[Bug]: Server preview browser is still on Chrome 157.0.8103.38, missing the fix for an exploited CVE #34920

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Run v0.1.9 and open a preview tab so the server downloads its browser.
2. Check ~/.t3/tools/chrome-headless-shell/linux64/. It's 157.0.8103.38, the VERSION pinned in apps/server/src/preview/PreviewBrowser.ts on main.

Expected behavior

The preview browser picks up Chrome security releases soon after they ship, and fast when one fixes a bug that's being exploited.

Actual behavior

Chrome 157.0.8103.50 went to Stable on Nov 9 with 9 security fixes, including CVE-2026-125350 (use after free in XML), which Google says is exploited in the wild. 157.0.8103.78 followed on Nov 11 with 83 more, 5 of them critical. v0.1.9 shipped on Nov 11 still pinned to .38, and there's no open PR for either.

This has happened before. The pin only moves when someone sends a PR by hand. When the server browser landed on Oct 6 it pinned 154.0.8037.92 and stayed there until Oct 24, missing all of Chrome 155 and the first 156 Stable build, and that bump (#24542) was for the eMudhra certs. The last two bumps (#27822, #30820) were quick, but both came from one outside contributor, and a merged bump still only reaches users at the next release.

This browser opens whatever pages agents and users point it at, and it doesn't auto-update or load a CRLSet (see #24542), so the pin is the only way fixes arrive.

Could the bump be automated? A scheduled workflow that reads Chrome for Testing's last-known-good-versions.json, fills in the sizes and SHA-256s, and opens a PR would cover most of it. Failing that, a stated policy would help, e.g. bump within a few days of a Stable security release and cut a patch release when there's an in-the-wild exploit.

#31740 (system browser override) would help anyone who can use a packaged Chromium, but default installs still depend on the pin.

Version or commit

v0.1.9, main @ 8024e50

Environment

Linux x64, server running as a systemd user service