Security Policy

Supported Versions

Currently supported stable Cobalt versions are.

VersionRelease statusSupported
25.ltsupcoming release:white_check_mark:
24.ltslast stable:white_check_mark:
23.ltsmaintenance:white_check_mark:
22.ltsEOL:no_entry:
< 21.ltsno support:x:

Model

Although Cobalt is built to process web content similar to browsers, it is not a web browser. Our security model assumes only trusted content processing.

Reporting a Vulnerability

Please use https://developers.google.com/youtube/cobalt as an overall guide where to report issues.

Critical security vulnerabilities should be reported via yt-cobalt-security@google.com.