on 2026-09-23

[$TBD] [563716534] High CVE-2026-102302 Buffer overflow in V8 on 2026-09-19

[$5000.0] [563297615] High CVE-2026-102329 Cross-site scripting in WebUI on 2026-09-18

[$TBD] [562279351] High CVE-2026-102318 Out of bounds read in WebGL on 2026-09-15

[$1500.0] [562174487] High CVE-2026-102324 Use after free in PictureInPicture on 2026-09-15

[$TBD] [562042411] High CVE-2026-102319 Uninitialized resource in GPU on 2026-09-15

[$TBD] [562004351] High CVE-2026-102301 Out of bounds write in GPU on 2026-09-15

[$TBD] [561997480] High CVE-2026-102308 Use after free in Views on 2026-09-15

[$TBD] [561994362] High CVE-2026-102325 Uninitialized resource in Skia on 2026-09-15

[$TBD] [560536732] High CVE-2026-102328 Type confusion in V8 on 2026-09-12

[$TBD] [560251736] High CVE-2026-102304 Use after free in Passwords Reported by [Xinyang Ge ] on 2026-09-11

[$TBD] [560238698] High CVE-2026-102316 Use after free in Views Reported by [Xinyang Ge ] on 2026-09-11

[$TBD] [560233248] High CVE-2026-102326 Type confusion in V8 on 2026-09-11

[$2000.0] [560062638] High CVE-2026-102300 Uninitialized resource in WebGPU on 2026-09-11

[$TBD] [559266114] High CVE-2026-102323 Type confusion in V8 on 2026-09-09

[$TBD] [556926296] High CVE-2026-102306 Use after free in Bluetooth on 2026-09-03

[$500.0] [556908674] High CVE-2026-102299 Type confusion in V8 on 2026-09-03

[$TBD] [554038924] Medium CVE-2026-102320 Missing authorization in CORS on 2026-08-28

[$TBD] [514059780] Low CVE-2026-102314 UI misrepresentation in TabStrip on 2026-05-17

[$TBD] [498793976] Low CVE-2026-102330 Incorrect authorization in SiteIsolation on 2026-04-01

[$1000.0] [477726837] Low CVE-2026-102310 Missing authorization in Payments on 2026-01-21

[$TBD] [567088927] High CVE-2026-103631 Buffer overflow in WebRTC on 2026-09-28

[$TBD] [565742180] High CVE-2026-103623 Use after free in MediaStream on 2026-09-24

[$TBD] [565742179] High CVE-2026-103622 Use after free in SVG on 2026-09-24

[$TBD] [559893859] High CVE-2026-103625 Type confusion in V8 on 2026-09-10

[$TBD] [557323166] High CVE-2026-103630 Use after free in FedCM on 2026-09-04

[$TBD] [556268833] High CVE-2026-103621 Integer overflow in Compositing on 2026-09-02

[$TBD] [553147154] Medium CVE-2026-103627 Information leak in SVG on 2026-08-26

[$TBD] [549995090] Critical CVE-2026-103628 Out of bounds write in WebGL on 2026-08-20

Chrome Dev for Android Update

2026-10-09T07:43:32.230-07:00

Hi everyone! We've just released Chrome Dev 157 (157.0.8092.0) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Dev for Desktop Update

2026-10-09T07:28:32.819-07:00

The Dev channel has been updated to 157.0.8092.0 for Windows, Mac and Linux.

A partial list of changes is available in the Git log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Chrome Release Team
Google Chrome

Chrome for Android Update

2026-10-07T15:30:00.000-07:00

Hello Everyone! We've just released Chrome 156 (156.0.8078.25) for Android to a small percentage of users. It'll become available on Google Play over the next few days. You can find more details about early Stable releases here.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Harry Souders
Google Chrome

Long Term Support Channel Update for ChromeOS

2026-10-07T11:30:32.914-07:00

A new LTC version 150.0.7871.256 (Platform Version: 16700.66.0), is being rolled out for most ChromeOS devices.

This version includes selected security fixes including:

