-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 27 Oct 2026 22:31:04 -0400
Source: chromium
Architecture: source
Version: 156.0.8078.73-1~deb12u1
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Changes:
chromium (156.0.8078.73-1~deb12u1) bookworm-security; urgency=high
.
[ Daniel Richard G. ]
* d/clean: Drop files created by d/scripts/unbundle, as they are now
cleaned up in the override_dh_auto_clean target in d/rules.
* d/patches/ppc64le/regen:
- regenerate_xnnpack_patch: Revised version of Tim's script for
generating 0002-regenerate-xnn-buildgn.patch.
- xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's,
to support the regenerate_xnnpack_patch script.
* d/rules:
- Move the functionality of d/scripts/customize-typescript.sh into the
override_dh_auto_configure target.
- On cleaning, restore upstream files that were modified in said target.
- Tweak what files get cleaned up, and delete any resulting empty dirs.
- Don't clean up Cargo.toml.orig files, as the upstream tarball
(not ours) has many of these.
* d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here.
* d/scripts/check-upstream: Error out if the upstream tarball has anything
named *.upstream, as we use that suffix for our purposes.
* d/scripts/customize-typescript.sh: Drop, now handled in d/rules.
* d/scripts/unbundle: Use Python calls (instead of shell commands) to
create symlinks, and preserve existing files.
.
[ Andres Salomon ]
* New upstream security release.
- CVE-2026-118306: Memory corruption in FileSystem.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118331: Improper input validation in FileAPI.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118348: Improper input validation in Skia.
Reported by Xinyang Ge.
- CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge.
- CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge.
- CVE-2026-118318: Improper access control in V8. Reported by Jihyeon
Jeong (Compsec Lab, Seoul National University / Research Intern).
- CVE-2026-118350: Use after free in Turbolev.
Reported by OpenAI Codex Security (amyb).
- CVE-2026-118339: Use after free in Animation.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118305: Memory corruption in Turbolev. Reported by Google.
- CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge.
- CVE-2026-118320: Memory corruption in V8. Reported by Google.
- CVE-2026-118322: Memory corruption in ANGLE. Reported by Google.
- CVE-2026-118329: Improper input validation in ANGLE. Reported by Google.
- CVE-2026-118354: Improper input validation in Skia. Reported by Google.
- CVE-2026-118340: Memory corruption in Skia. Reported by Google.
- CVE-2026-118321: Improper input validation in Core. Reported by Google.
- CVE-2026-118337: Improper access control in Forms.
Reported by Xinyang Ge.
- CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge.
- CVE-2026-118355: Improper input validation in Command.
Reported by Xinyang Ge.
- CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge.
- CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge.
- CVE-2026-118328: Improper input validation in WebRTC.
Reported by Mozilla.
- CVE-2026-118333: Missing authorization in Video.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118336: Improper input validation in Headless.
Reported by Anonymous.
- CVE-2026-118358: Memory corruption in WebAudio.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118353: Use after free in Paint.
Reported by Anthropic and Ada Logics.
- CVE-2026-118349: Memory corruption in Payments.
Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-118327: Memory corruption in Media.
Reported by Please attribute Anthropic and Ada Logics.
- CVE-2026-118359: Memory corruption in V8.
Reported by zenneth (randomguy6407).
- CVE-2026-118343: Improper input validation in ReadingList.
Reported by malichamdan.
- CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben).
- CVE-2026-118334: Use after free in ImageCapture.
Reported by OpenAI Codex Security (kylebot).
- CVE-2026-118332: Improper input validation in Compositing.
Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2.
- CVE-2026-118313: Use after free in Video.
Reported by OpenAI Codex Security (kylebot).
- CVE-2026-118345: Use after free in PDFium.
Reported by OpenAI Codex Security (kylebot).
- CVE-2026-118304: Improper input validation in SVG.
Reported by Arni Hardarson (Neonix Security).
- CVE-2026-118316: Improper input validation in V8. Reported by Google.
- CVE-2026-118346: Use after free in Compositing. Reported by Google.
- CVE-2026-118342: Out of bounds write in Editing. Reported by Google.
- CVE-2026-118310: Improper input validation in Views. Reported by Google.
- CVE-2026-118335: Improper input validation in Metrics.
Reported by Google.
- CVE-2026-118308: Use after free in SVG. Reported by Google.
- CVE-2026-118314: Improper input validation in UI. Reported by Google.
- CVE-2026-118347: Use after free in FileSystem. Reported by Google.
- CVE-2026-118341: Use after free in Modularization. Reported by Google.
- CVE-2026-118330: Use after free in Browser. Reported by Google.
