Vivaldi shipped a fifth minor update for Desktop 8.2 on September 18, 2026, just one day after minor update 4 landed.
If your Vivaldi browser stopped at update 4, you're already behind on the newest Chromium security fixes included in Vivaldi's current stable build, according to Vivaldi's release notes.
That gap matters because Vivaldi's update posts don't always make the browser build and underlying Chromium build easy to distinguish.
Update 4, released on September 17, patched a script-injection security issue in Vivaldi Mail and fixed a broken "Accept" button in Calendar.
Update 5 builds directly on top of that work with Chromium 152.0.7977.137 ESR, including security fixes from Chromium 153.0.8010.52 and .53.
Vivaldi currently lists the latest stable Desktop build as Vivaldi 8.2.4133.68, paired with Chromium 152.0.7977.137 ESR.
If you're still on the previous Chromium 152.0.7977.134 ESR build from update 4, install the latest Desktop 8.2 update.
What Vivaldi 8.2 Update 4 Fixed
Update 4's headline fix addresses a script-injection security issue in Vivaldi Mail, tracked internally as VB-131004.
Vivaldi's update 4 changelog lists it as:
[Mail][Security] Script injection in email (VB-131004)
Vivaldi also describes the release as including "a security fix from us," distinguishing the Mail issue from the Chromium security work bundled into the same update.
The release moved Chromium to 152.0.7977.134 ESR, incorporating security fixes from Chromium 153.0.8010.47.
Two everyday problems were fixed in the same release.
Clicking Accept on a Calendar invitation had been doing nothing, a bug tracked as VB-131622.
Audio feeds had also lost their sound, tracked as VB-131543.
Both fixes shipped with update 4.
If you rely on Vivaldi's built-in Calendar to manage meeting invitations, that Accept bug wasn't merely cosmetic. Invitations could arrive while the control for accepting them failed.
Anyone who experienced the problem should still confirm invitation acceptance works normally after updating.
What the Vivaldi Desktop 8.2 Security Update Does Not Disclose
The release note for update 4 identifies the Mail script-injection problem as a security issue, but it doesn't provide a CVE number, severity rating, exploitation conditions, or an active-exploitation warning.
That's noticeably less detail than Vivaldi provided for some other security fixes in the same 8.2 cycle.
The first 8.2 minor update, released September 4, included a fix for CVE-2026-85046, a type-confusion vulnerability in V8.
Vivaldi explicitly said that Chromium had a known exploit for that vulnerability in the wild.
Update 2 on September 11 similarly included CVE-2026-87491, an out-of-bounds write vulnerability in V8 that Vivaldi also said had a known exploit in the wild.
Update 4's Vivaldi Mail fix comes with no equivalent statement about active exploitation.
Treat it as a confirmed security fix with limited public detail, not evidence that attackers were known to be exploiting VB-131004 before Vivaldi patched it.
Why the Chromium 152 ESR Update in Update 5 Matters
Update 5 arrived one day after update 4.
Its changelog says the listed changes were made "since the fourth 8.2 minor update," confirming that it supersedes update 4 rather than representing a parallel release branch.
The main change is Chromium 152.0.7977.137 ESR, incorporating security fixes from Chromium 153.0.8010.52 and .53.
Update 4 had stopped at Chromium 152.0.7977.134 ESR, with fixes from Chromium 153.0.8010.47.
So anyone still on the update 4 Chromium build has Vivaldi's Mail, Calendar, and audio-feed fixes but doesn't have the later Chromium security work included in update 5.
Update 5 also fixes a "small tabs" display issue, tracked as VB-131314.
That isn't a security fix, but it confirms the two updates contain different code rather than being two labels for the same release.
Calendar and Security Fixes Across the 8.2 Cycle
The Calendar issue fixed in update 4 wasn't the first Calendar-related fix in Vivaldi 8.2.
On September 11, minor update 2 fixed an incorrect sanitization of calendar display, tracked as VB-130990 and explicitly marked as a security issue.
That release also fixed:
Calculator precision rounding, VB-131340.
Flexible vertical-tab spacing, VB-131200.
Several other smaller issues.
It moved Chromium to 152.0.7977.124 ESR, incorporating fixes from Chromium 153.0.8010.36 and .37, including CVE-2026-87491.
Update 4 then addressed the separate broken Calendar invitation Accept button six days later.
Vivaldi therefore shipped more than one Calendar-related fix during the 8.2 cycle, covering both sanitization and basic invitation handling.
Tracking the Full Vivaldi 8.2 Patch Sequence
Vivaldi 8.2 launched on September 3, 2026, introducing features including a local calculator in the address field and easier Progressive Web App installation.
Five numbered minor updates have followed.
The sequence is:
September 4, minor update 1: Chromium security update including CVE-2026-85046, a V8 type-confusion vulnerability Vivaldi said had a known exploit in the wild.
September 11, minor update 2: Chromium 152.0.7977.124 ESR, including CVE-2026-87491; Calendar display-sanitization fix; calculator rounding fix; vertical-tab spacing fix.
September 14, minor update 3: Linux-only update fixing open-media-format support on modern Linux distributions. Windows and macOS were not affected and didn't receive this build.
September 17, minor update 4: Chromium 152.0.7977.134 ESR; Vivaldi Mail script-injection fix; Calendar invitation Accept fix; audio-feed sound fix.
September 18, minor update 5: Chromium 152.0.7977.137 ESR with later Chromium 153 security fixes; small-tabs display fix.
That Linux-only third update explains why some Windows and macOS users may not remember seeing five separate Desktop builds even though Vivaldi's release numbering reached update 5.
As of September 24, Vivaldi's Desktop update feed still lists minor update 5 as the latest stable Desktop 8.2 maintenance release.
What to Check Before You Assume You're Current
Don't use the Chromium number alone as the Vivaldi browser version.
The current stable pairing is:
Vivaldi: 8.2.4133.68
Chromium: 152.0.7977.137 ESR
Vivaldi's official update instructions say Windows and Linux users can manually check from:
Vivaldi menu > Help > Check for Updates
On macOS, use:
Vivaldi > Check for Updates
If an update is available, install it and restart the browser when prompted.
Automatic updates can also download in the background and finish installing after a restart, depending on your settings and installation type.
If you're on Vivaldi 8.2 but the underlying Chromium version is still 152.0.7977.134 ESR, you're on update 4 rather than the latest update 5 code.
If Vivaldi reports 8.2.4133.68 with Chromium 152.0.7977.137 ESR, you match the current stable Desktop release documented by Vivaldi as of September 24.
The practical advice is simple: don't stop at update 4 just because it contains the Mail security fix. Update 5 arrived a day later and adds newer upstream Chromium security work on top of it.
Comments
Be the first, drop a comment!