Node browser runtime release notesRSS

Improvements and enhancements

• Upgraded Chrome from 154.0.8037.57-1 to 156.0.8078.47-1

Security patches

Library vulnerabilities:

• Upgraded undici to 7.30.1 (6.29.1 inside npm): CVE-2026-109383, CVE-2026-109829, CVE-2026-109841, CVE-2026-109869, CVE-2026-109924, CVE-2026-109932, CVE-2026-87018, CVE-2026-87029
• Upgraded ip-address to 10.7.5 (10.7.4 inside npm): CVE-2026-111997
• Upgraded nodemailer to 10.2.1: GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-4ffr-jq9g-5ffx, GHSA-g73g-hqqh-jr95
• Upgraded qs to 6.16.1: CVE-2026-110816

OS vulnerabilities:

• Updated zlib1g to 1:1.3.dfsg-3.1ubuntu2.3: CVE-2026-85091
• Updated libbrotli1: CVE-2026-111497

CA certificates:

• Addressed the eMudhra certificate authority compromise by removing trust for the eMudhra (emSign) root certificates and the Comodo AAA Certificate Services root from the OS CA bundle and the respective keystores

Improvements

• Upgraded node version 22.20.0 to 22.23.4 (fixes critical node CVEs)

Security patches

Fixed the following vulnerabilities:

OS vulnerabilities:

• CVE-2026-16517
• CVE-2026-19033
• CVE-2026-19662
• CVE-2026-19666
• CVE-2026-19667
• CVE-2026-19668
• CVE-2026-19941
• CVE-2026-46675
• CVE-2026-75029
• CVE-2026-76781
• CVE-2026-77119
• CVE-2026-78301
• CVE-2026-80274
• CVE-2026-81563
• CVE-2026-81736
• CVE-2026-86138
• CVE-2026-86142
• CVE-2026-86143
• CVE-2026-86144
• CVE-2026-88806
• CVE-2026-94283
• CVE-2026-94284
• CVE-2026-94285
• CVE-2026-96512

Library vulnerabilities:

• CVE-2026-111755
• CVE-2026-111756
• CVE-2026-111497
• CVE-2026-106069
• CVE-2026-105483
• CVE-2026-105482
• CVE-2026-105481
• CVE-2026-106072
• CVE-2026-106074
• CVE-2026-106070
• CVE-2026-106071
• CVE-2026-106073

Security patches

OS vulnerabilities:

• CVE-2026-35189
• CVE-2026-54872
• CVE-2026-75805
• CVE-2026-75806
• CVE-2026-77696
• CVE-2026-84384
• CVE-2026-84447
• CVE-2026-84448
• CVE-2026-84449
• CVE-2026-84782
• CVE-2026-86219
• CVE-2026-94287
• CVE-2026-95512
• CVE-2026-96889

Library vulnerabilities:

• CVE-2026-104844

Bug fixes

• Fixed 12–30 second click delays on Angular and Zone.js applications. The Synthetics browser extension is now loaded via CDP WebSocket (Extensions.loadUnpacked) instead of BiDi (webExtension.install). Chrome 153+ BiDi introduced a "Waiting for pending navigations" check after every click that stalled responses on apps with pending macrotasks. Switching to CDP keeps BiDi out of the session, restoring ChromeDriver's classic sub-millisecond document.readyState navigation check.

Security patches

Upgraded Chrome from version 153.0.8010.47-1 to 154.0.8037.57-1.

OS vulnerabilities:

• CVE-2025-59375
• CVE-2026-15588
• CVE-2026-16118
• CVE-2026-32776
• CVE-2026-32777
• CVE-2026-32778
• CVE-2026-39919
• CVE-2026-41080
• CVE-2026-45186
• CVE-2026-50219
• CVE-2026-56403
• CVE-2026-56404
• CVE-2026-56405
• CVE-2026-56408
• CVE-2026-56412
• CVE-2026-58010
• CVE-2026-58011
• CVE-2026-58012
• CVE-2026-58013
• CVE-2026-58014
• CVE-2026-58015
• CVE-2026-58016
• CVE-2026-74860
• CVE-2026-82474
• CVE-2026-86140

Library vulnerabilities:

• CVE-2026-17495
• CVE-2026-18149
• CVE-2026-18540
• CVE-2026-19534
• CVE-2026-77301
• CVE-2026-84890
• CVE-2026-84933
• CVE-2026-84947
• CVE-2026-84961
• CVE-2026-85008
• CVE-2026-85014
• CVE-2026-85024
• CVE-2026-90771
• CVE-2026-90776
• CVE-2026-92000
• CVE-2026-92599

Bug fixes

• Fixed deepStrictEqual/strictEqual failures on $webDriver/$browser return values caused by a vm-realm prototype mismatch for scripted-browser monitors

Security patches

Upgraded Chrome from version 152.0.7977.82-1 to 153.0.8010.47-1.

OS vulnerabilities:

• CVE-2026-56208
• CVE-2026-56209
• CVE-2026-56210
• CVE-2026-56211

Enhancements

Added AbortController and AbortSignal as available host globals in the Scripted Browser monitor runtime sandbox.

