-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 14 Oct 2026 17:13:29 -0400
Source: chromium
Architecture: source
Version: 155.0.8059.79-1
Distribution: unstable
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Changes:
chromium (155.0.8059.79-1) unstable; urgency=high
.
[ Andres Salomon ]
* d/patches/debianization/strip-rlibs.patch: drop, it didn't actually
help with armhf builds crashing with OOM.
* New upstream security release.
- CVE-2026-110152: Buffer overflow in ANGLE.
Reported by Zhenpeng (Leo) Lin at depthfirst.
- CVE-2026-110149: Use after free in Browser. Reported by Google.
- CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge.
- CVE-2026-110161: Use after free in Network. Reported by Google.
- CVE-2026-110165: Use after free in Core. Reported by Google.
- CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge.
- CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110162: Use after free in Desktop. Reported by Findingz.
- CVE-2026-110170: Use after free in Bindings. Reported by Google.
- CVE-2026-110160: Missing authorization in ReadingMode.
Reported by Google.
- CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk.
Reported by Google.
- CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin.
- CVE-2026-110150: Privilege elevation in Installer.
Reported by M. Fauzan Wijaya (Gh05t666nero).
- CVE-2026-110156: Incorrect reference resolution in Extensions.
Reported by Google.
- CVE-2026-110137: Use after free in WebRTC. Reported by Google.
- CVE-2026-110140: Type confusion in V8. Reported by Google.
- CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge.
- CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge.
- CVE-2026-110159: Incorrect authorization in Updater.
Reported by Aria Akhavan - Haikhavan Security.
- CVE-2026-110144: Incorrect authorization in Mojo.
Reported by Souma Ohsawa.
- CVE-2026-110153: Use after free in Media. Reported by xinyang.
- CVE-2026-110166: Buffer overflow in Animation.
Reported by Syn4pse (@ret2happy).
- CVE-2026-110169: Use after free in V8.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-110168: Use after free in V8. Reported by Google.
- CVE-2026-110139: Use after free in Media. Reported by weihengqiuu.
- CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge.
- CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge.
- CVE-2026-110141: Observable discrepancy in Media. Reported by Google.
- CVE-2026-110138: Use after free in ShapeDetection. Reported by Google.
- CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge.
- CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge.
- CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge.
- CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge.
- CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni.
.
[ Timothy Pearson]
* d/patches/ppc64le:
- sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Fix syscall
execution go/no-go test logic error
Checksums-Sha1:
bf27238011673fb88b784ece00e1815b5817863e 4394 chromium_155.0.8059.79-1.dsc
695e8fbff5d8ad1626a2a524d379c3a85feaf0c5 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz
afccceb9065f741a9e299ce0eaae9672ccd58917 797389528 chromium_155.0.8059.79.orig.tar.xz
5313f032606e8d9e79fbd4ac24f1acb5d604d9d6 581936 chromium_155.0.8059.79-1.debian.tar.xz
06a095cf750d15968616881bb55c4b0fbdbeb2b7 27066 chromium_155.0.8059.79-1_source.buildinfo
Checksums-Sha256:
9e4979db412bbd537f39fc4614cdd850815c8a12804fbd9efc3d636db464663f 4394 chromium_155.0.8059.79-1.dsc
75fc1329e91581b28fb4b24ad3661372d80b548d39badbd99c957d59c9d28650 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz
976245b8d9c905795fc4bc3445c379b63f7e1f342186369beffaa1f6e073635e 797389528 chromium_155.0.8059.79.orig.tar.xz
022dbbc2140b0034ee3de9f6835aebafee4aba28c46d8f37d83291ac66e888f1 581936 chromium_155.0.8059.79-1.debian.tar.xz
b5f5bdef389f526986c5d8abdd180bdc5efc3c3cd9178a4132564cc619ab2ca3 27066 chromium_155.0.8059.79-1_source.buildinfo
Files:
dcdb4107bda72b24a2410655cb0a5686 4394 web optional chromium_155.0.8059.79-1.dsc
5c434381797894eccda0705bfe75c8e9 17201300 web optional chromium_155.0.8059.79.orig-pre-gen.tar.xz
661d2d2a840cccdb5fa5b700b556c6fa 797389528 web optional chromium_155.0.8059.79.orig.tar.xz
c849be0f0ae7d705ffdb9f07d0d41312 581936 web optional chromium_155.0.8059.79-1.debian.tar.xz
7612e9876d86f106b5ae1a09e1abb0df 27066 web optional chromium_155.0.8059.79-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmrQAnQUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8NudjfRwRAAlNx7JC0HjX17s+E6+44ui2PB+ntR
9+WJtE6lDvTNhw5iOAQOJjewLjWr7krq5ulz6/+38GWnW67O2kv+AB6zWQeJjduJ
dkFMsdNsGMvmeu+wcXg41mcalfqFYcbg4QTlgZ5IxDuPx8SO3SNzgVG61cGmRC7f
VGh7rgqGWIh/H4TSwFyFkB8Urvb59Tlh7C12zGeSuYOjvF1rmHvql1ekxsOEd9iM
IPTf+3W3vk66nVNBh46xBGcfUQpmDn3tusVKtvl2jHfJBkRdfoiZLmFG2z5uI0a9
9LUJIzY0xZbJBU1zA902A38Q0RylbzxF895ozyA/O6UoveNpYhVLFxWupSXzfbKz
SalzuGWXWsG8ENXBlQFyB+qRi0vN8pQHbsc4ttTzXCsyBiruuaXwcyhPYJ+YiuHL
udvIjQlNNPdqNf7i7Q8CywHtLPyVQFXAwJmyKBM3OwfoHvd6sTebb29DGolD5YRu
97CiF9GeqXqgbui2uZ3mqreQedGkG44Cu2bJK7Qxzm5av8jabZFQIAxPnWgad5Mz
M4Um6xl+yM1DV2FXQGQGvHZrdwRpcLBGSQzw0HKzk0j+VytCDXZ29zFEnCMeiT+T
F/qzXutkybrGNVVtv2VD/NKu50qsZ58XVtFnw/tz9SM0CvAURIdMS/A7XPpGT3O8
lT4k+swNzXCaa8Y=
=pcCV
-----END PGP SIGNATURE-----
