The official Chromium releases tags every few hours (how do they even do that?)

This means, as far as I understood, that Downstream Versions of Chromium either ship an unstable Browser but with all security patches, or a stable Browser with Backports.

I am wondering how GrapheneOS does that, and also if you know how other Browsers like Brave (Desktop/Android) do it.

Vanadium is based on Chromium's stable release channel, similar to how other Chromium forks offer those for production usage than the developmental branch. The developmental branch that updates more frequently isn't meant for daily usage and has issues which may also include security issues.

Vanadium versioning involves the Chromium version, suffixed by Vanadium increment counter after the dot.

For example, 119.0.6045.163.2 implies Vanadium has been updated 2 times while retaining 119.0.6045.163 stable release from Chromium as base, seen here: https://github.com/GrapheneOS/Vanadium/releases/tag/119.0.6045.163.2