Fuzio 2026.4.0
Chromium 150.0.7871.47
We upgraded Chromium to a newer version, which introduces 433 security fixes. Among them:
- CVE-2026-13774: Use after free in Extensions
- CVE-2026-13775: Use after free in GPU
- CVE-2026-14398: Use after free in ANGLE
- CVE-2026-13776: Type Confusion in Dawn
- CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb
See the Chromium release announcement for more details.
Touch ID on macOS
Fuzio now supports the built-in macOS Touch ID platform authenticator using the WebAuthn API. Users on Mac can authenticate to sites that support passkeys using Touch ID directly through the browser.
As part of enabling this feature, the Chromium bundle ID changed from
org.chromium.Chromium to tech.Mercury. Because macOS identifies
applications by their bundle ID, it now treats this as a different application
than previous builds. Developers and users may see macOS permission prompts on
the first launch after an update — camera, microphone, screen recording,
notifications, and accessibility access may each be re-requested. This is
expected one-time behavior; granting the permissions restores normal operation.
Breaking changes
Asynchronous media device selection
SelectMediaDeviceCallback is now asynchronous. The callback no longer
returns a Response value. Instead, it receives an Action object and calls
the appropriate method on it.
Previous versions:
engine.mediaDevices().set(SelectMediaDeviceCallback.class, params -> {
MediaDevice selected = chooseDevice(params.mediaDevices());
return SelectMediaDeviceCallback.Response.select(selected);
});
2026.4.0:
engine.mediaDevices().set(SelectMediaDeviceCallback.class, (params, action) -> {
MediaDevice selected = chooseDevice(params.mediaDevices());
action.select(selected);
});
Password store records
PasswordStore now provides remove(PasswordRecord), which removes a
specific password record from the store.
Use it when you need to remove an exact saved credential or a blacklisted
record returned by allNeverSaved():
passwordStore.allNeverSaved().forEach(passwordStore::remove);
Quality enhancements
IllegalArgumentExceptionis no longer thrown when showing an off-screen JavaFXBrowserViewwith JavaFX 25 on macOS.- HTML access keys now activate correctly in off-screen Swing
BrowserViewon Windows when native input is enabled. - WebAuthn dialogs now appear in the correct position on macOS in both off-screen and hardware-accelerated rendering modes.
- The application no longer freezes during close when
removeKeyboardListeneris called on Windows. - Capture lists for screens and application windows are no longer empty on
macOS when using
StartCaptureSessionCallback. - The sharing source picker dialog now appears in
OFF_SCREENmode on macOS. - Exclusive-access instruction bubbles — for example, “To see your cursor, press Esc” — are no longer shown when a page enters pointer lock, keyboard lock, or full screen.