533502257 High CVE-2026-85043 Incomplete cleanup in Network

562174487 High CVE-2026-102324 Use after free in PictureInPicture

553118043 High CVE-2026-87499 Incorrect authorization in Network

502304489 High CVE-2026-85052 Out of bounds read in CrashReporting

533534913 High CVE-2026-84324 Use after free in Proxy

557323166 High CVE-2026-103630 Use after free in FedCM

534997484 High CVE-2026-95372 Use after free in Chromecast

562242429 High CVE-2026-95351 Use after free in Views

502293787 High CVE-2026-17657 Use after free in Navigation

553115724 High CVE-2026-91708 Race condition in Network

548585299 Critical CVE-2026-95339 Use after free in ServiceWorker

513836495 Medium CVE-2026-79201 Improper access control in Workers

562151598 Critical CVE-2026-95310 Use after free in AdFilter

560439699 Critical CVE-2026-95356 Use after free in WindowDialog

538332338 High CVE-2026-19173 Out of bounds write in Skia

558036280 High CVE-2026-91737 Use after free in PDF

500311587 High CVE-2026-79218 Incorrect authorization in Sandbox

553117928 High CVE-2026-84325 Improper input validation in DataTransfer

554953456 Medium CVE-2026-91722 Use after free in Input

552283275 High CVE-2026-91724 Use after free in Input

557320614 Critical CVE-2026-91721 Use after free in Internals

516947491 High CVE-2026-79219 Use after free in Bluetooth

499602793 Critical CVE-2026-19137 Use after free in WebGL

537729021 Critical CVE-2026-19170 Use after free in WebGL

536673946 High CVE-2026-87647 Uninitialized resource in GPU

553121008 High CVE-2026-91736 Use after free in DOM

532916987 High CVE-2026-87514 Use after free in Views

554558368 High CVE-2026-91716 Use after free in Auth

552665794 Critical CVE-2026-95313 Use after free in Fullscreen

558456602 Critical CVE-2026-91749 Use after free in Workers

523208474 High CVE-2026-84357 Improper input validation in Omnibox

553449113 High CVE-2026-85051 Type confusion in Compositing

552689418 High CVE-2026-85053 Improper resource exposure in CacheStorage

553770012 Critical CVE-2026-87628 Use after free in Cast

511761758 High CVE-2026-17666 Cryptographic Flaw in Enterprise

501892500 High CVE-2026-79195 Use after free in Script

537105664 High CVE-2026-84349 Use after free in Browser

540870921 High CVE-2026-78954 Incorrect authorization in Extensions

535876894 Medium CVE-2026-79174 Incorrect authorization in Extensions

523296105 High CVE-2026-79187 Use after free in WebRTC

543707066 High CVE-2026-79274 Information leak in GPU

545820931 High CVE-2026-78952 Out of bounds write in Crashpad

548340637 High CVE-2026-79078 Use after free in FedCM

If you have devices in the LTC channel, they will be updated to this version. The LTS channel remains on LTS-144 until October 6th, 2026.

Release notes for LTC-150 can be found here

Want to know more about Long-term Support? Click here

Andy Wu

Google Chrome OS

Chrome Beta for Android Update

2026-10-07T10:28:32.223-07:00

Hi everyone! We've just released Chrome Beta 156 (156.0.8078.25) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Early Stable Update for Desktop

2026-10-07T10:18:55.747-07:00

The Stable channel has been updated to 156.0.8078.12/.13 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

Chrome Beta for Desktop Update

2026-10-07T08:13:34.219-07:00

The Beta channel has been updated to 156.0.8078.17 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

Chrome Beta for iOS Update

2026-10-07T07:58:33.042-07:00

Hi everyone! We've just released Chrome Beta 156 (156.0.8078.24) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Long Term Support (LTS) channel for ChromeOS - Major update from 144-> 150

2026-10-06T18:03:41.934-07:00

The Long Term Support Candidate LTC-150 has been promoted to ChromeOS LTS-150 and is rolling out to most ChromeOS devices. The current version is 150.0.7871.256 (Platform Version: 16700.66.0).

If you are currently on the ChromeOS Long Term Support (LTS) channel (and not pinned to 144), your devices will automatically update to ChromeOS LTS 150.

Release notes for LTS-150 can be found here

Andy Wu

Google ChromeOS

Chrome for Android Update

2026-10-06T15:00:00.000-07:00

Hi, everyone! We've just released Chrome 155 (155.0.8059.39) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 155.0.8059.39/.40 Linux: 155.0.8059.39) unless otherwise noted.

Krishna Govind

Google Chrome

Stable Channel Update for Desktop

2026-10-06T10:17:52.425-07:00

The Stable channel has been updated to 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 247 security fixes. Please see the Chrome Security Page for more information.

[N/A][534994449] Critical CVE-2026-106382: Use after free in Chromecast. Reported by Google on 2026-07-15

[TBD][560238696] Critical CVE-2026-106197: Use after free in Browser. Reported by Xinyang Ge on 2026-09-11

[TBD][567160164] Critical CVE-2026-106358: Use after free in Navigation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28

[N/A][567936270] Critical CVE-2026-106347: Use after free in Track. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30

[$5000][527023137] High CVE-2026-102322: Incorrect Authorization in SiteIsolation. Reported by Avadhut Mahamuni on 2026-06-23

[$2,000][550302121] High CVE-2026-106245: Uninitialized resource in ANGLE. Reported by JonathanBouman on 2026-08-21

[$2,000][551529559] High CVE-2026-106327: Incorrect authorization in Core. Reported by OGINOME Tomohito on 2026-08-23

[$2,000][552115620] High CVE-2026-106366: Incomplete cleanup in CustomTabs. Reported by Naoya Miyaguchi on 2026-08-24

[$2,000][553857574] High CVE-2026-106258: Uninitialized resource in ANGLE. Reported by weihengqiuu on 2026-08-28

[$2,000][553881031] High CVE-2026-106376: Uninitialized resource in ANGLE. Reported by weihengqiuu on 2026-08-28

[$2,000][560055258] High CVE-2026-106308: Incorrect reference resolution in Autofill. Reported by Anonymous on 2026-09-11

[$2,000][561066220] High CVE-2026-106215: Uninitialized resource in ANGLE. Reported by JonathanBouman on 2026-09-13

[$1,000][539043243] High CVE-2026-106369: Missing authorization in Translate. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-07-26

[$1,000][547343108] High CVE-2026-106293: Type confusion in ANGLE. Reported by Jinpyo Lee on 2026-08-16

[N/A][520179149] High CVE-2026-106377: Race condition in Fonts. Reported by Google on 2026-06-05

[N/A][520755056] High CVE-2026-106412: Race condition in Core. Reported by Google on 2026-06-06

[N/A][533426590] High CVE-2026-106243: Incomplete cleanup in Proxy Auth. Reported by Google on 2026-07-10

[N/A][533493992] High CVE-2026-106214: Information leak in Proxy. Reported by Google on 2026-07-10

[N/A][540018068] High CVE-2026-106364: Incorrect authorization in Omnibox. Reported by Google on 2026-07-28

