Author Archives:

Chrome for Android Update

Hi, everyone! We've just released Chrome 149 (149.0.7827.102) for Android. It'll become available on Google Play over the next few days. 

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.


Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 149.0.7827.102/103, Linux: 149.0.7872.102) unless otherwise noted.

Harry Souders
This entry was posted in Uncategorized on by .

Toggle on the Google Mobile Ads Next-Gen SDK in your Unity apps

We are thrilled to announce the Google Mobile Ads (GMA) Next-Gen SDK for Android is now officially available for Unity developers.

Upgrading to GMA Next-Gen SDK for Android offers the following benefits:

  • Faster performance:
    • Up to 27% faster ad request latency for banner ads than the previous version.
    • Smaller size on device than the previous SDK.
    • Starts in the background to minimize impact on app startup.
  • Enhanced stability: GMA Next-Gen SDK removes remote procedure calls (RPCs), which reduces latency and decreases crash risk due to process communication failures.
  • Supports all ad formats: Supports all existing Google Mobile Ads formats. For details, see Select an ad format.
  • The future of Android ads with AdMob: All new development for Android exclusively targets the Next-Gen SDK

One-click upgrade with GMA Unity plugin 11.1.0

GMA Unity plugin version 11.1.0 added a built-in setting to upgrade in GMA Next-Gen SDK instantly:

  1. Navigate to Assets > Google Mobile Ads > Settings within the Unity Editor.
  2. Locate the "Switch Google Mobile Ads Android architecture" setting and select "Upgrade to the GMA Next-Gen SDK".

That's all it takes! Your Android builds are now powered by the Next-Gen SDK.

To get started with the Next-Gen SDK, read the Install GMA Next-Gen SDK developer guide. To comment on this blog post or engage with fellow developers, join the "Google Advertising and Measurement Community" Discord server and share your thoughts on the #gma-next-gen-sdk channel.

 - Nicholas Ventimiglia, Mobile Ads Developer Relations

This entry was posted in Uncategorized on by .

Extended Stable Updates for Desktop

The Extended Stable channel has been updated to 148.0.7778.254 for Windows and Mac which will roll out over the coming days/weeks.


A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip
Google Chrome
This entry was posted in Uncategorized on by .

Stable Channel Update for Desktop

The Stable channel has been updated to 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log


Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.


This update includes 74 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information

[N/A][516501794] Critical CVE-2026-11628: Use after free in Ozone. Reported by Google on 2026-05-25

[N/A][516674532] Critical CVE-2026-11629: Use after free in Ozone. Reported by Google on 2026-05-26

[N/A][516677924] Critical CVE-2026-11630: Use after free in File Input. Reported by Google on 2026-05-26

[N/A][516691130] Critical CVE-2026-11631: Use after free in Aura. Reported by Google on 2026-05-26

[N/A][516707881] Critical CVE-2026-11632: Use after free in TabStrip. Reported by Google on 2026-05-26

[N/A][516963272] Critical CVE-2026-11633: Use after free in Bluetooth. Reported by Google on 2026-05-27

[N/A][516975148] Critical CVE-2026-11634: Use after free in Gamepad. Reported by Google on 2026-05-27

[N/A][516987814] Critical CVE-2026-11635: Use after free in Bluetooth. Reported by Google on 2026-05-27

[N/A][517023053] Critical CVE-2026-11636: Use after free in Autofill. Reported by Google on 2026-05-27

[N/A][517040438] Critical CVE-2026-11637: Use after free in Views. Reported by Google on 2026-05-27

[N/A][517047197] Critical CVE-2026-11638: Use after free in Printing. Reported by Google on 2026-05-27

[N/A][517227707] Critical CVE-2026-11639: Use after free in Compositing. Reported by Google on 2026-05-27

[N/A][517339758] Critical CVE-2026-11640: Integer overflow in libyuv. Reported by Google on 2026-05-28

[N/A][517418936] Critical CVE-2026-11641: Use after free in Bluetooth. Reported by Google on 2026-05-28

[N/A][517678820] Critical CVE-2026-11642: Use after free in Web Apps. Reported by Google on 2026-05-29

