-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 27 Oct 2026 22:31:04 -0400
Source: chromium
Architecture: source
Version: 156.0.8078.73-1
Distribution: unstable
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Changes:
chromium (156.0.8078.73-1) unstable; urgency=high
.
[ Daniel Richard G. ]
* d/clean: Drop files created by d/scripts/unbundle, as they are now
cleaned up in the override_dh_auto_clean target in d/rules.
* d/patches/ppc64le/regen:
- regenerate_xnnpack_patch: Revised version of Tim's script for
generating 0002-regenerate-xnn-buildgn.patch.
- xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's,
to support the regenerate_xnnpack_patch script.
* d/rules:
- Move the functionality of d/scripts/customize-typescript.sh into the
override_dh_auto_configure target.
- On cleaning, restore upstream files that were modified in said target.
- Tweak what files get cleaned up, and delete any resulting empty dirs.
- Don't clean up Cargo.toml.orig files, as the upstream tarball
(not ours) has many of these.
* d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here.
* d/scripts/check-upstream: Error out if the upstream tarball has anything
named *.upstream, as we use that suffix for our purposes.
* d/scripts/customize-typescript.sh: Drop, now handled in d/rules.
* d/scripts/unbundle: Use Python calls (instead of shell commands) to
create symlinks, and preserve existing files.
.
[ Andres Salomon ]
* New upstream security release.
- CVE-2026-118306: Memory corruption in FileSystem.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118331: Improper input validation in FileAPI.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118348: Improper input validation in Skia.
Reported by Xinyang Ge.
- CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge.
- CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge.
- CVE-2026-118318: Improper access control in V8. Reported by Jihyeon
Jeong (Compsec Lab, Seoul National University / Research Intern).
- CVE-2026-118350: Use after free in Turbolev.
Reported by OpenAI Codex Security (amyb).
- CVE-2026-118339: Use after free in Animation.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118305: Memory corruption in Turbolev. Reported by Google.
- CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge.
- CVE-2026-118320: Memory corruption in V8. Reported by Google.
- CVE-2026-118322: Memory corruption in ANGLE. Reported by Google.
- CVE-2026-118329: Improper input validation in ANGLE. Reported by Google.
- CVE-2026-118354: Improper input validation in Skia. Reported by Google.
- CVE-2026-118340: Memory corruption in Skia. Reported by Google.
- CVE-2026-118321: Improper input validation in Core. Reported by Google.
- CVE-2026-118337: Improper access control in Forms.
Reported by Xinyang Ge.
- CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge.
- CVE-2026-118355: Improper input validation in Command.
Reported by Xinyang Ge.
- CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge.
- CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge.
- CVE-2026-118328: Improper input validation in WebRTC.
Reported by Mozilla.
- CVE-2026-118333: Missing authorization in Video.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118336: Improper input validation in Headless.
Reported by Anonymous.
- CVE-2026-118358: Memory corruption in WebAudio.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118353: Use after free in Paint.
Reported by Anthropic and Ada Logics.
- CVE-2026-118349: Memory corruption in Payments.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118327: Memory corruption in Media.
Reported by Please attribute Anthropic and Ada Logics.
- CVE-2026-118359: Memory corruption in V8.
Reported by zenneth (randomguy6407).
- CVE-2026-118343: Improper input validation in ReadingList.
Reported by malichamdan.
- CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben).
- CVE-2026-118334: Use after free in ImageCapture.
Reported by OpenAI Codex Security (kylebot).
- CVE-2026-118332: Improper input validation in Compositing.
Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2.
- CVE-2026-118313: Use after free in Video.
Reported by OpenAI Codex Security (kylebot).
- CVE-2026-118345: Use after free in PDFium.
Reported by OpenAI Codex Security (kylebot).
- CVE-2026-118304: Improper input validation in SVG.
Reported by Arni Hardarson (Neonix Security).
- CVE-2026-118316: Improper input validation in V8. Reported by Google.
- CVE-2026-118346: Use after free in Compositing. Reported by Google.
- CVE-2026-118342: Out of bounds write in Editing. Reported by Google.
- CVE-2026-118310: Improper input validation in Views. Reported by Google.
- CVE-2026-118335: Improper input validation in Metrics.
Reported by Google.
- CVE-2026-118308: Use after free in SVG. Reported by Google.
- CVE-2026-118314: Improper input validation in UI. Reported by Google.
- CVE-2026-118347: Use after free in FileSystem. Reported by Google.
- CVE-2026-118341: Use after free in Modularization. Reported by Google.
