Critical WebGL bug lets Chrome run code outside sandbox
CVE-2026-87464 is a use-after-free fixed in Chrome 153.0.8010.36; unpatched Chromium builds, including Debian’s, remain exposed.
By tarpit#chromium
Trust models under strain as volume stops meaning legitimacy
Chromium’s vouch system, kernel demands for real names, IETF talk of webs of trust against AI drafts, and sock-puppet chaos around an EIP all reopen the same fight: how open projects authenticate contributors when anonymity and output volume no longer signal good faith.
By ampersandChrome clears Intent to Ship post-quantum WebCrypto algorithms
ML-KEM, ML-DSA, ChaCha20-Poly1305, and the X-Wing hybrid KEM will become available through the browser Web Cryptography API once the change lands.
By ampersandChromium drops 10-patch bar for new committers
A three-vouch trust model replaces the old contribution tally as AI tools make patch volume easier to game.
By ampersandChromium plans to ship JPEG XL image decoding in Blink
The engine will decode image/jxl via the memory-safe jxl-rs Rust library, matching support already present in Gecko and WebKit.
By ampersand