-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sun, 01 Nov 2026 22:51:42 -0500 Source: chromium Architecture: source Version: 156.0.8078.79-1~deb12u1 Distribution: bookworm-security Urgency: high Maintainer: Debian Chromium Team <chromium@packages.debian.org> Changed-By: Andres Salomon <dilinger@debian.org> Closes: 1150706 Changes: chromium (156.0.8078.79-1~deb12u1) bookworm-security; urgency=high . [ Juan Manuel Méndez Rey ] * d/patches/upstream: new directory for fixes that are already upstream, with the two a component build needs. * d/rules: set use_mold=false and dcheck_always_on=false, which a component build needs because both default back on when is_official_build is off. * d/rules: turn off use_thin_lto in a component build. Thin lto adds -fwhole-program-vtables, which a component build makes unsound, and the browser then crashes in mojo at startup. * d/rules: keep dh_makeshlibs out of /usr/lib/chromium. That directory is private, and chromium-common was declaring libvulkan in its shlibs and activating an ldconfig trigger for it. * d/rules: add the component build configuration, off by default. Name an architecture in COMPONENT_BUILD_ARCHS to turn it on there. * d/rules: build chromium as a component build on armhf, the only configuration whose final link fits in a 32-bit address space. (Closes: #1150706) * d/README.armhf: new, why armhf is built this way and what to check on a version bump. . [ Andres Salomon ] * New upstream security release. - CVE-2026-76024: Memory corruption in MediaStream. Reported by Xinyang Ge. - CVE-2026-76025: Use after free in FileSystem. Reported by Google. - CVE-2026-76026: Memory corruption in Autofill. Reported by Google. - CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google. - CVE-2026-76028: Use after free in FileSystem. Reported by Google. - CVE-2026-76029: Memory corruption in Network. Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com). - CVE-2026-76030: Memory corruption in FileSystem. Reported by huntersnot4. - CVE-2026-76031: Use after free in Input. Reported by Arni Hardarson (Neonix Security). - CVE-2026-119260: Use after free in Frames. Reported by Google. - CVE-2026-119261: Improper input validation in Skia. Reported by Google. - CVE-2026-119262: Improper input validation in V8. Reported by Hyeonjun Ahn (@_deayzl). - CVE-2026-119263: Memory corruption in GarbageCollection. Reported by Xinyang Ge. - CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a. - CVE-2026-119265: Memory corruption in Quota. Reported by Google. - CVE-2026-119266: Use after free in Quota. Reported by Google. - CVE-2026-119267: Memory corruption in DOM. Reported by Xinyang Ge. - CVE-2026-119268: Integer overflow in Editing. Reported by Xinyang Ge. - CVE-2026-119269: Use after free in Blink. Reported by Google. - CVE-2026-119270: Improper input validation in CacheStorage. Reported by Google. - CVE-2026-119271: Use after free in Skia. Reported by Google. - CVE-2026-119272: Out of bounds read in FileSystem. Reported by Google. . [ Daniel Richard G. ] * d/deb_pre_gen.py: Rework script to be called directly by ninja, instead of being called by various upstream build scripts. * d/patches: - debianization/pre-gen.patch: stop patching various upstream scripts (eg, run_bindgen.py). - disable/node-ts.patch: drop, no longer needed with above rework. Checksums-Sha1: 4f2ece77433608ae6ac259efdc5788cffac8e83e 4377 chromium_156.0.8078.79-1~deb12u1.dsc b517e12ce018658f0aa2762b5a08a026ecffbdb9 18141952 chromium_156.0.8078.79.orig-pre-gen.tar.xz 303ee58a331bb0e85ad070d18af52524c11fee68 801144748 chromium_156.0.8078.79.orig.tar.xz 5535593d18aba539a30546a0616ec69881d01303 516260 chromium_156.0.8078.79-1~deb12u1.debian.tar.xz 2cdbd582bbaab2e2f1e32b48c56db12703e5cbf3 27233 chromium_156.0.8078.79-1~deb12u1_source.buildinfo Checksums-Sha256: 6120d611c5829f5ac9fcccce451425db7574f66dcd63f28bdf1c4d6285312f8c 4377 chromium_156.0.8078.79-1~deb12u1.dsc 81da743a5cb52784043027e6adf3578cda7667c6e98bbedc41464feb82bc96d9 18141952 chromium_156.0.8078.79.orig-pre-gen.tar.xz 5351bbf4e68def70819a25b3a07eafad8f97204bcd4a3e2002c1a1dd690b0e31 801144748 chromium_156.0.8078.79.orig.tar.xz a6ceee2559cb4ca497de721d79aca74a2f99ed246d92a884e1bf2db0961a303f 516260 chromium_156.0.8078.79-1~deb12u1.debian.tar.xz c811d0ee2a66f0dab3625e43c44dfea2a789d577b90751a9bdbd64061928cc79 27233 chromium_156.0.8078.79-1~deb12u1_source.buildinfo Files: 7b7a89bf7445eda206f4fe17ccfcfaa9 4377 web optional chromium_156.0.8078.79-1~deb12u1.dsc 6d2ff9da6832ad154cfe3389761ee204 18141952 web optional chromium_156.0.8078.79.orig-pre-gen.tar.xz d23ddb08c7feb5222cac20f6b615ce4a 801144748 web optional chromium_156.0.8078.79.orig.tar.xz 54e018915db3380782bfe37c951d3409 516260 web optional chromium_156.0.8078.79-1~deb12u1.debian.tar.xz 9b8743dbab946b897574c2780c5817c1 27233 web optional chromium_156.0.8078.79-1~deb12u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmro+7gUHGRpbGluZ2Vy QGRlYmlhbi5vcmcACgkQZF0CR8Nudjcu2Q/+IwdsesDepMOfDZooPvm+ZYnWUXa1 xDW/L+r1c54e8/EeMGhhVF7utfoQpdz/eRnkg20wCvhrfRNMsfwWdqhqsTFuctLf PrCCX3dRhpCRp8fcJO3GHxqRwlacUClp9bh5SMK7NLCCbVnRO3+nIbDz8LZhCYCB fot69bKYjNDCJY72MTxtb08ILbZG3eMhs1e2MlTL28BRlVmtUeWP85bXZ3TW/I5i EXT+E4wDMW8+kPEHzQ4PK2RU3cOvXNWYap7Pysh38oFDOc6POyKEPWibayyswmBY 1+Y/PjeUSxxeDoWBgehh2IOYXNCQpIbMrnlahYNjcEkcDG7tYHbJhVtXox9TaCdT +1Kd7TMBYcgiqFP6BoZo9BJFIY4WiuNVzB4oxEdFGU1ZleoAxeGBm28wLRXu32cH jHQawc6LwCFvPZQAf1/xl/W7tgycV5BvZGl7zlKJQ3V1fSiA9ucisdlV1iU1kkBH RYLBC4+wuXQ/3vhZvJoigfmPRyxEVospAv+HXCd1CJB652jpJnpwpsuulh31bGhi JUZuB92hcLwZhvWSjl3jPg/EcXL9PnjS+HyhhJhjMsP2Z7YBuwDqbM120+ELLWbO yZUrAuKKWVA4B6Z/mCcd/70AgVAmxJWwyupbY0o3uEPDr499O5E3sebhNg818M99 AVWgNMbbIt0wpis= =lxBz -----END PGP SIGNATURE-----
