Chrome Releases Blog

Not totally related, but someone know if exist an RSS feed to follow the stable Firefox releases? Can't find it on this page. This Firefox changelogs are awesome to know big improvements and new features on a surface level. For Chrome I didn't find a proper way to follow the releases even if it has some RSS feeds, I follow the RSS feed of Chrome Releases blog [1] with a tag filter [2] but can't exclude the several point releases, and also the changelogs are not very informative [3]. And the Chrome blog [4] I get some feature announcements but is a mix bag. [1] https://chromereleases.googleblog.com [2] http://googlechromereleases.blogspot.com/feeds/posts/default/-/Stable%… [3] https://chromereleases.googleblog.com/2021/01/stable-channel-update-fo… [4] https://blog.google/products/chrome/

Not sure if it counts as dev blog but https://chromereleases.googleblog.com/ still has RSS and Atom feeds, I guess not everything got nuked.

I want to draw one's attention to the (at this point impressive) number of CVEs related to memory issues in Chromium's C++ codebase: https://chromereleases.googleblog.com/search/label/Stable%20updates and control-f for CVE Even granting that some of them come from dependent libraries, if the world's arguably best funded software engineering organization can't keep C++ footguns out of an application that runs untrusted code on the regular ... one may want to have a think about whether C++ is the best tool for that purpose

Safari also has a bug bounty program so this could be worth $$. At least on the Chrome blog WebGL bugs regularly net people bounties. (Example: https://chromereleases.googleblog.com/2022/08/stable-channel-update-fo… - the bountied ANGLE and SwiftShader bugs are WebGL. You don't need to craft exploits at least in Chrome's program, just demo crashes that look concerning)

You can write comments at https://chromereleases.googleblog.com/

Chrome stable 89.0.4389.90 was released on March 12: https://chromereleases.googleblog.com/2021/03/stable-channel-update-fo… Version bump in nixpkgs: https://github.com/NixOS/nixpkgs/commit/5f8b95113983c8f31d635c0930d9a6… on March 13 (one day later) Released in nixos-unstable on Mar 16 11:11:22 UTC (four days later) Backport to 20.09: https://github.com/NixOS/nixpkgs/commit/26ba8cd77b5a4408799ffb02b281cd… on March 13 (one day later) Released in nixos-20.09 on Mar 16 16:31:31 UTC (four days later) Again, four days is not great for a Chrome zero-day. NixOS doesn't have a professional security team, and if you need that assurance, maybe you can't use it. But please don't exaggerate and muddy the facts. Most of the delay is due to hydra having to build everything that came in ahead of that change on the master branch, and sometimes the master branch is just broken.... I wish there was a fast-track process that could bump urgent security changes ahead of other ones, but it seems like it could complicate things a lot. Of course, as I said above, it's relatively easy for you to update your local install without waiting for all that, if you're aware of the release and its severity.

I do actually have a CSS CVE[0] in Chrome, but it was in the changelog as "in Animation" instead of "in CSS", so no fun stories/headlines for me :c [0] https://chromereleases.googleblog.com/2025/06/stable-channel-update-fo…

And yet in practice, it's been less than a week since a major CVE in Chromium due to memory unsafety: https://chromereleases.googleblog.com/2026/02/stable-channel-update-fo… Having a checklist of "things not to do" is historically a pretty in effectiveway to ensure memory safety, which is why the parent comment was asking for details. The fact that this type of thing gets dismissed as a non-issue is honestly a huge part of the problem in my opinion; it's time to move on from pretending this is a skill issue.

Source: https://chromereleases.googleblog.com/2025/12/stable-channel-update-fo…

And Chrome had one with severity "High" just three days ago, browsers will always have security issues that seem to be patched reasonably fast in the big three. Might as well pick one that's not part of the monoculture by a big advertising company, depending on your threat model of course. https://chromereleases.googleblog.com/2025/01/stable-channel-update-fo…

It's four versions behind the current one with a lot of CVEs. There seems to be an LTS 126 but it's only for ChromeOS - it's at least behind this one which fixed one critical and two High CVEs: https://chromereleases.googleblog.com/2024/11/long-term-support-channe… Even being only one version behind is dangerous for such a huge attack vector.

Sure, but opening the image in a browser wont run any malware even if there's one concealed inside the image data that can be extracted by specific "innocent-looking" software. The only possibility of doing something that bad (i.e. running the malware by just opening the image) would be a malformed image that manages to do a buffer overflow in the image parser of the browser (see this recent example: https://chromereleases.googleblog.com/2023/09/stable-channel-update-fo… but I rather think that this specific case is just a false positive. EDIT: someone in the thread apparently rescanned the file (I didn't check if the file was the same or was modified in-between on the original site) and it indeed appears clean now.