[N/A][546630009] High CVE-2026-106239: Integer overflow in WebGL. Reported by Google on 2026-08-14

[TBD][547065823] High CVE-2026-106426: Race condition in Fonts. Reported by Emond Papegaaij on 2026-08-17

[TBD][550379413] High CVE-2026-106419: Use after free in ANGLE. Reported by Shaked Reiner (Palo Alto Networks) on 2026-08-21

[N/A][552423127] High CVE-2026-106396: Improper input validation in Omnibox. Reported by Google on 2026-08-25

[N/A][553114676] High CVE-2026-106323: Missing authorization in Chrome for iOS. Reported by Google on 2026-08-26

[N/A][553115993] High CVE-2026-106231: Uninitialized resource in Dawn. Reported by Google on 2026-08-26

[N/A][553117809] High CVE-2026-106202: Uninitialized resource in ANGLE. Reported by Google on 2026-08-26

[N/A][553118338] High CVE-2026-106273: Uninitialized resource in Video. Reported by Google on 2026-08-26

[TBD][553394296] High CVE-2026-106203: Incomplete cleanup in Autofill. Reported by Anonymous on 2026-08-27

[N/A][553454734] High CVE-2026-106332: Integer overflow in Compositing. Reported by Google on 2026-08-27

[TBD][554992296] High CVE-2026-106281: Use after free in Tint. Reported by 0599jiangyc on 2026-08-31

[TBD][555932520] High CVE-2026-106298: Use after free in Chrome Tabs. Reported by TIENPA on 2026-09-02

[TBD][557729858] High CVE-2026-106193: Use after free in Parser. Reported by Blockian Creator of Kritt and Open-Kritt on 2026-09-05

[N/A][559780376] High CVE-2026-106255: Race condition in V8. Reported by Google on 2026-09-10

[TBD][559793873] High CVE-2026-106393: Use after free in Storage. Reported by Xinyang Ge on 2026-09-10

[N/A][561891645] High CVE-2026-106227: Use after free in Core. Reported by Google on 2026-09-15

[N/A][561987051] High CVE-2026-106379: Uninitialized resource in Skia. Reported by Google on 2026-09-15

[N/A][562002095] High CVE-2026-106211: Use after free in TabStrip. Reported by Google on 2026-09-15

[N/A][562043997] High CVE-2026-106329: Incorrect authorization in FileSystem. Reported by Google on 2026-09-15

[TBD][563673584] High CVE-2026-106248: Use after free in Bindings. Reported by Alessandro Rizzo (0xAlessandro) on 2026-09-19

[TBD][565612897] High CVE-2026-106235: Use after free in WebAudio. Reported by Team Allied (Hyeongeun Ji, h4nk3r1n, h4vrut4, HunSec, nag0x) on 2026-09-24

[TBD][565674529] High CVE-2026-106257: Use after free in HTML. Reported by OpenAI Codex Security (amyb) on 2026-09-24

[TBD][565742177] High CVE-2026-106268: Use after free in WebRTC. Reported by xinyang on 2026-09-24

[TBD][565774991] High CVE-2026-106278: Use after free in Select. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-24

[TBD][565797213] High CVE-2026-106233: Use after free in Metrics. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-24

[TBD][566111249] High CVE-2026-106318: Use after free in Media. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-25

[TBD][566136674] High CVE-2026-106411: Use after free in Parser. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-25

[TBD][566347711] High CVE-2026-106423: Use after free in Media. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-26

[N/A][566404364] High CVE-2026-106346: Improper state validation in DevTools. Reported by Google on 2026-09-26

[TBD][566824998] High CVE-2026-106190: Use after free in Media. Reported by weihengqiuu on 2026-09-27

[TBD][567160162] High CVE-2026-106357: Use after free in WebRTC. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28

[TBD][567177599] High CVE-2026-106240: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-28

[TBD][567379988] High CVE-2026-106184: Uninitialized resource in Media. Reported by James Burton (Offensive Security @ Meta) on 2026-09-29

[TBD][567447106] High CVE-2026-106383: Use after free in Media. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29

[TBD][567538973] High CVE-2026-106349: Use after free in V8. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29

[N/A][567873463] High CVE-2026-106421: Use after free in PDF. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30

[N/A][567910530] High CVE-2026-106204: Use after free in PDF. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30

[N/A][568422505] High CVE-2026-106200: Use after free in Track. Reported by Google on 2026-10-01

[$3,000][380789337] Medium CVE-2026-106265: UI misrepresentation in File. Reported by Umar Farooq on 2024-11-25

[$3,000][492374387] Medium CVE-2026-106238: Race condition in Fonts. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-13

[$2,000][501171258] Medium CVE-2026-106324: Incorrect authorization in WebAppInstalls. Reported by Narenda Singh (@_3P1C) on 2026-04-09

[$1,000][477327257] Medium CVE-2026-106420: Incorrect calculation in API. Reported by Luan Herrera (@lbherrera_) on 2026-01-21

[N/A][496623893] Medium CVE-2026-106222: Incorrect authorization in Sync. Reported by Google on 2026-03-26

[N/A][497062057] Medium CVE-2026-106208: Missing authorization in API. Reported by Google on 2026-03-28

[N/A][497148613] Medium CVE-2026-106286: Confused deputy in Omnibox. Reported by Google on 2026-03-28

[N/A][497350668] Medium CVE-2026-106181: Incorrect reference resolution in DevTools. Reported by Google on 2026-03-29

[N/A][497652727] Medium CVE-2026-106315: Use after free in Modularization. Reported by Google on 2026-03-30