Bug fixes

Removed the --jitless Chrome JS flag to re-enable JIT compilation, improving script execution performance for Scripted Browser monitors.

Bug fixes

Fixed a Chrome initialization delay of up to 5 minutes on private locations by bypassing Selenium Manager outbound ChromeDriver discovery calls and setting the ChromeDriver path explicitly.

Security patches

Strengthened script sandbox isolation for Scripted Browser Monitor runtime by migrating to vm.runInNewContext for robust V8 context separation.

Upgraded Chrome from version 152.0.7977.64-1 to 152.0.7977.82-1.

Fixed the following vulnerabilities:

OS vulnerabilities:

• CVE-2026-46275
• CVE-2026-53357
• CVE-2026-64015
• CVE-2026-64018
• CVE-2026-64032
• CVE-2026-64073
• CVE-2026-64115
• CVE-2025-71289
• CVE-2026-23469
• CVE-2026-31420
• CVE-2026-31486
• CVE-2026-31560
• CVE-2026-46158
• CVE-2026-46170
• CVE-2026-46315
• CVE-2026-52912
• CVE-2026-52915
• CVE-2026-52916
• CVE-2026-52918
• CVE-2026-52919
• CVE-2026-52921
• CVE-2026-52922
• CVE-2026-52926
• CVE-2026-52941
• CVE-2026-64025
• CVE-2026-64029
• CVE-2026-64033
• CVE-2026-64039
• CVE-2026-64046
• CVE-2026-64047
• CVE-2026-64048
• CVE-2026-64051
• CVE-2026-64055
• CVE-2026-64056
• CVE-2026-64064
• CVE-2026-64083
• CVE-2026-64084
• CVE-2026-64085
• CVE-2026-64086
• CVE-2026-64087
• CVE-2026-64088
• CVE-2026-64089
• CVE-2026-64092
• CVE-2026-64096
• CVE-2026-64097
• CVE-2026-64098
• CVE-2026-64102
• CVE-2026-64106
• CVE-2026-64108
• CVE-2026-64109
• CVE-2026-64111
• CVE-2026-64113
• CVE-2026-64114
• CVE-2026-64116
• CVE-2026-64118
• CVE-2026-64121
• CVE-2026-64125
• CVE-2026-64126
• CVE-2026-64127
• CVE-2026-64128
• CVE-2026-64133
• CVE-2026-64134
• CVE-2026-64135
• CVE-2026-64136
• CVE-2026-64137
• CVE-2026-64138
• CVE-2026-64144
• CVE-2026-64147
• CVE-2026-64148
• CVE-2026-64155
• CVE-2026-64163
• CVE-2026-64165
• CVE-2026-64166
• CVE-2026-64168
• CVE-2026-64170
• CVE-2026-64173
• CVE-2026-64174
• CVE-2026-64177
• CVE-2026-64178
• CVE-2026-64179
• CVE-2026-64180
• CVE-2026-64182
• CVE-2026-64183
• CVE-2026-64184
• CVE-2026-64185
• CVE-2026-64214
• CVE-2026-64217
• CVE-2026-64218
• CVE-2026-64219
• CVE-2026-64220
• CVE-2026-64221
• CVE-2026-64225
• CVE-2026-64231
• CVE-2026-64518
• CVE-2026-57062
• CVE-2026-64034
• CVE-2026-64103
• CVE-2026-64153

Library vulnerabilities:

• CVE-2026-84367
• CVE-2026-84368
• CVE-2026-84375
• GHSA-2x7j-588g-ccc2
• GHSA-8m3c-c648-2xjj
• GHSA-cc9r-2j5m-2m83
• GHSA-wmmp-3585-3rmp
• GHSA-x5fp-wj9c-mxmx
• GHSA-4mjr-xmp4-gh2g
• CVE-2026-82417
• CVE-2026-82562

Security patches

Upgraded Chrome from version 151.0.7922.173-1 to 152.0.7977.64-1.

Fixed the following vulnerabilities:

OS vulnerabilities:

• CVE-2024-2236
• CVE-2025-5278
• CVE-2025-6141
• CVE-2025-15649
• CVE-2026-7017
• CVE-2026-9538
• CVE-2026-12087
• CVE-2026-13221
• CVE-2026-13595
• CVE-2026-13757
• CVE-2026-18938
• CVE-2026-27171
• CVE-2026-27456
• CVE-2026-42250
• CVE-2026-48959
• CVE-2026-48962
• CVE-2026-53612
• CVE-2026-53613
• CVE-2026-53614
• CVE-2026-53615
• CVE-2026-53910
• CVE-2026-54371
• CVE-2026-57432
• CVE-2026-57433
• CVE-2026-59843
• CVE-2026-59845
• CVE-2026-59846
• CVE-2026-59847
• CVE-2026-59848
• CVE-2026-59850
• CVE-2026-62291

Library vulnerabilities:

• CVE-2026-55553