[N/A][518006379] Critical CVE-2026-11643: Use after free in Proxy. Reported by Google on 2026-05-29

[N/A][518043597] Critical CVE-2026-11644: Use after free in Views. Reported by Google on 2026-05-30

[$55000][506689381] High CVE-2026-11645: Out of bounds memory access in V8. Reported by 303f06e3 on 2026-04-27

[$500][517168239] High CVE-2026-11646: Use after free in ViewTransitions. Reported by Quac Tran on 2026-05-27

[N/A][502156940] High CVE-2026-11647: Use after free in Printing. Reported by Google on 2026-04-13

[N/A][506684534] High CVE-2026-11648: Use after free in FullScreen. Reported by Mihnea Nicolau on 2026-04-27

[N/A][511270083] High CVE-2026-11649: Use after free in V8. Reported by Google on 2026-05-08

[N/A][511279942] High CVE-2026-11650: Use after free in V8. Reported by Google on 2026-05-08

[N/A][511736002] High CVE-2026-11651: Use after free in Network. Reported by Google on 2026-05-10

[N/A][513156160] High CVE-2026-11652: Use after free in Extensions. Reported by Google on 2026-05-14

[N/A][513321171] High CVE-2026-11653: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-14

[N/A][513362710] High CVE-2026-11654: Use after free in CameraCapture. Reported by Google on 2026-05-15

[N/A][513396305] High CVE-2026-11655: Integer overflow in Media. Reported by Google on 2026-05-15

[N/A][513424000] High CVE-2026-11656: Use after free in ServiceWorker. Reported by Google on 2026-05-15

[N/A][513465272] High CVE-2026-11657: Use after free in Payments. Reported by Google on 2026-05-15

[N/A][513564337] High CVE-2026-11658: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-15

[N/A][513702971] High CVE-2026-11659: Insufficient validation of untrusted input in UI. Reported by Google on 2026-05-16

[N/A][513731890] High CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page. Reported by Google on 2026-05-16

[N/A][513748868] High CVE-2026-11661: Use after free in Views. Reported by Google on 2026-05-16

[N/A][513773313] High CVE-2026-11662: Type Confusion in Bindings. Reported by Google on 2026-05-16

[N/A][513820666] High CVE-2026-11663: Use after free in Skia. Reported by Google on 2026-05-16

[N/A][513830374] High CVE-2026-11664: Use after free in Payments. Reported by Google on 2026-05-16

[N/A][513948465] High CVE-2026-11665: Out of bounds read in Dawn. Reported by Google on 2026-05-17

[N/A][514009323] High CVE-2026-11666: Insufficient validation of untrusted input in Input. Reported by Google on 2026-05-17

[N/A][514671098] High CVE-2026-11667: Out of bounds read in WebRTC. Reported by Google on 2026-05-19

[N/A][515419790] High CVE-2026-11668: Uninitialized Use in Codecs. Reported by Google on 2026-05-21

[N/A][515429352] High CVE-2026-11669: Integer overflow in Media. Reported by Google on 2026-05-21

[N/A][515469283] High CVE-2026-11670: Use after free in PDF. Reported by Google on 2026-05-21

[N/A][516608438] High CVE-2026-11671: Use after free in Navigation. Reported by Google on 2026-05-26

[N/A][516794471] High CVE-2026-11672: Out of bounds write in GPU. Reported by Google on 2026-05-26

[N/A][516902973] High CVE-2026-11673: Use after free in InterestGroups. Reported by Google on 2026-05-26

[N/A][516910450] High CVE-2026-11674: Use after free in Guest View. Reported by Google on 2026-05-27

[N/A][516915337] High CVE-2026-11675: Insufficient validation of untrusted input in Skia. Reported by Google on 2026-05-27

[N/A][516949298] High CVE-2026-11676: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-27

[N/A][516979551] High CVE-2026-11677: Race in Network. Reported by Google on 2026-05-27

[N/A][516986556] High CVE-2026-11678: Integer overflow in libyuv. Reported by Google on 2026-05-27

[N/A][516997135] High CVE-2026-11679: Use after free in Codecs. Reported by Google on 2026-05-27

[N/A][517004487] High CVE-2026-11680: Use after free in Media. Reported by Google on 2026-05-27