[N/A][497842821] Medium CVE-2026-106274: Incorrect reference resolution in Browser. Reported by Google on 2026-03-30

[N/A][498075038] Medium CVE-2026-106365: Missing authorization in Animation. Reported by Google on 2026-03-31

[N/A][498737756] Medium CVE-2026-106267: Missing authorization in Network. Reported by Google on 2026-04-01

[N/A][498739277] Medium CVE-2026-106194: Missing authorization in WebAppInstalls. Reported by Google on 2026-04-01

[N/A][498770931] Medium CVE-2026-106313: Incorrect authorization in Browser. Reported by Google on 2026-04-02

[N/A][499468981] Medium CVE-2026-106283: Use after free in Streaming. Reported by Google on 2026-04-04

[N/A][499571442] Medium CVE-2026-106291: Use after free in GarbageCollection. Reported by Google on 2026-04-04

[N/A][500106110] Medium CVE-2026-106300: Race condition in CacheStorage. Reported by Google on 2026-04-06

[N/A][501533684] Medium CVE-2026-106314: Incorrect authorization in Bluetooth. Reported by Google on 2026-04-10

[N/A][501633302] Medium CVE-2026-106223: Uninitialized resource in GPU. Reported by Google on 2026-04-11

[N/A][501647772] Medium CVE-2026-106242: Information leak in Omnibox. Reported by Google on 2026-04-11

[N/A][501729675] Medium CVE-2026-106241: Incorrect authorization in Search. Reported by Google on 2026-04-11

[N/A][501763586] Medium CVE-2026-106381: Incorrect authorization in Passwords. Reported by Google on 2026-04-11

[N/A][501770489] Medium CVE-2026-106217: Missing authorization in Google Lens. Reported by Google on 2026-04-12

[N/A][501790682] Medium CVE-2026-106425: Missing authorization in BrowserTag. Reported by Google on 2026-04-12

[N/A][501805355] Medium CVE-2026-106225: Missing authorization in Autofill. Reported by Google on 2026-04-12

[N/A][501896592] Medium CVE-2026-106363: Missing authorization in FullScreen. Reported by Google on 2026-04-12

[N/A][501914204] Medium CVE-2026-106266: Confused deputy in Contextual Tasks. Reported by Google on 2026-04-12

[N/A][502034469] Medium CVE-2026-106189: Code injection in ReaderMode. Reported by Google on 2026-04-13

[N/A][502105238] Medium CVE-2026-106335: Use after free in Media. Reported by Google on 2026-04-13

[N/A][502179715] Medium CVE-2026-106415: Information leak in Enterprise. Reported by Google on 2026-04-13

[N/A][502278429] Medium CVE-2026-106224: Missing authorization in Google Lens. Reported by Google on 2026-04-13

[N/A][502462485] Medium CVE-2026-106185: Improper input validation in Viz. Reported by Google on 2026-04-14

[N/A][502475175] Medium CVE-2026-106244: Incorrect authorization in Permissions. Reported by Google on 2026-04-14

[N/A][502648640] Medium CVE-2026-106407: Incorrect authorization in GetUserMedia. Reported by Google on 2026-04-14

[N/A][503625361] Medium CVE-2026-106389: Incorrect authorization in USB. Reported by Google on 2026-04-17

[N/A][503725788] Medium CVE-2026-106397: Incorrect authorization in Mobile. Reported by Google on 2026-04-17

[N/A][504215649] Medium CVE-2026-106196: Missing authorization in Navigation. Reported by Google on 2026-04-19

[N/A][504223609] Medium CVE-2026-106414: Improper input validation in Mobile. Reported by Google on 2026-04-19

[N/A][504227656] Medium CVE-2026-106408: Protection mechanism failure in Mobile. Reported by Google on 2026-04-19

[N/A][504638005] Medium CVE-2026-106261: Uninitialized resource in Video. Reported by Google on 2026-04-20

[N/A][505186109] Medium CVE-2026-106406: Missing authorization in Mobile. Reported by Google on 2026-04-22

[N/A][507351786] Medium CVE-2026-106290: Uninitialized resource in GPU. Reported by Google on 2026-04-28

[TBD][507596239] Medium CVE-2026-106378: Privilege elevation in Sandbox. Reported by Paulos Yibelo Mesfin on 2026-04-29

[TBD][510773353] Medium CVE-2026-106198: Missing authorization in FileSystem. Reported by pakhunov.anton.n on 2026-05-07

[N/A][511745101] Medium CVE-2026-106326: Confused deputy in UI. Reported by Google on 2026-05-10

[N/A][511796554] Medium CVE-2026-106354: Improper resource exposure in Extensions. Reported by Google on 2026-05-10

[N/A][512998592] Medium CVE-2026-106342: Information leak in Autofill. Reported by Google on 2026-05-13

[N/A][513365978] Medium CVE-2026-106424: Information leak in Audio. Reported by Google on 2026-05-15

[N/A][513741326] Medium CVE-2026-106253: Incorrect authorization in Extensions. Reported by Google on 2026-05-16

[N/A][513757840] Medium CVE-2026-106279: Incorrect reference resolution in Passwords. Reported by Google on 2026-05-16

[N/A][513781133] Medium CVE-2026-106361: Incorrect provision of specified functionality in Mobile. Reported by Google on 2026-05-16

[N/A][514041626] Medium CVE-2026-106402: Incorrect authorization in Extensions. Reported by Google on 2026-05-17

[N/A][514061289] Medium CVE-2026-106311: Clickjacking in PermissionElement. Reported by Google on 2026-05-17