- CVE-2026-118315: Improper input validation in SVG.
Reported by Arni Hardarson (Neonix Security).
- CVE-2026-118356: Use after free in WTF. Reported by malichamdan.
- CVE-2026-118309: Improper input validation in UI. Reported by Google.
- CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge.
- CVE-2026-118312: Memory corruption in Paint. Reported by Google.
- CVE-2026-118338: Use after free in Animation.
Reported by flapjack-security-bugs-access.
Checksums-Sha1:
61e70d41baa3ec1090a944dd726b20325637f374 4377 chromium_156.0.8078.73-1~deb12u1.dsc
5cf5d9dd0cc10bf6fbc81d8d76258554e7068a58 18226388 chromium_156.0.8078.73.orig-pre-gen.tar.xz
d570a2bb90f2ad64f2543056823824e5d82f4b5d 801098408 chromium_156.0.8078.73.orig.tar.xz
bbd844b637e84be801586bee2a90811f0651f5ef 514196 chromium_156.0.8078.73-1~deb12u1.debian.tar.xz
f332869b36d4b4cf725cd0db47569ab08a676536 27233 chromium_156.0.8078.73-1~deb12u1_source.buildinfo
Checksums-Sha256:
03daea013049e50e549c14fd092badfdc1ff8e4e7f8c3c7385147cfbe0c6be18 4377 chromium_156.0.8078.73-1~deb12u1.dsc
0764ead49b237c01d07db608b113e014f807c8e5f246a2619901bc1e8616e665 18226388 chromium_156.0.8078.73.orig-pre-gen.tar.xz
e36b2c1ea057e9befdc93dc28e3c0194d1041752b805501bcc7e89e3e9c98ba1 801098408 chromium_156.0.8078.73.orig.tar.xz
2d53da995166e403934d232b1c006dde2d7107bfdb1ffed8c35a3b4f6d045f33 514196 chromium_156.0.8078.73-1~deb12u1.debian.tar.xz
e3dd50da602d051d29239afd5ba9c671e1af242de0cbbfcc1c937fa272ccd9f2 27233 chromium_156.0.8078.73-1~deb12u1_source.buildinfo
Files:
b97d8065f6b0eb60ad71c05d4fade232 4377 web optional chromium_156.0.8078.73-1~deb12u1.dsc
eefbb516dfe5208f44d7413d513468ce 18226388 web optional chromium_156.0.8078.73.orig-pre-gen.tar.xz
ec50652fc234dff7efebd537c42ea7b6 801098408 web optional chromium_156.0.8078.73.orig.tar.xz
f73b0c0233a40838905286a9604eefab 514196 web optional chromium_156.0.8078.73-1~deb12u1.debian.tar.xz
b14801ee698c3c854ee921119ec6cdf2 27233 web optional chromium_156.0.8078.73-1~deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmritFMUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8Nudjf9HxAAhHp8qQy5aJdxMG5YY1nGYm3W35Ef
BQOhkL+rIIMvYPIObHHOnq0MhVP3nhNrs3gBLTxQzHWXtfpg7piQAu50jnan/++k
xTbwaDaQcdOFV5xM0fpFOnuugI8D5FY8kpKq04H1dVzIs14kwKSStBhDTaNene3l
E/LywexSR69fZF5fJC8P57myLipH+ZzLGf+qqXrxoF0OzXdvby1TxOTiGTcXecgB
D1aOjW3WdI0upN+pzTdqVbDlLS2sAYgVIRFeneNqXqyLoPES0fkZYycyCN6rKWxF
2Ns/Sf+dnHn9Hv/1B6BhkJO6bzsfT/0F+sGPj5uUNW18SZ6F8FavGUvMDi5TlriY
ux0N6sMwo57ykiNgs0VsZAnQV4Tw5LyeIaTw31H/L0kt22bcLAw9PMHJBuzs20lb
daEmLLhkqa999a7KjgJOAQnn/Pl3LGOU4S/lFVZxQkYKodu6ytcC2YLRQBnSF0Si
Sp62HCkUkvFSiYZod2xkWkfccOQyZrEX5KakcznQ24Ehbm6HUW09zKgKjs9o+FfM
97bNGRmxX51Svd7+DNUy9Zz50mF9Be/M+RdjX+knmgZ3RtMpzrDD1iuCyFVGbMfz
RePjo8XdWqoTVuQSYoZANk8XLY3Oj+ob5FoY6DtRC2ClT1HHrdQVEQ5VczY/hCUc
z9cNNwrav4pRMCQ=
=cs3w
-----END PGP SIGNATURE-----
