deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-34236
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-stored-xss-via-networkcontroller
CVE: CVE-2025-34237
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-stored-xss-via-standalonevpnclientscontroller
CVE: CVE-2025-34238
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-path-traversal-via-ajaxstandalonevpnclientscontroller
CVE: CVE-2025-34239
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-command-injection-in-appmanagementcontroller
CVE: CVE-2025-34240
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-appmanagementcontroller-appupgradeaction
CVE: CVE-2025-34241
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxdevicecontroller-ajaxdeviceaction
CVE: CVE-2025-34242
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxnetworkcontroller
CVE: CVE-2025-34243
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxfwrulescontroller-ajaxnetworkfwrulesaction
CVE: CVE-2025-34244
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxfwruelscontroller-ajaxdevicefwrulesaction
CVE: CVE-2025-34245
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxstandalonevpnclientscontroller
CVE: CVE-2025-34246
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxprevalidationcontroller
CVE: CVE-2025-34247
Published: 2025-11-06
Description: Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://icr.advantech.com/download/software; https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf; https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-networkscontroller
CVE: CVE-2025-52565
Published: 2025-11-06
Description: runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-61, CWE-363
References: https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4; https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398; https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e
CVE: CVE-2025-12486
Published: 2025-11-06
Description: Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Minimal user interaction is required to exploit this vulnerability.

The specific flaw exists within the handling of the database event logs. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-24755.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://www.zerodayinitiative.com/advisories/ZDI-25-980/
CVE: CVE-2025-12487
Published: 2025-11-06
Description: oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the trust_remote_code parameter provided to the join endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26681.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-807
References: https://github.com/oobabooga/text-generation-webui/commit/b5a6904c4ac[PII_REDACTED]090360b6f566f4e4603; https://www.zerodayinitiative.com/advisories/ZDI-25-982/
CVE: CVE-2025-12488
Published: 2025-11-06
Description: oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the trust_remote_code parameter provided to the load endpoint. The issue results from the lack of proper validation of a user-supplied argument before using it to load a model. An attacker can leverage this vulnerability to execute code in the context of the service account.
. Was ZDI-CAN-26680.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-807
References: https://github.com/oobabooga/text-generation-webui/commit/b5a6904c4ac[PII_REDACTED]090360b6f566f4e4603; https://www.zerodayinitiative.com/advisories/ZDI-25-981/
CVE: CVE-2025-12489
Published: 2025-11-06
Description: evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the openBrowser function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27913.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/brentmid/evernote-mcp-server/commit/1e66c78c4ce6ea294ac6b0eb289a9eae9c5e9579; https://www.zerodayinitiative.com/advisories/ZDI-25-983/
CVE: CVE-2025-12790
Published: 2025-11-06
Description: A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-29
References: https://access.redhat.com/security/cve/CVE-2025-12790; https://bugzilla.redhat.com/show_bug.cgi?id=2413004; https://github.com/njh/ruby-mqtt/blob/main/NEWS.md#ruby-mqtt-version-070-2025-10-29
CVE: CVE-2025-33110
Published: 2025-11-06
Description: IBM OpenPages 9.1, and 9.0 with Watson is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://www.ibm.com/support/pages/node/7250321
CVE: CVE-2025-52881
Published: 2025-11-06
Description: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-61, CWE-363
References: http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e[PII_REDACTED]322; http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3; https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
CVE: CVE-2025-64173
Published: 2025-11-06
Description: Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. Apollo Router customers defining @authenticated, @requiresScopes, or @policy directives inconsistently on polymorphic types (i.e., object types that implement interface types) are impacted. This issue is fixed in versions 1.61.12 and 2.8.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://github.com/apollographql/router/releases/tag/v2.8.1; https://github.com/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9; https://www.apollographql.com/docs/graphos/routing/security/authorization#authorization-directives
CVE: CVE-2025-64174
Published: 2025-11-06
Description: Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/OpenMage/magento-lts/commit/9d604f5489851c54a96fca31b0e13c414b0fb20a; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qv78-c8hc-438r; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-qv78-c8hc-438r
CVE: CVE-2025-64326
Published: 2025-11-06
Description: Weblate is a web based localization tool. In versions 5.14 and below,  Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.
CVSS Score: 2.6 (LOW)
CWE: CWE-212
References: https://github.com/WeblateOrg/weblate/pull/16781; https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhc
CVE: CVE-2025-64327
Published: 2025-11-06
Description: ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery (SSRF) vulnerability, in its `/api/ping?url= endpoint`. This allows an attacker to make arbitrary requests to internal or external hosts. This can include discovering ports open on the local machine, hosts on the local network, and ports open on the hosts on the internal network. This issue is fixed in version 0.6.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae; https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/0.6.8; https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-p52r-qq3j-8p78
CVE: CVE-2024-12125
Published: 2025-11-06
Description: A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://access.redhat.com/security/cve/CVE-2024-12125; https://bugzilla.redhat.com/show_bug.cgi?id=2330214
CVE: CVE-2025-11205
Published: 2025-11-06
Description: Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/442444724
CVE: CVE-2025-11206
Published: 2025-11-06
Description: Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 7.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/444755026
CVE: CVE-2025-11207
Published: 2025-11-06
Description: Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1300, CWE-125
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/428189824
CVE: CVE-2025-11208
Published: 2025-11-06
Description: Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/397878997
CVE: CVE-2025-11209
Published: 2025-11-06
Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.2 (HIGH)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/438226517
CVE: CVE-2025-11210
Published: 2025-11-06
Description: Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1300
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/440523110
CVE: CVE-2025-11211
Published: 2025-11-06
Description: Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/441917796
CVE: CVE-2025-11212
Published: 2025-11-06
Description: Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/420734141
CVE: CVE-2025-11213
Published: 2025-11-06
Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/443408317
CVE: CVE-2025-11215
Published: 2025-11-06
Description: Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-193, CWE-193
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/439758498
CVE: CVE-2025-11216
Published: 2025-11-06
Description: Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. (Chromium security severity: Low)
CVSS Score: 6.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/419721056
CVE: CVE-2025-11219
Published: 2025-11-06
Description: Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 3.1 (LOW)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/439772737