- CVE-2026-118330: Use after free in Browser. Reported by Google.
- CVE-2026-118315: Improper input validation in SVG.
Reported by Arni Hardarson (Neonix Security).
- CVE-2026-118356: Use after free in WTF. Reported by malichamdan.
- CVE-2026-118309: Improper input validation in UI. Reported by Google.
- CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge.
- CVE-2026-118312: Memory corruption in Paint. Reported by Google.
- CVE-2026-118338: Use after free in Animation.
Reported by flapjack-security-bugs-access.
Checksums-Sha1:
e8344c775f96ae6518ee11bb8a52c51df9abb7a9 4399 chromium_156.0.8078.73-1.dsc
5cf5d9dd0cc10bf6fbc81d8d76258554e7068a58 18226388 chromium_156.0.8078.73.orig-pre-gen.tar.xz
d570a2bb90f2ad64f2543056823824e5d82f4b5d 801098408 chromium_156.0.8078.73.orig.tar.xz
4cef78d5c1f497f13f6700cf4b9d9989b3124fa1 506356 chromium_156.0.8078.73-1.debian.tar.xz
c6d53ccbb83b9be0afdcdac26b1fd04dfd666cb8 34750 chromium_156.0.8078.73-1_source.buildinfo
Checksums-Sha256:
21da9a7e9ad01ce420f453329341681428f6f9da48bd43bc17d3051eddc28e58 4399 chromium_156.0.8078.73-1.dsc
0764ead49b237c01d07db608b113e014f807c8e5f246a2619901bc1e8616e665 18226388 chromium_156.0.8078.73.orig-pre-gen.tar.xz
e36b2c1ea057e9befdc93dc28e3c0194d1041752b805501bcc7e89e3e9c98ba1 801098408 chromium_156.0.8078.73.orig.tar.xz
1439c1c61beef802e7c012b73437c01411e18f920018c3ed697ef3fff78898ed 506356 chromium_156.0.8078.73-1.debian.tar.xz
42016041930fe92a6efc2ce262eb411331c77faf005d6749964608172f78de05 34750 chromium_156.0.8078.73-1_source.buildinfo
Files:
978c1e2a9ff42cc53f44469628a85296 4399 web optional chromium_156.0.8078.73-1.dsc
eefbb516dfe5208f44d7413d513468ce 18226388 web optional chromium_156.0.8078.73.orig-pre-gen.tar.xz
ec50652fc234dff7efebd537c42ea7b6 801098408 web optional chromium_156.0.8078.73.orig.tar.xz
6d0142d4a86bdcfd6154ce45b7b078aa 506356 web optional chromium_156.0.8078.73-1.debian.tar.xz
5d7de4b2e2e837f7e6f90e12d4e130f5 34750 web optional chromium_156.0.8078.73-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmrh0YkUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8NudjfHSBAAg21Vk2Xvmg93A2oCLCd/FTyh7ZmV
DSFGR+mGWoWVZkBFxC2ZKCyo6fgvmmXdQUf9UXKPZg8cFrM+52A074K1n4J8nXNe
HVs+H5LpTHwkWDAQ3BbowVgRhlq6B9Cn4nbjf2esqcT9MoIcrPycv9INFHJm3um+
eYpBrCXwqiDqLCEnuE3UijttHpPQpNq4w1Bj6T/CdhMtLZbMbdEMjTWyx/bwG11y
aYrFc2WMT0WIpY8MpXummGp+15DtGqqTWaZ/p7JA5Ih4Ew3dHU1TjUoYiyBJH0gM
MavzwS8pLrZ45wAA2/t/VqhEXWp9rwdokipoyl59j7WeMfcACnv+9z4VtjZalGcC
7YB87gqnjGcZYvlOxbOiqIoJlRlhdpVV/aUuzp/Gfyzr0XjWpMb/weTnWMx18t9C
9X29XUbR5beS4BZo8erbvvmi2K2F9Rr2zO7g/amAPquNr02Cwu+ixQsyjnHciYjy
JxdV2JZzA4XmLkRnvSvvxSZ1J/fxyptx7eo+HtqzL+YNqV5FYlz99C6AecXyplAt
EGSeQRAxXq0OvQYHnyNgPPO4EvNMVHsh9WtdUQwfLnez9K+dT/qZwJvLMUql+Lzj
F0hNCxMh9AoKFbYvRgjT/sAMgFJ1z3ecF1BFcCgmSY9dmFhO8W/YRWvcyA6EIaFQ
M/g58S27ky+nV90=
=AVd3
-----END PGP SIGNATURE-----