There's not a lot of context in this submission, but presumably it is being linked because the release notes for this CVE says "Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild." https://chromereleases.googleblog.com/2024/01/stable-channel-update-fo…

CVE-2023-7024 https://chromereleases.googleblog.com/2023/12/stable-channel-update-fo…

Mine states 120.0.6099.26, which was released a month ago, https://chromereleases.googleblog.com/2023/11/chrome-beta-for-android-…

"Google is aware that an exploit for CVE-2023-2136 exists in the wild." https://chromereleases.googleblog.com/2023/04/stable-channel-update-fo…

https://google.github.io/styleguide/cppguide.html#Exceptions calls for factories or init methods (probably returning error codes) so running with an invalid state isn’t prevented by terminating the process. I don’t have access to CVEs on crbug.com but the top two from https://chromereleases.googleblog.com/2023/01/stable-channel-update-fo… are a use-after-free and buffer overflow reported months ago, which is the kind of stuff that modern C++ tries to avoid using containers and smart pointers with RAII.

Firefox fixes security 1-2x per month [0]. Chrome's security page is more difficult to grep since it includes multiple software types, but I see 1-2x per month as well [1]. [0] - https://www.mozilla.org/en-US/security/advisories/ [1] - https://chromereleases.googleblog.com/search/label/Stable%20updates

Searching https://chromereleases.googleblog.com/search/label/Stable%20updates for "Stable channel update for desktop" shows 4 updates in the last 30 days.

Do you mean “30 security vulnerabilities, 1 of which was critical”? Because that seems to be the reality: https://chromereleases.googleblog.com/2022/05/stable-channel-update-fo…

Sorry, but what? Every big C/C++ project is regularly plagued by memory-safety issues. This is a blog post from Chrome where the majority of bugs are memory-safety bugs: https://chromereleases.googleblog.com/2022/03/stable-channel-update-fo… This is a project with world-class resources for enforcing memory safety, and yet they regularly encounter this class of bugs. C and C++ do not provide sufficient tools to prevent memory safety, and this has been demonstrated across basically every project they're used in.

Looks like 99.0.4844.84 is the release we want. https://chromereleases.googleblog.com/2022/03/stable-channel-update-fo…

I have 99.0.4844.88, updated yesterday. The release notes for Android don't mention the CVE. https://chromereleases.googleblog.com/2022/03/stable-channel-update-fo…

Direct link to the Google Chrome Releases blog entry: https://chromereleases.googleblog.com/2022/03/stable-channel-update-fo…

Well, 96 is out, and these constant updates exist to patch out high-severity CVEs. https://chromereleases.googleblog.com/2021/12/stable-channel-update-fo… https://chromereleases.googleblog.com/2021/12/stable-channel-update-fo… https://chromereleases.googleblog.com/2021/11/stable-channel-update-fo…

Take a look at the most recent stable release notes for Chrome. I don't have a full list of which ones are in the renderer processes vs which ones are in the browser process. That said, it seems like a good number would affect Chrome without Javascript https://chromereleases.googleblog.com/2021/01/stable-channel-update-fo…

Chrome’s PDF viewer launched in Dec 2010[1] with v8.0.552. The release notes do note that a benefit of the built-in viewer is that it’s sandboxed. That’s fair enough, I guess — the Chrome team had a bee in their bonnet about plugins going all the way back to the Chrome launch comic[2]. Interestingly the Chrome team were using svn back then — that’s how long it’s been :-) [1] https://chromereleases.googleblog.com/2010/12/stable-beta-channel-upda… [2] https://www.google.com/googlebooks/chrome/big_28.html

> most of the bugs that Rust could have prevented right on the beggining are already covered (Chrome also uses fuzzers and static analysis tools to automate C++ code) This isn't even close to true... https://chromereleases.googleblog.com/2020/08/stable-channel-update-fo… Here's one from just this month. Here's another from just this month with another fifteen issues: https://chromereleases.googleblog.com/2020/08/stable-channel-update-fo… There are hundreds a year like this. I could find many, many, many more.

Direct link: https://chromereleases.googleblog.com/2020/08/stable-channel-update-fo…

Side note: I wish there was an accepted industry-wide, machine-readable format for security advisories. It's kind of a pain that every project out there defines their own way, ranging from atrocious blog posts: https://chromereleases.googleblog.com/2020/02/stable-channel-update-fo… to plain text files: http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2015-001.txt or custom XMLs: https://www.openssl.org/news/vulnerabilities.xml The CVRF standard promised to be this but is largely unused since it's fairly rigid and requires a lot of investment to get it right. Even GitHub's advisories are fairly limited in the metadata they provide and only accessible through the GraphQL API.