-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 27 Oct 2026 22:31:04 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: amd64 Version: 156.0.8078.73-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (156.0.8078.73-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. Checksums-Sha1: 2b3c4e02e772f707d64dd94dcd6e8064a571c7c2 4202596 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb b13c031e75893933e70f6a87eee1f5337626d792 31703468 chromium-common_156.0.8078.73-1~deb13u1_amd64.deb 1e1594aa7b29928a98d273d626a85c121ff53444 34365164 chromium-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 446456bcfef1d994d36fb8b681d969829fd413c6 8474220 chromium-driver_156.0.8078.73-1~deb13u1_amd64.deb e6fa4979c1eb0e19bea7986114270a0cacf03720 29288836 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 45939230367d03b6464b87756c64da4325cd937e 69320160 chromium-headless-shell_156.0.8078.73-1~deb13u1_amd64.deb e07a55cb2232edca9bb2bd58992485daf35edeea 20360 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 1e79fea6588f6b83dcd77459d7b0751867cbb13d 161548 chromium-sandbox_156.0.8078.73-1~deb13u1_amd64.deb 5e113025daca1348d317bdc4a2c8514c160e93b9 30417676 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 6802033affeb5a16cee487bb2dbe6e78cede3ae5 67055036 chromium-shell_156.0.8078.73-1~deb13u1_amd64.deb 6cd11447fe533413537b04c0fbd3d35ffe781a61 31481 chromium_156.0.8078.73-1~deb13u1_amd64-buildd.buildinfo 6e2b6e012b22add3f3a0868495dff4b715b409cc 91755788 chromium_156.0.8078.73-1~deb13u1_amd64.deb Checksums-Sha256: 5893336c4b6b8e59c78863d67d63464e5fabad8c3e15454404fe55dcb53d91e6 4202596 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 13fc3dbea698aeea8e6dc165f2afa275522cfde29b8e46c87aa82bc0e53759bf 31703468 chromium-common_156.0.8078.73-1~deb13u1_amd64.deb d2a25b8ebcbb1f4d918f75c51fa0ed37026431472b9fe910446837012907ec26 34365164 chromium-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 4e2b18d9004650c5a1c10e3b9c194add54899afe262c7a4048211b3bb24187e1 8474220 chromium-driver_156.0.8078.73-1~deb13u1_amd64.deb e35c82c2bbd3a51c0f0caf96b35f39ecfde1a22fffec952de34dc099fceda7a4 29288836 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 4b1f82893de149b01c926edb5efcaacb99b0421d1876ed0547b7e6076de1cdf0 69320160 chromium-headless-shell_156.0.8078.73-1~deb13u1_amd64.deb a7373fa90a3afbba9716cef01f543882823583d97bdeb3e7dc3fb10950abb144 20360 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 155ec1fd1afb88a75eefdd6c9d09fa57f1ceb4c6a6870e99ed091812fad8c3d6 161548 chromium-sandbox_156.0.8078.73-1~deb13u1_amd64.deb e1e5b565bafecf9eab053f1309da9464abfa6a62d9b95e94f750bbedd9e4a2c9 30417676 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 6d2a61cea306ade2d1c00ac4f373e6e3e07cc27b631e9bc003e347e5d2408a14 67055036 chromium-shell_156.0.8078.73-1~deb13u1_amd64.deb bd2e3dad5e82b417c3ea72738c48d53ae831048a0bd5411031bef9418c442a6e 31481 chromium_156.0.8078.73-1~deb13u1_amd64-buildd.buildinfo 27f8d260f9ca2ff8853882f6814df0b8eb552ea507b1b580b3a55150d8ec7070 91755788 chromium_156.0.8078.73-1~deb13u1_amd64.deb Files: 7b35663781d41bda996b6c986501f87f 4202596 debug optional chromium-common-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb e8fe2d7b0564ecfbd4fab6dd48c4358e 31703468 web optional chromium-common_156.0.8078.73-1~deb13u1_amd64.deb d8c6b212336931a8be6c19140e894bfa 34365164 debug optional chromium-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 7b06c8218cea7712437313959709a960 8474220 web optional chromium-driver_156.0.8078.73-1~deb13u1_amd64.deb e0d392db5a73ed66fe7ce3fa71cf9582 29288836 debug optional chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 7a83b428e35d21fa98b422fdbf242602 69320160 web optional chromium-headless-shell_156.0.8078.73-1~deb13u1_amd64.deb 2449b1dcddd63b0cabb515b63c2d02a5 20360 debug optional chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 6a395b422cbe7eff49c1f965038df19d 161548 web optional chromium-sandbox_156.0.8078.73-1~deb13u1_amd64.deb 461fc1290cfc1f5b5a06fbec61ce676d 30417676 debug optional chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_amd64.deb 479e597ef84da8a7835f6a03684f6531 67055036 web optional chromium-shell_156.0.8078.73-1~deb13u1_amd64.deb 4032823f2e1b7a82badb84e88342be90 31481 web optional chromium_156.0.8078.73-1~deb13u1_amd64-buildd.buildinfo d43b74f776c84523caf0207a2ba23a17 91755788 web optional chromium_156.0.8078.73-1~deb13u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmrin+sACgkQN8Ugyu9d QiQ+PA/9GBoCPo583tQ7pmlJ4bvIrRkCfJwVKheYjGnODGF+4vL5QgXODhqV2uxq imZONKk8CB9vgiCufNzQeyBmlIjmjIJ/qJnbI/qYruzknEosIM3N7cbCXwJCDAl0 SpI0xZpmKpkE97qMPaBPWDvLt/dkTDnuCh+Fk28vB7eD0vnjySFGLVSHMIuuqX3b +3jXsQJ4Pcqad6uvL373Co50gwOoTdXehQlR1/NARjK8glfBg4GKB8VqH4y4ODmL UTcGeGKr0Rd5UgPxqCyFhFxWTfauTQGIbhEt2ZOul2E7GVGkDAjCkmm42RCXIQSS CYbQo2wMKwd0+I3Ff7BDPRNamee2jckyx/cuqpf03zqg8MNYLIAfgUGbSOHh0Pnk +AIYwj0VEz84OUPwI5NW6nCTS49LCOOhMBH5FqFz/uSEwkc1AfPeAfxwD3zaH+/n W43splGDzFI2k86yC1CGCrkzhVXmSoi7+eUhvYhQvd9omIobAaDc6LNooDcC+yfJ A4SR8Fni1lYCqHiYytz4uOZ3KCI4WPk3VrY9T0YXQRQwY9hsWgqRMFXq9cDUJacf pQ65jZw0G9zpByXLaXIcbdXgsuAoBiVJLVZscVhL+vj/4rDYUb9CAw2JGqfQlF8g apeizJUvD+JsF59Ineyf32iwQnbJFmyFuI+nWnR397+A54XiTmA= =5zZJ -----END PGP SIGNATURE-----