-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 14 Oct 2026 17:13:29 -0400 Source: chromium Architecture: source Version: 155.0.8059.79-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Chromium Team <[email protected]> Changed-By: Andres Salomon <[email protected]> Changes: chromium (155.0.8059.79-1~deb13u1) trixie-security; urgency=high . [ Andres Salomon ] * d/patches/debianization/strip-rlibs.patch: drop, it didn't actually help with armhf builds crashing with OOM. * New upstream security release. - CVE-2026-110152: Buffer overflow in ANGLE. Reported by Zhenpeng (Leo) Lin at depthfirst. - CVE-2026-110149: Use after free in Browser. Reported by Google. - CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge. - CVE-2026-110161: Use after free in Network. Reported by Google. - CVE-2026-110165: Use after free in Core. Reported by Google. - CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge. - CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge. - CVE-2026-110162: Use after free in Desktop. Reported by Findingz. - CVE-2026-110170: Use after free in Bindings. Reported by Google. - CVE-2026-110160: Missing authorization in ReadingMode. Reported by Google. - CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk. Reported by Google. - CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin. - CVE-2026-110150: Privilege elevation in Installer. Reported by M. Fauzan Wijaya (Gh05t666nero). - CVE-2026-110156: Incorrect reference resolution in Extensions. Reported by Google. - CVE-2026-110137: Use after free in WebRTC. Reported by Google. - CVE-2026-110140: Type confusion in V8. Reported by Google. - CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge. - CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge. - CVE-2026-110159: Incorrect authorization in Updater. Reported by Aria Akhavan - Haikhavan Security. - CVE-2026-110144: Incorrect authorization in Mojo. Reported by Souma Ohsawa. - CVE-2026-110153: Use after free in Media. Reported by xinyang. - CVE-2026-110166: Buffer overflow in Animation. Reported by Syn4pse (@ret2happy). - CVE-2026-110169: Use after free in V8. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-110168: Use after free in V8. Reported by Google. - CVE-2026-110139: Use after free in Media. Reported by weihengqiuu. - CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge. - CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge. - CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge. - CVE-2026-110141: Observable discrepancy in Media. Reported by Google. - CVE-2026-110138: Use after free in ShapeDetection. Reported by Google. - CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge. - CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge. - CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge. - CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge. - CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge. - CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge. - CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni. . [ Timothy Pearson] * d/patches/ppc64le: - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Fix syscall execution go/no-go test logic error Checksums-Sha1: 69bf8ee490b8a13238f29d8e18026334825f964f 4415 chromium_155.0.8059.79-1~deb13u1.dsc 695e8fbff5d8ad1626a2a524d379c3a85feaf0c5 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz afccceb9065f741a9e299ce0eaae9672ccd58917 797389528 chromium_155.0.8059.79.orig.tar.xz 44a8044df8665804f5d7a7ceebc4303e98e7563a 582504 chromium_155.0.8059.79-1~deb13u1.debian.tar.xz 89b3db47134bf9580b4fd138d952dbdd59b6b959 27964 chromium_155.0.8059.79-1~deb13u1_source.buildinfo Checksums-Sha256: f531310e27ae933ba02f76a1d2939ed564cdd011b6f1bdbfcfb703ffb5b4a4a4 4415 chromium_155.0.8059.79-1~deb13u1.dsc 75fc1329e91581b28fb4b24ad3661372d80b548d39badbd99c957d59c9d28650 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz 976245b8d9c905795fc4bc3445c379b63f7e1f342186369beffaa1f6e073635e 797389528 chromium_155.0.8059.79.orig.tar.xz 42c8a682377ed5422fc0cbe247427fe7eca211bc57ea7a7102023b3b83e47c39 582504 chromium_155.0.8059.79-1~deb13u1.debian.tar.xz 107012a2dd72024f83f4cd5b5ef6e99e285771b44099aaf86b58dc358d07d145 27964 chromium_155.0.8059.79-1~deb13u1_source.buildinfo Files: e741fb7cb6861d45baf71247ff80f104 4415 web optional chromium_155.0.8059.79-1~deb13u1.dsc 5c434381797894eccda0705bfe75c8e9 17201300 web optional chromium_155.0.8059.79.orig-pre-gen.tar.xz 661d2d2a840cccdb5fa5b700b556c6fa 797389528 web optional chromium_155.0.8059.79.orig.tar.xz 24ae498de7ee670b9f6b85b5c483a6f7 582504 web optional chromium_155.0.8059.79-1~deb13u1.debian.tar.xz 2e184b2a6a00eec15ea0d5c201305e32 27964 web optional chromium_155.0.8059.79-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmrQBrEUHGRpbGluZ2Vy QGRlYmlhbi5vcmcACgkQZF0CR8NudjeB7w//WJDUCvonStn0aHrFbKGWtHNkDYnT 1Udf1LLlAiMsWfl6uAuv/iNLGVukOEM5Q/dHuYku7hFRUCaYaH9g9ix4+K0A0L9n nx9Oph4Dri33I6uw/NeoV/XW+3P6+ryKK+MNHoHX8Wf6K/+jgd5WxSe+uJVHBkni X2viqywiLP1wZf40zIE2jLELt2EKg7/7c+mR+CdEcjITu+EO7aHTeyFbSNI6p4NQ eSymhoiXDaOtP/Q7VQVTFRx+aiuwTIVOD4n0cph4Ji2L/dyT2MCukWBseUuKVwk+ QhAfRDYMOf3Vs+4o1/DIbkMx6PK17TunB66HxRmKbb6ceE4b6BuSAHY3112aZvP/ mLUHzrxuiYiRhGKAzQE2EVa9u921avEwkAkaPRBjLMRbSxGYtt1C18woBSkoVcVj qHTy6hy8UVbPH3aiIzkzQ1c0LKnWXHzsTI3Y2Zngu5M/OWaNzuW8OnxV3apGbMrn w7PxfVIJE1I4a4qPgUWYHMXZ0fj3ZuciYgWAGxGaaSBgH0EKTmAxgEhF8MwNuhEt qUfdEKZPVUqf04T9HWxPhuSANJmwFOw48XCzBiukeR6LjHuQySRHudqFtVNU3NO+ 5jXFp9eLNAyLnE9lPfKJWvQ4POARB0vhXQaHRld/+AIL1NzXLbwGbjD5xbl0X2t9 ohESDJ4plGAeHEs= =/M7K -----END PGP SIGNATURE-----
pgpqf1l8bWsMZ.pgp
Description: PGP signature