[N/A][514070956] Medium CVE-2026-106246: Incorrect authorization in Browser. Reported by Google on 2026-05-17

[N/A][514071472] Medium CVE-2026-106302: UI misrepresentation in PermissionElement. Reported by Google on 2026-05-17

[N/A][514072462] Medium CVE-2026-106416: Code injection in Extensions. Reported by Google on 2026-05-17

[N/A][514078734] Medium CVE-2026-106182: UI misrepresentation in Paint. Reported by Google on 2026-05-17

[N/A][514204338] Medium CVE-2026-106282: UI misrepresentation in WebOTP. Reported by Google on 2026-05-18

[N/A][514426571] Medium CVE-2026-106392: Information leak in WebAudio. Reported by Google on 2026-05-18

[N/A][515477538] Medium CVE-2026-106188: Confused deputy in SignIn. Reported by Google on 2026-05-21

[N/A][517033396] Medium CVE-2026-106370: Uninitialized resource in GPU. Reported by Google on 2026-05-27

[N/A][517090646] Medium CVE-2026-106356: Clickjacking in EVP. Reported by Google on 2026-05-27

[N/A][517150523] Medium CVE-2026-106405: Race condition in CustomTabs. Reported by Google on 2026-05-27

[N/A][517213220] Medium CVE-2026-106322: Open redirect in AppManifest. Reported by Google on 2026-05-27

[N/A][517366426] Medium CVE-2026-106280: Incorrect authorization in PermissionElement. Reported by Google on 2026-05-28

[N/A][517374100] Medium CVE-2026-106206: Improper input validation in Mobile. Reported by Google on 2026-05-28

[N/A][517429254] Medium CVE-2026-106180: Observable discrepancy in Animation. Reported by Google on 2026-05-28

[N/A][517475258] Medium CVE-2026-106303: Observable discrepancy in Autofill AI. Reported by Google on 2026-05-28

[N/A][517546096] Medium CVE-2026-106201: Race condition in V8. Reported by Google on 2026-05-28

[N/A][517649552] Medium CVE-2026-106333: Incorrect authorization in Input. Reported by Google on 2026-05-28

[N/A][517689673] Medium CVE-2026-106228: Confused deputy in Google Lens. Reported by Google on 2026-05-29

[N/A][517700327] Medium CVE-2026-106289: Missing authorization in FedCM. Reported by Google on 2026-05-29

[N/A][517708426] Medium CVE-2026-106277: Information leak in Animation. Reported by Google on 2026-05-29

[N/A][517801814] Medium CVE-2026-106410: Missing authorization in Permissions. Reported by Google on 2026-05-29

[N/A][517804731] Medium CVE-2026-106284: Out of bounds read in Printing. Reported by Google on 2026-05-29

[N/A][518039724] Medium CVE-2026-106209: UI misrepresentation in Mobile. Reported by Google on 2026-05-29

[N/A][518076654] Medium CVE-2026-106216: Cross-site request forgery in ReadingList. Reported by Google on 2026-05-30

[N/A][518091868] Medium CVE-2026-106328: Incorrect authorization in PDF. Reported by Google on 2026-05-30

[N/A][518096516] Medium CVE-2026-106387: Missing authorization in Mobile. Reported by Google on 2026-05-30

[N/A][518108937] Medium CVE-2026-106400: Clickjacking in Messages. Reported by Google on 2026-05-30

[N/A][519499907] Medium CVE-2026-106205: Missing authorization in Passwords. Reported by Google on 2026-06-03

[N/A][520153320] Medium CVE-2026-106213: Race condition in WebAudio. Reported by Google on 2026-06-05

[N/A][520507737] Medium CVE-2026-106230: Incorrect reference resolution in Offline. Reported by Google on 2026-06-05

[N/A][520533412] Medium CVE-2026-106367: Missing authorization in Mobile. Reported by Google on 2026-06-05

[N/A][520573237] Medium CVE-2026-106226: Improper input validation in Compositing. Reported by Google on 2026-06-06

[N/A][521949525] Medium CVE-2026-106229: UI misrepresentation in FileSystem. Reported by Google on 2026-06-09

[N/A][522299740] Medium CVE-2026-106232: UI misrepresentation in Browser. Reported by Google on 2026-06-10

[N/A][522325665] Medium CVE-2026-106391: Incorrect authorization in WebShare. Reported by Google on 2026-06-10

[N/A][522722456] Medium CVE-2026-106336: Observable discrepancy in Paint. Reported by Google on 2026-06-11

[N/A][523601696] Medium CVE-2026-106403: Incorrect authorization in Accessibility. Reported by Google on 2026-06-13

[N/A][523699645] Medium CVE-2026-106373: Use after free in Fonts. Reported by Google on 2026-06-13

[N/A][523750306] Medium CVE-2026-106301: Confused deputy in Contextual Tasks. Reported by Google on 2026-06-14

[N/A][524587778] Medium CVE-2026-106292: Buffer overflow in Fonts. Reported by Google on 2026-06-16

[N/A][533066295] Medium CVE-2026-106262: Incomplete cleanup in GetUserMedia. Reported by Google on 2026-07-09

[TBD][535639435] Medium CVE-2026-106360: Information leak in Payments. Reported by NH DEV on 2026-07-17

[N/A][536507840] Medium CVE-2026-106375: Incomplete cleanup in Dawn. Reported by Google on 2026-07-19

[N/A][537107728] Medium CVE-2026-106348: Information leak in Animation. Reported by Google on 2026-07-21

