-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 14 Oct 2026 17:13:29 -0400
Source: chromium
Architecture: source
Version: 155.0.8059.79-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Changes:
chromium (155.0.8059.79-1~deb13u1) trixie-security; urgency=high
.
[ Andres Salomon ]
* d/patches/debianization/strip-rlibs.patch: drop, it didn't actually
help with armhf builds crashing with OOM.
* New upstream security release.
- CVE-2026-110152: Buffer overflow in ANGLE.
Reported by Zhenpeng (Leo) Lin at depthfirst.
- CVE-2026-110149: Use after free in Browser. Reported by Google.
- CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge.
- CVE-2026-110161: Use after free in Network. Reported by Google.
- CVE-2026-110165: Use after free in Core. Reported by Google.
- CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge.
- CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110162: Use after free in Desktop. Reported by Findingz.
- CVE-2026-110170: Use after free in Bindings. Reported by Google.
- CVE-2026-110160: Missing authorization in ReadingMode.
Reported by Google.
- CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk.
Reported by Google.
- CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin.
- CVE-2026-110150: Privilege elevation in Installer.
Reported by M. Fauzan Wijaya (Gh05t666nero).
- CVE-2026-110156: Incorrect reference resolution in Extensions.
Reported by Google.
- CVE-2026-110137: Use after free in WebRTC. Reported by Google.
- CVE-2026-110140: Type confusion in V8. Reported by Google.
- CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge.
- CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge.
- CVE-2026-110159: Incorrect authorization in Updater.
Reported by Aria Akhavan - Haikhavan Security.
- CVE-2026-110144: Incorrect authorization in Mojo.
Reported by Souma Ohsawa.
- CVE-2026-110153: Use after free in Media. Reported by xinyang.
- CVE-2026-110166: Buffer overflow in Animation.
Reported by Syn4pse (@ret2happy).
- CVE-2026-110169: Use after free in V8.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-110168: Use after free in V8. Reported by Google.
- CVE-2026-110139: Use after free in Media. Reported by weihengqiuu.
- CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge.
- CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge.
- CVE-2026-110141: Observable discrepancy in Media. Reported by Google.
- CVE-2026-110138: Use after free in ShapeDetection. Reported by Google.
- CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge.
- CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge.
- CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge.
- CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge.
- CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni.
.
[ Timothy Pearson]
* d/patches/ppc64le:
- sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Fix syscall
execution go/no-go test logic error
Checksums-Sha1:
69bf8ee490b8a13238f29d8e18026334825f964f 4415 chromium_155.0.8059.79-1~deb13u1.dsc
695e8fbff5d8ad1626a2a524d379c3a85feaf0c5 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz
afccceb9065f741a9e299ce0eaae9672ccd58917 797389528 chromium_155.0.8059.79.orig.tar.xz
44a8044df8665804f5d7a7ceebc4303e98e7563a 582504 chromium_155.0.8059.79-1~deb13u1.debian.tar.xz
89b3db47134bf9580b4fd138d952dbdd59b6b959 27964 chromium_155.0.8059.79-1~deb13u1_source.buildinfo
Checksums-Sha256:
f531310e27ae933ba02f76a1d2939ed564cdd011b6f1bdbfcfb703ffb5b4a4a4 4415 chromium_155.0.8059.79-1~deb13u1.dsc
75fc1329e91581b28fb4b24ad3661372d80b548d39badbd99c957d59c9d28650 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz
976245b8d9c905795fc4bc3445c379b63f7e1f342186369beffaa1f6e073635e 797389528 chromium_155.0.8059.79.orig.tar.xz
42c8a682377ed5422fc0cbe247427fe7eca211bc57ea7a7102023b3b83e47c39 582504 chromium_155.0.8059.79-1~deb13u1.debian.tar.xz
107012a2dd72024f83f4cd5b5ef6e99e285771b44099aaf86b58dc358d07d145 27964 chromium_155.0.8059.79-1~deb13u1_source.buildinfo
Files:
e741fb7cb6861d45baf71247ff80f104 4415 web optional chromium_155.0.8059.79-1~deb13u1.dsc
5c434381797894eccda0705bfe75c8e9 17201300 web optional chromium_155.0.8059.79.orig-pre-gen.tar.xz
661d2d2a840cccdb5fa5b700b556c6fa 797389528 web optional chromium_155.0.8059.79.orig.tar.xz
24ae498de7ee670b9f6b85b5c483a6f7 582504 web optional chromium_155.0.8059.79-1~deb13u1.debian.tar.xz
2e184b2a6a00eec15ea0d5c201305e32 27964 web optional chromium_155.0.8059.79-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmrQBrEUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8NudjeB7w//WJDUCvonStn0aHrFbKGWtHNkDYnT
1Udf1LLlAiMsWfl6uAuv/iNLGVukOEM5Q/dHuYku7hFRUCaYaH9g9ix4+K0A0L9n
nx9Oph4Dri33I6uw/NeoV/XW+3P6+ryKK+MNHoHX8Wf6K/+jgd5WxSe+uJVHBkni
X2viqywiLP1wZf40zIE2jLELt2EKg7/7c+mR+CdEcjITu+EO7aHTeyFbSNI6p4NQ
eSymhoiXDaOtP/Q7VQVTFRx+aiuwTIVOD4n0cph4Ji2L/dyT2MCukWBseUuKVwk+
QhAfRDYMOf3Vs+4o1/DIbkMx6PK17TunB66HxRmKbb6ceE4b6BuSAHY3112aZvP/
mLUHzrxuiYiRhGKAzQE2EVa9u921avEwkAkaPRBjLMRbSxGYtt1C18woBSkoVcVj
qHTy6hy8UVbPH3aiIzkzQ1c0LKnWXHzsTI3Y2Zngu5M/OWaNzuW8OnxV3apGbMrn
w7PxfVIJE1I4a4qPgUWYHMXZ0fj3ZuciYgWAGxGaaSBgH0EKTmAxgEhF8MwNuhEt
qUfdEKZPVUqf04T9HWxPhuSANJmwFOw48XCzBiukeR6LjHuQySRHudqFtVNU3NO+
5jXFp9eLNAyLnE9lPfKJWvQ4POARB0vhXQaHRld/+AIL1NzXLbwGbjD5xbl0X2t9
ohESDJ4plGAeHEs=
=/M7K
-----END PGP SIGNATURE-----
