The Chrome team has officially rolled out Chrome 136 to the stable release channel for Windows, Mac, and Linux, bringing a notable update across all supported platforms.
The update will be gradually released over the next few days and weeks, introducing a variety of fixes and enhancements, with a particular emphasis on boosting security and privacy.
Among the most significant improvements in Chrome 136 is the resolution of a privacy vulnerability that has persisted for over 20 years. This flaw allowed websites to detect users’ previously visited links by exploiting the browser’s handling of the CSS :visited selector. Typically, browsers display visited links in a distinct color (like purple), but this styling was applied universally, enabling any website to check if a user had visited a specific link elsewhere.
This vulnerability posed serious privacy risks, as it facilitated tracking, profiling, and potentially phishing attacks. Malicious sites could gain insight into a user’s browsing history by analyzing the color changes in links. In Chrome 136, Google has introduced a more secure approach with a triple-key partitioning method for visited links.
Now, the visited status is handled with three distinct keys: the link URL, the top-level site, and the frame origin. This ensures that only the website that originally hosted the link can access its visited status, effectively preventing cross-site leaks of browsing history.
From a usability perspective, links will still be marked as visited within the same website, maintaining the familiar user interface without compromising privacy.
In addition to addressing the privacy issue, Chrome 136 also resolves eight security flaws, some of which were identified by external researchers. These fixes include:
- A critical heap buffer overflow in HTML (CVE-2025-4096), earning a $5,000 reward.
- Two moderate-severity vulnerabilities in DevTools: out-of-bounds memory access (CVE-2025-4050) and inadequate data validation (CVE-2025-4051), both rewarded with $2,000.
- A minor flaw in DevTools regarding inappropriate implementation (CVE-2025-4052), accompanied by a $1,000 reward.
Besides the external bug reports, Google’s internal security teams have contributed additional fixes through proactive audits and tools such as AddressSanitizer and MemorySanitizer.
For enterprise users, the extended stable channel has also been updated to version 136.0.7103.48/49 for Windows and Mac, ensuring that security and privacy enhancements reach risk-averse environments.
Users are encouraged to update their browsers as soon as Chrome 136 is available, with more detailed blog posts to follow, highlighting new features and significant updates in this release.
By closing a longstanding privacy gap, Chrome 136 marks a major advancement in both security and user trust.