[N/A][537832408] Medium CVE-2026-106307: Incorrect authorization in Network. Reported by Google on 2026-07-22

[N/A][540072162] Medium CVE-2026-106212: Incorrect authorization in Autofill. Reported by Google on 2026-07-28

[TBD][543082212] Medium CVE-2026-106398: Incorrect authorization in Media. Reported by caveeroo on 2026-08-05

[N/A][550512266] Medium CVE-2026-106388: Missing authorization in DataTransfer. Reported by leolee on 2026-08-21

[N/A][553118313] Medium CVE-2026-106271: Missing authorization in Workers. Reported by Google on 2026-08-26

[N/A][553121488] Medium CVE-2026-106395: Uninitialized resource in Dawn. Reported by Google on 2026-08-26

[N/A][553124799] Medium CVE-2026-106304: Out of bounds read in ANGLE. Reported by Google on 2026-08-26

[N/A][553129739] Medium CVE-2026-106401: Out of bounds write in Media. Reported by Google on 2026-08-26

[N/A][553135213] Medium CVE-2026-106330: Information leak in Paint. Reported by Google on 2026-08-26

[N/A][553138969] Medium CVE-2026-106295: Incorrect authorization in Unbounded Element. Reported by Google on 2026-08-26

[N/A][553139506] Medium CVE-2026-106352: Incorrect authorization in WebProtect. Reported by Google on 2026-08-26

[N/A][553145497] Medium CVE-2026-106337: UI misrepresentation in UI. Reported by Google on 2026-08-26

[N/A][553149001] Medium CVE-2026-106263: Improper input validation in SignIn. Reported by Google on 2026-08-26

[N/A][553150261] Medium CVE-2026-106404: Incorrect authorization in FontAccess. Reported by Google on 2026-08-26

[N/A][553154579] Medium CVE-2026-106183: Missing authorization in Chromoting. Reported by Google on 2026-08-26

[N/A][553156221] Medium CVE-2026-106386: Uninitialized resource in WebAudio. Reported by Google on 2026-08-26

[N/A][553164077] Medium CVE-2026-106351: Observable discrepancy in Safebrowsing. Reported by Google on 2026-08-27

[TBD][554348119] Medium CVE-2026-106384: Missing authorization in SiteIsolation. Reported by med.bassia on 2026-08-29

[TBD][554619028] Medium CVE-2026-106207: Race condition in V8. Reported by flyyy on 2026-08-30

[N/A][556235808] Medium CVE-2026-106321: Information leak in Editing. Reported by Google on 2026-09-02

[TBD][556304559] Medium CVE-2026-106210: Observable discrepancy in Scroll. Reported by Hafiizh on 2026-09-03

[TBD][557036053] Medium CVE-2026-106254: Information leak in Mobile. Reported by Anonymous on 2026-09-04

[TBD][557288890] Medium CVE-2026-106372: Incorrect authorization in UI. Reported by Quyen Son at VinFast (@zer0qs) on 2026-09-05

[N/A][558539954] Medium CVE-2026-106341: Type confusion in V8. Reported by Google on 2026-09-08

[TBD][559097675] Medium CVE-2026-106409: Incorrect reference resolution in WebAppInstalls. Reported by Quyen Son at VinFast (@zer0qs) on 2026-09-09

[$2,000][503794852] Low CVE-2026-106340: Missing authorization in CredentialProvider. Reported by Wooseok Sung on 2026-04-17

[$1,000][417555081] Low CVE-2026-106276: UI misrepresentation in Payments. Reported by Khalil Zhani on 2025-05-14

[TBD][448789663] Low CVE-2026-106338: UI misrepresentation in PictureInPicture. Reported by Hafiizh on 2025-10-02

[TBD][450323465] Low CVE-2026-106317: UI misrepresentation in FullScreen. Reported by Manojkumar Jaganathan (https://www.linkedin.com/in/manojkumar-j-7ba35b202/) Aka TheWhiteEvil (https://hackerone.com/the-white-evil) with HackerBro Technologies on 2025-10-09

[N/A][498375898] Low CVE-2026-106344: Missing authorization in Permissions. Reported by Google on 2026-04-01

[N/A][500532594] Low CVE-2026-106359: Confused deputy in DeviceBoundSessionCredentials. Reported by Google on 2026-04-08

[N/A][502078791] Low CVE-2026-106353: Improper input validation in Mobile. Reported by Google on 2026-04-13

[N/A][502111211] Low CVE-2026-106312: Missing authorization in SignIn. Reported by Google on 2026-04-13

[N/A][502282293] Low CVE-2026-106191: Missing authorization in Actor. Reported by Google on 2026-04-13

[N/A][502497790] Low CVE-2026-106250: Missing authorization in Actor. Reported by Google on 2026-04-14

[TBD][503708636] Low CVE-2026-106309: Incorrect authorization in Selection. Reported by Putra Mahardika | Instagram @mhrdkaa._ on 2026-04-17

[N/A][511776800] Low CVE-2026-106187: Missing authorization in Permissions. Reported by Google on 2026-05-10

[N/A][513122002] Low CVE-2026-106394: Incomplete cleanup in Glic. Reported by Project Fortify on 2026-05-14

[N/A][513383360] Low CVE-2026-106306: Incorrect authorization in DevTools. Reported by Google on 2026-05-15

[N/A][513423334] Low CVE-2026-106427: Confused deputy in Mobile. Reported by Google on 2026-05-15

[N/A][513446410] Low CVE-2026-106252: Incorrect comparison in Fonts. Reported by Google on 2026-05-15

[N/A][513518289] Low CVE-2026-106287: Information loss in CORS. Reported by Google on 2026-05-15

