Accepted chromium 156.0.8078.79-1 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 01 Nov 2026 22:51:42 -0500
Source: chromium
Architecture: source
Version: 156.0.8078.79-1
Distribution: unstable
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Closes: 1150706
Changes:
 chromium (156.0.8078.79-1) unstable; urgency=high
 .
   [ Juan Manuel Méndez Rey ]
   * d/patches/upstream: new directory for fixes that are already upstream,
     with the two a component build needs.
   * d/rules: set use_mold=false and dcheck_always_on=false, which a component
     build needs because both default back on when is_official_build is off.
   * d/rules: turn off use_thin_lto in a component build. Thin lto adds
     -fwhole-program-vtables, which a component build makes unsound, and the
     browser then crashes in mojo at startup.
   * d/rules: keep dh_makeshlibs out of /usr/lib/chromium. That directory is
     private, and chromium-common was declaring libvulkan in its shlibs and
     activating an ldconfig trigger for it.
   * d/rules: add the component build configuration, off by default. Name an
     architecture in COMPONENT_BUILD_ARCHS to turn it on there.
   * d/rules: build chromium as a component build on armhf, the only
     configuration whose final link fits in a 32-bit address space.
     (Closes: #1150706)
   * d/README.armhf: new, why armhf is built this way and what to check on a
     version bump.
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-76024: Memory corruption in MediaStream.
       Reported by Xinyang Ge.
     - CVE-2026-76025: Use after free in FileSystem. Reported by Google.
     - CVE-2026-76026: Memory corruption in Autofill. Reported by Google.
     - CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google.
     - CVE-2026-76028: Use after free in FileSystem. Reported by Google.
     - CVE-2026-76029: Memory corruption in Network.
       Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com).
     - CVE-2026-76030: Memory corruption in FileSystem.
       Reported by huntersnot4.
     - CVE-2026-76031: Use after free in Input.
       Reported by Arni Hardarson (Neonix Security).
     - CVE-2026-119260: Use after free in Frames. Reported by Google.
     - CVE-2026-119261: Improper input validation in Skia. Reported by Google.
     - CVE-2026-119262: Improper input validation in V8.
       Reported by Hyeonjun Ahn (@_deayzl).
     - CVE-2026-119263: Memory corruption in GarbageCollection.
       Reported by Xinyang Ge.
     - CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a.
     - CVE-2026-119265: Memory corruption in Quota. Reported by Google.
     - CVE-2026-119266: Use after free in Quota. Reported by Google.
     - CVE-2026-119267: Memory corruption in DOM. Reported by Xinyang Ge.
     - CVE-2026-119268: Integer overflow in Editing. Reported by Xinyang Ge.
     - CVE-2026-119269: Use after free in Blink. Reported by Google.
     - CVE-2026-119270: Improper input validation in CacheStorage.
       Reported by Google.
     - CVE-2026-119271: Use after free in Skia. Reported by Google.
     - CVE-2026-119272: Out of bounds read in FileSystem. Reported by Google.
 .
   [ Daniel Richard G. ]
   * d/deb_pre_gen.py: Rework script to be called directly by ninja, instead
     of being called by various upstream build scripts.
   * d/patches:
     - debianization/pre-gen.patch: stop patching various upstream scripts
       (eg, run_bindgen.py).
     - disable/node-ts.patch: drop, no longer needed with above rework.
Checksums-Sha1:
 6081f495d1af7c9468ace36c6502fdeac9424092 4399 chromium_156.0.8078.79-1.dsc
 b517e12ce018658f0aa2762b5a08a026ecffbdb9 18141952 chromium_156.0.8078.79.orig-pre-gen.tar.xz
 303ee58a331bb0e85ad070d18af52524c11fee68 801144748 chromium_156.0.8078.79.orig.tar.xz
 4b114ba62d667006aaf59faf8b6cc3835d52d59a 508264 chromium_156.0.8078.79-1.debian.tar.xz
 7a0e5e5eba8a5943e9f30c96e8dacfd0779c3a64 34750 chromium_156.0.8078.79-1_source.buildinfo
Checksums-Sha256:
 73095298070d36c3d202d0f82e14378f744fc3e8c5448a3cbeda619efabe5fc6 4399 chromium_156.0.8078.79-1.dsc
 81da743a5cb52784043027e6adf3578cda7667c6e98bbedc41464feb82bc96d9 18141952 chromium_156.0.8078.79.orig-pre-gen.tar.xz
 5351bbf4e68def70819a25b3a07eafad8f97204bcd4a3e2002c1a1dd690b0e31 801144748 chromium_156.0.8078.79.orig.tar.xz
 7f678a7951e3ae803dee32c680a16f64e0e78bbfa74bdbb370d7156b9e060e00 508264 chromium_156.0.8078.79-1.debian.tar.xz
 c6fabf36fdb8536a98b3045847c680c2583fc2ee32aa7438e89371bc97190ee3 34750 chromium_156.0.8078.79-1_source.buildinfo
Files:
 a6c36d326fdb4e29ced7d6d24b711881 4399 web optional chromium_156.0.8078.79-1.dsc
 6d2ff9da6832ad154cfe3389761ee204 18141952 web optional chromium_156.0.8078.79.orig-pre-gen.tar.xz
 d23ddb08c7feb5222cac20f6b615ce4a 801144748 web optional chromium_156.0.8078.79.orig.tar.xz
 28890d5f2bc2b6ba793837d6e904a56b 508264 web optional chromium_156.0.8078.79-1.debian.tar.xz
 16428119fa73a1026781536d9209a935 34750 web optional chromium_156.0.8078.79-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmroEKgUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8Nudjd8VRAAqz/nXCcKqyK1k1giuQap56qbQFnw
GBgbTYOsLH0mD5ScAEq2sBjQnzf0m4C/iChOrNi59iLa4tPBq4KwKP/0oSVMZCtK
WYlkv2AFsrUwjvM6pOrsOJ1oMW8TWkVmfOw8fd/7kObc+jni9aIMtvplgHmZmGTW
CO3Gay1uvUj1hEtM0mZ4UG2ZSMD16JLvi9txWEzofj436JNnlVn+Lw1C1ZLQ0peq
Hdj4XcGY1oo40okuDwectki7DZ/lJlnTXoHJI77SgPibWUgkVA4YEWWI8s9EKwOw
+6klxTQbATB3xPgTU7LBXOMgxzpY5hmkOks0Ct03tNjKm9PCyji76aFi8CcH4Wfh
srVPudr1AoMZU0UshsGBPZSyV0wzgQw8ClznyXxhEUeFN09O3EVorrwe8bNL8qM6
DGs5fjSGNFaOh7l+tKVnITtP2FQFcat+62eTBk0c7fTvv/MqiERphjVQcomf1Duq
KNpO8MmFdROcsq+XQfNWMd9JMNwmRXLfyY18U4h/3bklwDwYQ8hii/LH/MNtcspF
gokZ9a3Z4bK1nW9+8wB2mftigCCP+YufO0sAWuVdpql47DH7TmWKn3m4QO6PojCq
E9Wie4DYaMkp+3GSuE9MB4J0QX7r3vFi5DBOJUzsuxI57rJ2pQNnqdvmg4Xsax9Q
HdXxNodS32RvCeQ=
=SU+q
-----END PGP SIGNATURE-----