-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 14 Oct 2026 17:13:29 -0400
Source: chromium
Architecture: source
Version: 155.0.8059.79-1~deb12u1
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Changes:
chromium (155.0.8059.79-1~deb12u1) bookworm-security; urgency=high
.
[ Andres Salomon ]
* d/patches/debianization/strip-rlibs.patch: drop, it didn't actually
help with armhf builds crashing with OOM.
* New upstream security release.
- CVE-2026-110152: Buffer overflow in ANGLE.
Reported by Zhenpeng (Leo) Lin at depthfirst.
- CVE-2026-110149: Use after free in Browser. Reported by Google.
- CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge.
- CVE-2026-110161: Use after free in Network. Reported by Google.
- CVE-2026-110165: Use after free in Core. Reported by Google.
- CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge.
- CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110162: Use after free in Desktop. Reported by Findingz.
- CVE-2026-110170: Use after free in Bindings. Reported by Google.
- CVE-2026-110160: Missing authorization in ReadingMode.
Reported by Google.
- CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk.
Reported by Google.
- CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin.
- CVE-2026-110150: Privilege elevation in Installer.
Reported by M. Fauzan Wijaya (Gh05t666nero).
- CVE-2026-110156: Incorrect reference resolution in Extensions.
Reported by Google.
- CVE-2026-110137: Use after free in WebRTC. Reported by Google.
- CVE-2026-110140: Type confusion in V8. Reported by Google.
- CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge.
- CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge.
- CVE-2026-110159: Incorrect authorization in Updater.
Reported by Aria Akhavan - Haikhavan Security.
- CVE-2026-110144: Incorrect authorization in Mojo.
Reported by Souma Ohsawa.
- CVE-2026-110153: Use after free in Media. Reported by xinyang.
- CVE-2026-110166: Buffer overflow in Animation.
Reported by Syn4pse (@ret2happy).
- CVE-2026-110169: Use after free in V8.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-110168: Use after free in V8. Reported by Google.
- CVE-2026-110139: Use after free in Media. Reported by weihengqiuu.
- CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge.
- CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge.
- CVE-2026-110141: Observable discrepancy in Media. Reported by Google.
- CVE-2026-110138: Use after free in ShapeDetection. Reported by Google.
- CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge.
- CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge.
- CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge.
- CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge.
- CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge.
- CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni.
.
[ Timothy Pearson]
* d/patches/ppc64le:
- sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Fix syscall
execution go/no-go test logic error
Checksums-Sha1:
65a6a0114c89da819369bebbcf02b01adba5af33 4377 chromium_155.0.8059.79-1~deb12u1.dsc
695e8fbff5d8ad1626a2a524d379c3a85feaf0c5 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz
afccceb9065f741a9e299ce0eaae9672ccd58917 797389528 chromium_155.0.8059.79.orig.tar.xz
4ba864ff3c74894c251d8a0177b7504ef135221a 589708 chromium_155.0.8059.79-1~deb12u1.debian.tar.xz
36cd291266acd10c9219464aa153d871fa7df88b 27233 chromium_155.0.8059.79-1~deb12u1_source.buildinfo
Checksums-Sha256:
cf673ebe3cd4dafd85ce0dab4a4b9ae7b608e3e2d16349d240940e41c68d8788 4377 chromium_155.0.8059.79-1~deb12u1.dsc
75fc1329e91581b28fb4b24ad3661372d80b548d39badbd99c957d59c9d28650 17201300 chromium_155.0.8059.79.orig-pre-gen.tar.xz
976245b8d9c905795fc4bc3445c379b63f7e1f342186369beffaa1f6e073635e 797389528 chromium_155.0.8059.79.orig.tar.xz
33773ce13c4c2f18c2d95bb5a510353705685b0e072dde6952facdec45c77acf 589708 chromium_155.0.8059.79-1~deb12u1.debian.tar.xz
3fbaf41d7011721ca5ad75bfa817e8595b8e776e39c15bac521e334b557700fb 27233 chromium_155.0.8059.79-1~deb12u1_source.buildinfo
Files:
6535976fa495775b72d7b41b0e88ed0c 4377 web optional chromium_155.0.8059.79-1~deb12u1.dsc
5c434381797894eccda0705bfe75c8e9 17201300 web optional chromium_155.0.8059.79.orig-pre-gen.tar.xz
661d2d2a840cccdb5fa5b700b556c6fa 797389528 web optional chromium_155.0.8059.79.orig.tar.xz
62a795981a639c2e442a3987e48d2637 589708 web optional chromium_155.0.8059.79-1~deb12u1.debian.tar.xz
70e63df7dde2696a90fc3b876dba055f 27233 web optional chromium_155.0.8059.79-1~deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmrREcsUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8NudjcKyw/9FcJu+sLciPKJXiRqp4i/ntL5ZKiL
FbdfpXG4eSCfxmsqRJ79TrFju4ggp8fttxfRrGYjGGu2MYZS+syl3EpEna/H5w7z
tztCMVJ3JnxCGbiQ2GHLVQkCXTpxGg3JPJyuRfdbFBQMvDWLMBWSAi2RQaBHJmol
DAmIUXZG6qt8TKABlV6HTAw8XYFlAjKZ5gVPIhmzlpmBPfsrHiw5zH6vl/45aMN0
wAikPBXuHpwQxOGJ4HD14POgvbgiyLu6boeC8gvaRi+hcmO5yKXkfkRIs7OsSWp9
PIIbXiN7taax0fVN2C18QLuOa7XaIyZW3kSMYo2T0NDW9BwbLg2wuhta7EXSzqdc
VnOXblkPjkq5cy1uxTWd1QC79xyxJSFrTzD6Z0pC4zFo79MkEIXmd0BoM56DusEj
AtyzgbsUFKW+3YqzavZ9RuwIQYbMiHVOC5qdEnzQYUsMApWW2GmmRZQweAoq5X2C
jNxzN7EKbhr/c5Vd3BpEefEjQ2oKuSHeUfSsYHqyexNiTEBgobIRLmOGeNlA6H6y
EtwZw3Hv3uBPqAyqEZhcqbH/Ax8ye0YcrXFUUEtMEZd79GSe+fANPWJE/Td3Q8KT
wgCwnBwbW9s3qqs1pJwyzq/peMnrj+ko6HGIbf30fVq3A2lti+1q4QMvdXubz2T/
YF3GU4y5kwGZwCs=
=fTuK
-----END PGP SIGNATURE-----