[N/A][513735469] Low CVE-2026-106297: Incorrect authorization in Scheduling. Reported by Google on 2026-05-16

[N/A][513821237] Low CVE-2026-106260: Incorrect authorization in DevTools. Reported by Google on 2026-05-16

[N/A][514456975] Low CVE-2026-106362: Missing authorization in DevTools. Reported by Google on 2026-05-19

[N/A][514460295] Low CVE-2026-106275: Uninitialized resource in GPU. Reported by Google on 2026-05-19

[N/A][517703787] Low CVE-2026-106199: Incorrect authorization in Actor. Reported by Google on 2026-05-29

[N/A][519211890] Low CVE-2026-106299: Improper input validation in WebAudio. Reported by Google on 2026-06-02

[N/A][519458746] Low CVE-2026-106422: Incorrect authorization in API. Reported by Google on 2026-06-03

[N/A][522557469] Low CVE-2026-106186: Uncontrolled search path element in CredentialProvider. Reported by Google on 2026-06-11

[N/A][524435922] Low CVE-2026-106247: Buffer overflow in ANGLE. Reported by Google on 2026-06-16

[N/A][524681280] Low CVE-2026-106192: Information leak in Mobile. Reported by Google on 2026-06-16

[N/A][530237174] Low CVE-2026-106399: Out of bounds read in Skia. Reported by Google on 2026-07-01

[N/A][533084756] Low CVE-2026-106264: Missing authorization in Web Authentication (Passkeys & Security Keys). Reported by Google on 2026-07-09

[N/A][533119681] Low CVE-2026-106285: UI misrepresentation in WebAppInstalls. Reported by Google on 2026-07-09

[N/A][534843648] Low CVE-2026-106220: Information leak in Passwords. Reported by Google on 2026-07-14

[N/A][536471438] Low CVE-2026-106417: Integer overflow in Media. Reported by Google on 2026-07-19

[N/A][540049672] Low CVE-2026-106221: Confused deputy in WebAPKs. Reported by Google on 2026-07-28

[N/A][540076586] Low CVE-2026-106259: Incorrect authorization in PermissionElement. Reported by Google on 2026-07-28

[N/A][540078886] Low CVE-2026-106296: Improper privilege management in UI. Reported by Google on 2026-07-28

[TBD][552440317] Low CVE-2026-106249: Incorrect authorization in Autofill. Reported by mute1008 on 2026-08-25

[TBD][552832446] Low CVE-2026-106374: Type confusion in V8. Reported by SecBuddyN, Tencent KeenLab (CodeBuddy Security) on 2026-08-26

[N/A][553168380] Low CVE-2026-106380: UI misrepresentation in UI. Reported by Google on 2026-08-27

[N/A][553250818] Low CVE-2026-106179: UI misrepresentation in WebAppInstalls. Reported by Google on 2026-08-27

[N/A][553252261] Low CVE-2026-106368: UI misrepresentation in UI. Reported by Google on 2026-08-27

[N/A][553255283] Low CVE-2026-106237: Information leak in Permissions. Reported by Google on 2026-08-27

[N/A][553256068] Low CVE-2026-106331: Improper input validation in Extensions. Reported by Google on 2026-08-27

[N/A][553269860] Low CVE-2026-106270: Incorrect authorization in WebAppInstalls. Reported by Google on 2026-08-27

[N/A][553270559] Low CVE-2026-106350: Incorrect authorization in Browser. Reported by Google on 2026-08-27

[N/A][553274076] Low CVE-2026-106288: Missing authorization in Browser. Reported by Google on 2026-08-27

[N/A][553276352] Low CVE-2026-106305: UI misrepresentation in Mobile. Reported by Google on 2026-08-27

[N/A][553283471] Low CVE-2026-106418: Missing authorization in Network. Reported by Google on 2026-08-27

[N/A][553317583] Low CVE-2026-106343: Improper state validation in Autofill AI. Reported by Google on 2026-08-27

[N/A][553326010] Low CVE-2026-106371: Incorrect authorization in Transactions Platform. Reported by Google on 2026-08-27

[N/A][553335319] Low CVE-2026-106256: Information leak in Passwords. Reported by Google on 2026-08-27

[N/A][553336689] Low CVE-2026-106413: Race condition in Browser. Reported by Google on 2026-08-27

[N/A][553913506] Low CVE-2026-106339: Use of released resource in Core. Reported by Google on 2026-08-28

[N/A][553929758] Low CVE-2026-106320: Use of released resource in UI. Reported by Google on 2026-08-28

[N/A][553930843] Low CVE-2026-106195: Incorrect authorization in Chromoting. Reported by Google on 2026-08-28

[N/A][554556423] Low CVE-2026-106316: UI misrepresentation in Chromoting. Reported by Google on 2026-08-29

[N/A][554874487] Low CVE-2026-106385: Race condition in Chromoting. Reported by Google on 2026-08-30

[N/A][556211265] Low CVE-2026-106325: Incorrect reference resolution in Core. Reported by Google on 2026-09-02

[N/A][556213916] Low CVE-2026-106390: Incorrect provision of specified functionality in SanitizerAPI. Reported by Google on 2026-09-02

[N/A][556215048] Low CVE-2026-106294: Incomplete cleanup in Chromoting. Reported by Google on 2026-09-02

[N/A][556229780] Low CVE-2026-106334: Information leak in Payments. Reported by Google on 2026-09-02

[N/A][556233068] Low CVE-2026-106236: UI misrepresentation in Chromoting. Reported by Google on 2026-09-02

