-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 30 Sep 2026 03:47:05 -0400 Source: chromium Architecture: source Version: 154.0.8037.92-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Chromium Team <[email protected]> Changed-By: Andres Salomon <[email protected]> Changes: chromium (154.0.8037.92-1~deb13u1) trixie-security; urgency=high . [ Andres Salomon ] * New upstream security release. - CVE-2026-102331: Buffer overflow in ANGLE. Reported by @mfx. - CVE-2026-102317: Improper privilege management in Mojo. Reported by Google. - CVE-2026-102312: UI misrepresentation in Omnibox. Reported by jodyritonga. - CVE-2026-102313: Uninitialized resource in ANGLE. Reported by Google. - CVE-2026-102299: Type confusion in V8. Reported by Andrew Boni. - CVE-2026-102306: Use after free in Bluetooth. Reported by Google. - CVE-2026-102307: Uninitialized resource in Dawn. Reported by Google. - CVE-2026-102323: Type confusion in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-102303: Uninitialized resource in GPU. Reported by Google. - CVE-2026-102311: Uninitialized resource in GPU. Reported by Google. - CVE-2026-102300: Uninitialized resource in WebGPU. Reported by Arni Hardarson (Neonix Security). - CVE-2026-102326: Type confusion in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-102316: Use after free in Views. Reported by Xinyang Ge. - CVE-2026-102304: Use after free in Passwords. Reported by Xinyang Ge. - CVE-2026-102328: Type confusion in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-102309: Use after free in FullScreen. Reported by sean geofrey. - CVE-2026-102325: Uninitialized resource in Skia. Reported by Google. - CVE-2026-102308: Use after free in Views. Reported by Google. - CVE-2026-102301: Out of bounds write in GPU. Reported by Google. - CVE-2026-102319: Uninitialized resource in GPU. Reported by Google. - CVE-2026-102324: Use after free in PictureInPicture. Reported by Blockian Creator of Kritt and Open-Kritt. - CVE-2026-102318: Out of bounds read in WebGL. Reported by Google. - CVE-2026-102329: Cross-site scripting in WebUI. Reported by chipsec. - CVE-2026-102315: Uninitialized resource in Media. Reported by Google. - CVE-2026-102302: Buffer overflow in V8. Reported by Google. - CVE-2026-102321: Type confusion in V8. Reported by Taisic Yun (@taisic_) of Theori, with Xint. - CVE-2026-102320: Missing authorization in CORS. Reported by Anonymous. - CVE-2026-102310: Missing authorization in Payments. Reported by Autodidact. - CVE-2026-102327: Incorrect authorization in WebView. Reported by Google. - CVE-2026-102330: Incorrect authorization in SiteIsolation. Reported by Google. - CVE-2026-102314: UI misrepresentation in TabStrip. Reported by Google. - CVE-2026-102305: UI misrepresentation in SignIn. Reported by Google. * d/patches: - disable/omnibox-ai-mode.patch: add patch that *actually* removes the AI Mode button from the new tab page's omnibox. Checksums-Sha1: 47014e543c8e6ddbeadfb0c6007c3905d0af74c3 4415 chromium_154.0.8037.92-1~deb13u1.dsc 971bd0c616f73b93c555e45aaafea6a7b4bf33d3 16689032 chromium_154.0.8037.92.orig-pre-gen.tar.xz eab6649cbb68eeb184a5a899fda828988ac0b608 995122080 chromium_154.0.8037.92.orig.tar.xz c26330e333ecd800d9c3b70714ea68302e532a28 575700 chromium_154.0.8037.92-1~deb13u1.debian.tar.xz d2506ca28cb7da74122e19568995c1ba14884c04 27964 chromium_154.0.8037.92-1~deb13u1_source.buildinfo Checksums-Sha256: c5838ef54aafb5ab925f7acb7b82d41fa599b6dff0f96b80c1862030697afbd7 4415 chromium_154.0.8037.92-1~deb13u1.dsc d8316f2d3cbe1ab942629b9b1044166f33ca9575478feac814a31463c81e8cbe 16689032 chromium_154.0.8037.92.orig-pre-gen.tar.xz d5a37fdb95f8c2d24f505f36824540158367d20101f47623e93670cbda006e7e 995122080 chromium_154.0.8037.92.orig.tar.xz e347d1dca5a28add92495339bd528be6c8cbdd771427dd6d5b354c85e8e44909 575700 chromium_154.0.8037.92-1~deb13u1.debian.tar.xz cc0e504c362d79eae88ec32fe0afd71b73eb56dfe45c13deb3d8000abca9782b 27964 chromium_154.0.8037.92-1~deb13u1_source.buildinfo Files: 1a9697239e63b2480823133b519bb8a9 4415 web optional chromium_154.0.8037.92-1~deb13u1.dsc e2bbef87a3ae1828a7d523507e0fbe11 16689032 web optional chromium_154.0.8037.92.orig-pre-gen.tar.xz 49e6d74714cbed79ccb64da86f35c830 995122080 web optional chromium_154.0.8037.92.orig.tar.xz 787c8dec302378150b5b4ff79f36671f 575700 web optional chromium_154.0.8037.92-1~deb13u1.debian.tar.xz ad9c333259cab4b2a71bce6e27e14e3c 27964 web optional chromium_154.0.8037.92-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmq9TOYUHGRpbGluZ2Vy QGRlYmlhbi5vcmcACgkQZF0CR8NudjdhcxAAxgjI8mZ2L3w/3WGFwoMpFimoGcB1 gAiVweyUBYYk29Ehz22V7O+TVNSuIJU+fY+sG6gzJl2Alv4w3atZl8LE8UuTPJlk 3bRInQwBgVAVABfnR1qqzLUfOvVyoZzAseso/97Aa+OrAQrZfytbIyNpYwG+pGKn NbAd5bcz1KWmNm+i3+xZefUN2zXmRiyyKqjLE+4dnC4NdqaWa04t3ANGHTBgoZeH zoSwMBr4Tmq5saOqFactj9QV6UvjatsYaWbsOJxcliFzes5Z4KMbM2vJMZKK76Bp WJbW+kGyeBg9p86ew7pHRFp5YP+JxUDj21CQTyUu89gTYtcfpYgwAnt9foOedr/h TkjzWXApDYqiQx1iG8VhIg8DyODFbFDEliLKLGCHMogPSBucyeAAla7x4V4c9H9N qLl8P5RiPYJJxs0v7BOmIPdccjCsgVyURd53aHJKGj7nAvCWFyLOp72a6Xo9A9MG m/3tgtIwgag/bU3aKY159OLi7UtPsoDvM6zsyLOG83ElVPHfkjz7dqUFYlYB74nV UHYvH66uXrGuycaNugHDbz/UhEPyT0fTDE5r0efxOZmq1TZWTuKAKlQ+pZTKYGW0 pdu6L2DP6LmeweHWavcAVeBOxp/4NaqeZfEWUCUEQ5rbWgsnq6nzIJrlg/S4NODM e0mUufsttSTi4gY= =AXfK -----END PGP SIGNATURE-----
pgpZW73ORDsNu.pgp
Description: PGP signature
