Accepted chromium 147.0.7727.137-1 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 29 Apr 2026 04:36:38 -0400
Source: chromium
Architecture: source
Version: 147.0.7727.137-1
Distribution: unstable
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Closes: 1052440
Changes:
 chromium (147.0.7727.137-1) unstable; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-7363: Use after free in Canvas. Reported by heapracer.
     - CVE-2026-7361: Use after free in iOS. Reported by Google.
     - CVE-2026-7344: Use after free in Accessibility. Reported by Google.
     - CVE-2026-7343: Use after free in Views. Reported by Google.
     - CVE-2026-7333: Use after free in GPU.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7360: Insufficient validation of untrusted input in Compositing.
       Reported by Google.
     - CVE-2026-7359: Use after free in ANGLE. Reported by Google.
     - CVE-2026-7358: Use after free in Animation. Reported by Google.
     - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ.
     - CVE-2026-7357: Use after free in GPU. Reported by Google.
     - CVE-2026-7356: Use after free in Navigation. Reported by Google.
     - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google.
     - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google.
     - CVE-2026-7352: Use after free in Media. Reported by Google.
     - CVE-2026-7351: Race in MHTML. Reported by Google.
     - CVE-2026-7350: Use after free in WebMIDI. Reported by Google.
     - CVE-2026-7349: Use after free in Cast. Reported by Google.
     - CVE-2026-7348: Use after free in Codecs. Reported by Google.
     - CVE-2026-7335: Use after free in media.
       Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po).
     - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla.
     - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io.
     - CVE-2026-7347: Use after free in Chromoting. Reported by Google.
     - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google.
     - CVE-2026-7345: Insufficient validation of untrusted input in Feedback.
       Reported by Google.
     - CVE-2026-7338: Use after free in Cast. Reported by Krace.
     - CVE-2026-7342: Use after free in WebView. Reported by Google.
     - CVE-2026-7341: Use after free in WebRTC. Reported by Google.
     - CVE-2026-7339: Heap buffer overflow in WebRTC.
       Reported by c6eed09fc8b174b0f3eebedcceb1e792.
     - CVE-2026-7340: Integer overflow in ANGLE.
       Reported by 86ac1f1587b71893ed2ad792cd7dde32.
     - CVE-2026-7355: Use after free in Media. Reported by Google.
 .
   [ Jianfeng Liu ]
   * d/patches:
     - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch:
       Fixes upstream issue https://crbug.com/501115509. This issue is
       introduced in v147, and unfortunately the fix won't get into v147. This
       issue affects both vaapi and v4l2 decoding under ozone wayland.
     - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine
       support on arm64. There is no official support for widevine on arm64
       linux while there are libwidevine binaries extracted from chromeos,
       which can work on linux (closes: #1052440).
Checksums-Sha1:
 9b4885eafdf4dcdb0d862658babaeacdab8000eb 4065 chromium_147.0.7727.137-1.dsc
 0916bd66a6ae05ad5a1dff42a960c56d29c29aee 787224144 chromium_147.0.7727.137.orig.tar.xz
 c88f347a396714948db6711de688189d0807cb1b 480384 chromium_147.0.7727.137-1.debian.tar.xz
 0dc38c804d2205b64360b493d98cc555f62b2cd1 27947 chromium_147.0.7727.137-1_source.buildinfo
Checksums-Sha256:
 75aa2f52b446b4757fc702e4fa32cb465cf778475910147a3056935f7c2cb795 4065 chromium_147.0.7727.137-1.dsc
 f186528758c082ec3b25992677633918cd0012436613c04da0f62a613063ac51 787224144 chromium_147.0.7727.137.orig.tar.xz
 97891f0b8f4b4b8ec5964fc2cc80ea4306d2bca244b90248998e31c2307aca48 480384 chromium_147.0.7727.137-1.debian.tar.xz
 3aea7f3b7e82a2d5baa3fe86a81ca5618c37c008cd097dc1173fb78acb1eff1a 27947 chromium_147.0.7727.137-1_source.buildinfo
Files:
 ae6e38c5ff7152b2a819669992914448 4065 web optional chromium_147.0.7727.137-1.dsc
 950fb971a06c30b674b09620be44fc38 787224144 web optional chromium_147.0.7727.137.orig.tar.xz
 53182e55b8cb3d908744921704378474 480384 web optional chromium_147.0.7727.137-1.debian.tar.xz
 90c365fb8723607b50e55eb236cead96 27947 web optional chromium_147.0.7727.137-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmnyeGEUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8NudjfpZA/9ElYznv2cYcpBglMfEJo50KKV9+mW
ozd1VIfCssFnI1yXaw8+35QZRg97Uo6x3/SmsYFpKpGbxapCNsvaK8R/K4tm/LfG
uglUq1iU8jOiy27SXKVAj5QQ9rfs4FSmHx1Fy5V4q7Bs93jHq8zYjugp4jXzJUe4
EnKDpHQtwnIYbVa7py0q/7d+/ZO4ojPQ+RvPgu3pL1cesaa3ldfufJgOMYiU+uOB
yhf4jCFwN35uEKFfR9JB2WnPNXPq1PTsIIEYSURmX0hwca/5HQfAUkHGmazxttBn
1/myEcdYmWGz4CovRT3oiwsO7zXNwG5Ge+UUjxUATHIxsXAG63wnErV9Jv2pYrj4
2F6u9PQPziFroP0YmjNIDS5qr8bupvXRyTuitYCtK0hJGP+KLOxrAhEmFtQ/rmVN
MxkRXztFKORXWMckc0ne9AUIqJ20+lsg9Ah4MuNiMZLklsJ430iFpqaniZjaWKzu
mce+PEdVRCFg8g/CXX6t4hsto5H0tAbl1OFqly9V7SBXBa03Nt4kU9ANwKT0+ye8
6uqb15TBkNn4P0CKSOlq53h5WR4eoIYcZUUj4rBwmiDONyfVN9QzG+xduBeLUqB+
/69iQEQP7Sn+1XoyFz3GVb6ty4REt2382o2e7SIk9ZWt3tPTVXz1qyrrxpggaN40
EAsttQ0kx24Zgh4=
=xjw1
-----END PGP SIGNATURE-----