[N/A][517050585] High CVE-2026-11681: Use after free in Ozone. Reported by Google on 2026-05-27

[N/A][517103584] High CVE-2026-11682: Insufficient validation of untrusted input in Views. Reported by Google on 2026-05-27

[N/A][517129549] High CVE-2026-11683: Use after free in WebCodecs. Reported by Google on 2026-05-27

[N/A][517130229] High CVE-2026-11684: Insufficient policy enforcement in Network. Reported by Google on 2026-05-27

[N/A][517183713] High CVE-2026-11685: Insufficient data validation in MediaCapture. Reported by Google on 2026-05-27

[N/A][517247333] High CVE-2026-11686: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-27

[N/A][517303276] High CVE-2026-11687: Use after free in Dawn. Reported by Google on 2026-05-28

[N/A][517309206] High CVE-2026-11688: Object lifecycle issue in SVG. Reported by Google on 2026-05-28

[N/A][517486004] High CVE-2026-11689: Insufficient validation of untrusted input in Passwords. Reported by Google on 2026-05-28

[N/A][517533654] High CVE-2026-11690: Out of bounds read and write in Media. Reported by Google on 2026-05-28

[N/A][517585486] High CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page. Reported by Google on 2026-05-28

[N/A][517607902] High CVE-2026-11692: Use after free in Read Anything. Reported by Google on 2026-05-28

[N/A][517644287] High CVE-2026-11693: Inappropriate implementation in Plugins. Reported by Google on 2026-05-28

[N/A][517705966] High CVE-2026-11694: Use after free in ServiceWorker. Reported by Google on 2026-05-29

[N/A][517762104] High CVE-2026-11695: Inappropriate implementation in Passwords. Reported by Google on 2026-05-29

[N/A][517993381] High CVE-2026-11696: Uninitialized Use in Video. Reported by Google on 2026-05-29

[N/A][518105731] High CVE-2026-11697: Insufficient validation of untrusted input in UI. Reported by Google on 2026-05-30

[N/A][518235412] High CVE-2026-11698: Use after free in Bluetooth. Reported by Google on 2026-05-30

[N/A][518237527] High CVE-2026-11699: Use after free in Bluetooth. Reported by Google on 2026-05-30

[N/A][511732085] Medium CVE-2026-11700: Use after free in Tracing. Reported by Google on 2026-05-10

[N/A][516413817] Medium CVE-2026-11701: Insufficient validation of untrusted input in Guest View. Reported by Google on 2026-05-25


Google is aware that an exploit for CVE-2026-11645 exists in the wild.


We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.


Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.


Daniel Yip

Google Chrome

This entry was posted in Uncategorized on by .

Introducing the Workspace Policy API mutate endpoints for DLP

The Workspace Policy API provides a centralized, comprehensive view of your security settings, eliminating the need to navigate to numerous pages in the Admin console.

With our latest update, we are introducing mutate endpoints (Create, Update, Delete) alongside existing read-only capabilities (Get, List) for data loss prevention (DLP) rules and detectors. This allows super admins to programmatically manage and fully automate the entire lifecycle of their DLP policies, from initial creation to real-time activation and deactivation.

Note this is an API-only launch for capabilities currently supported in the Admin console.

About DLP

DLP lets Workspace admins control external file sharing to prevent sensitive information leaks. It scans files for violations, triggering incidents and protective actions like content blocking.

How DLP works:

  • Admins define rules for sensitive content across Drive, Gmail, Chat, and Chrome.
  • DLP scans content for DLP rule violations that trigger DLP incidents.
  • DLP enforces the rules you defined and violations trigger actions, such as alerts.
  • Admins are alerted for DLP rule violations.
Summary of capabilities supported by mutate endpoints for DLP

Getting started

  • Admins: You must be a super admin to use the Policy API. See our developer documentation to learn more about the Policy API. You can also use GAM, an open source tool for managing Workspace, which now supports the Policy API.
  • End users: This is an admin-only capability.

Rollout pace

Availability

  • Available to all Google Workspace customers and Workspace Individual subscribers

Resources

This entry was posted in Uncategorized on by .