[N/A][556237314] Low CVE-2026-106251: UI misrepresentation in Chromoting. Reported by Google on 2026-09-02

[N/A][556250086] Low CVE-2026-106310: Use of released resource in FontAccess. Reported by Google on 2026-09-02

[N/A][556258544] Low CVE-2026-106345: Use of released resource in Session. Reported by Google on 2026-09-02

[N/A][556259957] Low CVE-2026-106272: UI misrepresentation in Chromoting. Reported by Google on 2026-09-02

[N/A][559777100] Low CVE-2026-106355: Missing authorization in Media. Reported by Google on 2026-09-10

[TBD][564085088] Low CVE-2026-106234: Use after free in Network. Reported by Findingz on 2026-09-20

[TBD][565742178] Low CVE-2026-106269: Use after free in CSS. Reported by xinyang on 2026-09-24

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Chrome Stable for iOS Update

2026-10-06T10:13:33.008-07:00

Hi everyone! We've just released Chrome Stable 155 (155.0.8059.37) for iOS; it'll become available on App Store in the next few hours.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Extended Stable Update for Desktop

2026-10-06T10:13:03.632-07:00

The Extended Stable channel has been updated to 152.0.7977.158 for Windows and Mac which will roll out over the coming days/weeks.

A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

Beta Channel Update for ChromeOS / ChromeOS Flex

2026-10-05T12:23:08.536-07:00

The Beta channel is being updated to OS version 16820.18.0 (Browser version 155.0.8059.31) for most ChromeOS devices.

If you find new issues, please let us know one of the following ways:

File a bug
Visit our ChromeOS communities

General: Chromebook Help Community
Beta Specific: ChromeOS Beta Help Community

Report an issue or send feedback on Chrome
Interested in switching channels? Find out how.

Andy Wu

Google ChromeOS

Chrome Dev for Desktop Update

2026-10-02T17:58:33.442-07:00

The Dev channel has been updated to 157.0.8081.0 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

Chrome Dev for Android Update

2026-10-02T15:43:32.707-07:00

Hi everyone! We've just released Chrome Dev 157 (157.0.8080.0) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Extended Stable Update for Desktop

2026-10-02T10:48:00.289-07:00

The Extended Stable channel has been updated to 152.0.7977.152 for Windows and Mac which will roll out over the coming days/weeks.

Srinivas Sista

Google Chrome

Chrome for Android Update

2026-10-01T19:25:42.499-07:00

Hi, everyone! We've just released Chrome 154 (154.0.8037.126) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 154.0.8037.97/.98 Linux: 153.0.8010.97) unless otherwise noted.

Krishna Govind

Google Chrome

Stable Channel Update for Desktop

2026-10-01T18:04:35.613-07:00

The Stable channel has been updated to 154.0.8037.97/.98 for Windows and Mac and 154.0.8037.97 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

This update includes 11 security fixes. Please see the Chrome Security Page for more information.

[N/A][549995090] Critical CVE-2026-103628: Out of bounds write in WebGL. Reported by Google on 2026-08-21

[N/A][553114097] High CVE-2026-103626: Incorrect authorization in FileSystem. Reported by Google on 2026-08-26

[N/A][556268833] High CVE-2026-103621: Integer overflow in Compositing. Reported by Google on 2026-09-02

[TBD][557323166] High CVE-2026-103630: Use after free in FedCM. Reported by xinyang on 2026-09-04

[N/A][559893859] High CVE-2026-103625: Type confusion in V8. Reported by Google on 2026-09-11

[TBD][561660166] High CVE-2026-103624: Use after free in Contextual Tasks. Reported by xuanocto1221 on 2026-09-15

[N/A][562038679] High CVE-2026-103629: Integer overflow in Skia. Reported by Google on 2026-09-15

[TBD][565742179] High CVE-2026-103622: Use after free in SVG. Reported by xinyang on 2026-09-24

[TBD][565742180] High CVE-2026-103623: Use after free in MediaStream. Reported by xinyang on 2026-09-24

[TBD][567088927] High CVE-2026-103631: Buffer overflow in WebRTC. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28

[N/A][553147154] Medium CVE-2026-103627: Information leak in SVG. Reported by Google on 2026-08-26

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Srinivas Sista

Google Chrome

Dev Channel Update for ChromeOS / ChromeOS Flex

2026-10-01T12:11:40.070-07:00

The Dev channel is being updated to OS version 16836.2.0 (Browser version 156.0.8078.5) for most ChromeOS devices.

If you find new issues, please let us know one of the following ways

File a bug
Visit our ChromeOS communities

General: Chromebook Help Community
Beta Specific: ChromeOS Beta Help Community

Report an issue or send feedback on Chrome

Interested in switching channels? Find out how.

Andy Wu,
Google ChromeOS

Early Stable Update for Desktop

2026-09-30T11:47:20.575-07:00

The Stable channel has been updated to 155.0.8059.26/.27 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Srinivas Sista

Google Chrome

Chrome for Android Update

2026-09-30T11:10:24.906-07:00

Hello Everyone! We've just released Chrome 155 (155.0.8059.30) for Android to a small percentage of users. It'll become available on Google Play over the next few days. You can find more details about early Stable releases here.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Krishna Govind
Google Chrome

Chrome Beta for Android Update

2026-09-30T10:13:32.409-07:00

Hi everyone! We've just released Chrome Beta 156 (156.0.8078.4) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Beta for iOS Update

2026-09-30T09:28:33.021-07:00

Hi everyone! We've just released Chrome Beta 156 (156.0.8078.3) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome