-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Fri, 07 Aug 2026 12:19:50 -0400 Source: chromium Architecture: source Version: 151.0.7922.108-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Chromium Team <[email protected]> Changed-By: Andres Salomon <[email protected]> Changes: chromium (151.0.7922.108-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/deb_pre_gen.py: Minor fixes to the pre-gen framework: - Always record target outputs in an .OUTPUTS file, even if a target has only a single output. This incurs only a small (tarball) size penalty, and catches cases where there is disagreement on which is the first output file of a .ninja target. - Update the handling logic for generate_css_js_files.js, as the first output file of the .ninja target changed from v150. - Add an extra check to ensure that target outputs are unique. * d/patches/debianization/pre-gen.patch: Tweak a script so that it outputs a constant UUID, instead of one dependent on the build path. * d/patches/system/golang.patch: Prevent the Go compiler from writing things into our home dir, or accessing the network. * d/scripts/init-pre-gen.sh: Don't hard-code the package name, as we might be doing init-pre-gen for ungoogled-chromium. . [ Andres Salomon ] * New upstream security release. - CVE-2026-19137: Use after free in WebGL. Reported by anonymous. - CVE-2026-19149: Use after free in Aura. Reported by Google. - CVE-2026-19154: Use after free in Skia. Reported by Google. - CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. - CVE-2026-19172: Use after free in Views. Reported by Google. - CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@svn-dys). - CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg. - CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google. - CVE-2026-19139: Race in CredentialProvider. Reported by Google. - CVE-2026-19140: Use after free in GPU. Reported by Google. - CVE-2026-19141: Use after free in Resources. Reported by Google. - CVE-2026-19142: Use after free in Views. Reported by Google. - CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs. Reported by Google. - CVE-2026-19144: Use after free in HTML. Reported by Google. - CVE-2026-19145: Use after free in Translate. Reported by Google. - CVE-2026-19146: Uninitialized Use in GPU. Reported by Google. - CVE-2026-19147: Use after free in Aura. Reported by Google. - CVE-2026-19148: Out of bounds write in GPU. Reported by Google. - CVE-2026-19150: Inappropriate implementation in V8. Reported by Google. - CVE-2026-19151: Use after free in V8. Reported by Google. - CVE-2026-19152: Inappropriate implementation in Navigation. Reported by Google. - CVE-2026-19153: Insufficient validation of untrusted input in Workers. Reported by Google. - CVE-2026-19155: Use after free in Payments. Reported by Google. - CVE-2026-19156: Heap buffer overflow in Base. Reported by Viktoria Zlatinova. - CVE-2026-19158: Use after free in Views. Reported by Google. - CVE-2026-19159: Use after free in Views. Reported by Google. - CVE-2026-19160: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19161: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19162: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-19163: Use after free in Media. Reported by Google. - CVE-2026-19164: Insufficient validation of untrusted input in Codecs. Reported by Google. - CVE-2026-19165: Use after free in Extensions. Reported by @bean5oup. - CVE-2026-19166: Use after free in Web Authentication. Reported by heesun. - CVE-2026-19167: Integer overflow in GPU. Reported by Google. - CVE-2026-19171: Use after free in Media. Reported by Google. - CVE-2026-19173: Out of bounds write in Skia. Reported by Vu Van Tien (@n0_Be3r). - CVE-2026-19174: Integer overflow in V8. Reported by Seunghyun Lee (@0x10n) of QED Audit (qedaudit.io). - CVE-2026-19175: Use after free in Payments. Reported by Google. - CVE-2026-19176: Use after free in Skia. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-19177: Insufficient validation of untrusted input in UI. Reported by Fabian Wahle (Hap Security). Checksums-Sha1: aaa18e1fc7807c6a98f69b64179a102bd6b993cd 4408 chromium_151.0.7922.108-1~deb13u1.dsc 5db7fe8f89a8fa3ff494e0286ff5f91358ab6ad5 15073392 chromium_151.0.7922.108.orig-pre-gen.tar.xz 9f6610225455ca29c87964dc04ad23e16873b605 949043204 chromium_151.0.7922.108.orig.tar.xz 033f17f1095dad419b39140da51e6f8384148f5f 549364 chromium_151.0.7922.108-1~deb13u1.debian.tar.xz 3129b3a6b7061d48917b5d48c089e339091f5243 27844 chromium_151.0.7922.108-1~deb13u1_source.buildinfo Checksums-Sha256: 226d69fa1aed9c4b2e8c1d0ab5278802e78d5ce4b10d4f4fbca5e6c925f85ff9 4408 chromium_151.0.7922.108-1~deb13u1.dsc ec5cdca5594aadeeb7076fa27712278037b0ba6f00d5a8ae86602ed573bacba2 15073392 chromium_151.0.7922.108.orig-pre-gen.tar.xz 90e46be09cf71d1d426e6c8266657d85bf75faf958c2ac6d8d31786430ee3762 949043204 chromium_151.0.7922.108.orig.tar.xz 3296e191796d2b1f579b0722408186f4b8f048a4f19cf7220864bca82537685a 549364 chromium_151.0.7922.108-1~deb13u1.debian.tar.xz ac0d98c1199a789b2a9f51f036cfdcb3fe4bcf63504c5c4fba3c862824a3076b 27844 chromium_151.0.7922.108-1~deb13u1_source.buildinfo Files: 414a9d50346f8c3b717409c02f0e1245 4408 web optional chromium_151.0.7922.108-1~deb13u1.dsc 8f3589d01d63ade127070eb61257aea5 15073392 web optional chromium_151.0.7922.108.orig-pre-gen.tar.xz dd30a91d4d7d2e2a7dcd4d3b86e44ec4 949043204 web optional chromium_151.0.7922.108.orig.tar.xz d954f6a01bfb3d45c6cae20b76c0e801 549364 web optional chromium_151.0.7922.108-1~deb13u1.debian.tar.xz c64b4630ae21a7c7d41889d3edbfc356 27844 web optional chromium_151.0.7922.108-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmp21q4UHGRpbGluZ2Vy QGRlYmlhbi5vcmcACgkQZF0CR8NudjfyKw/+K/HblXohmwk/ZLR1R8b7VHc0RFLC Dj5BxuWk9GyDwYOfn71gLBY8SUYcKfFgI0Kx6slUTIWhqPcTwYgl67k9hZZ4fa8C 1nl54v5x79YiSlpB+yylBOyLndax3l54U/NY9NcQ6txaE3JW++B+egrWjRk5k7xL kooTIabTUsmNKKuLJwnrBZ+K/LxUjNeMGnI8YwI0cWqI3njHNEAbnkzHBvyJ3bKA GzAURoEID8+CTljymQwNfRrR4TCRLO92WZhXc1Or0Rc6ELC+N45tUvev3J0OApbW DU9TqQN/D02wP2FOd15/P9YapL9hNs+h4a/EDL/y62B8ImQxj2P2hQBW0kP2xD1t 7P+aOBJAdKYu3J2E3TlmQxvYzDUTGAqrfYmE8qpDubyKVMSWMZyA05crb5pZWrwI TvpUazqAUxgGtsDH3S0Wmne4xDVrEfninNJYmGjR8/KZAAtyDxeFDfCMIbo4vx0z Vb6rRxaxOrG7JANpwZB7SGGJ//RFeR1JhE+2uqEeyBTWeXeULXItBDuUJ4ISe0EZ s5ixfkgR4sPbJ8N1JFUJt8Lr1YvNF84R4Mirt0CIltfHoytRbQiBMGADrY6A0mMl l4eItJJ0qoyBjAZo/eJgJk8TOLewr2WlowKzNG2FauamWAv2CzBnDAu0sAu8F5AO EEAx2b3UC/sohck= =aLg9 -----END PGP SIGNATURE-----
pgpj4YGniTh0k.pgp
Description: PGP signature
