Fuzio 2026.5.0

Opening links in external apps 

OpenExternalAppCallback.Params now exposes url() — the URL that is about to be handed to the external application. Previously the callback only provided the localized dialog texts, so there was no way to tell which link triggered it or to apply your own allow/deny rules before calling Action.open().

browser.set(OpenExternalAppCallback.class, (params, tell) -> {
    if (isTrusted(params.url())) {
        tell.open();
    } else {
        tell.cancel();
    }
});

We also removed Chromium’s built-in limitation on how often external applications may be launched. Chromium blocks every external-protocol request after the first one until the user performs a new gesture, which meant script-initiated requests were silently dropped and your callback was never invoked for them. Fuzio now routes every request to OpenExternalAppCallback, so a web page can open an external application as many times as needed, and the decision to allow or block it is entirely yours.

As part of the same change, mailto: links are no longer special-cased. Chromium used to launch the default mail client directly, bypassing the callback; mailto: now reaches OpenExternalAppCallback like any other external scheme.

macOS 12 is no longer supported 

Starting with this release, macOS 13 (Ventura) is the minimum supported macOS version. This change follows the Chromium 151 upgrade, which dropped support for macOS 12 (Monterey).

Chromium 151.0.7922.72 

We upgraded Chromium to a newer version, which introduces 435 security fixes. Among them:

• CVE-2026-15899: Use after free in CameraCapture
• CVE-2026-15900: Use after free in GPU
• CVE-2026-15901: Use after free in Network
• CVE-2026-17650: Use after free in Compositing
• CVE-2026-17651: Insufficient validation of untrusted input in Dawn
• CVE-2026-15764: Use after free in Ozone
• CVE-2026-15765: Use after free in Ozone
• CVE-2026-15766: Uninitialized Use in Skia
• CVE-2026-15767: Heap buffer overflow in libyuv
• CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas

See the Chromium release announcements for more details:

• July 16
• July 21
• July 23
• July 29

Quality enhancements 

• Added the bundled 7zr utility to the SBOM.
• Fixed a deadlock when closing an Engine used by Compose in off-screen mode.
• Fixed duplicate characters in SWT off-screen mode on Windows when native input is enabled.
• Swing BrowserView now works correctly when embedded into SWT on macOS without throwing an exception.
• Touch events in Windows off-screen mode now work correctly when other Java UI elements shift the BrowserView.
• Cancelling StartPresentationCallback with media routing enabled no longer causes a crash.
• Closing a browser with an active picture-in-picture window no longer causes a crash.
• Pressing Esc now releases pointer lock correctly on all platforms.