-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 27 Oct 2026 22:31:04 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: arm64 Version: 156.0.8078.73-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: arm64 Build Daemon (arm-conova-03) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (156.0.8078.73-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. Checksums-Sha1: 20d1d789efb2d6865ce68b02648c89a1fd8a8a3c 4997152 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 7c44959085db077644affcd6bee551b7005f7780 36729468 chromium-common_156.0.8078.73-1~deb13u1_arm64.deb 9430def1167aec55975f23fb3dd22f824d8a6546 35953816 chromium-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 515ed6d8f1ce2bd2811994c0843daab4f32695e7 7430012 chromium-driver_156.0.8078.73-1~deb13u1_arm64.deb f098ba3f0b8aecf5c625aebb75e8c69370d42e61 30132332 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb f0d79767d768ea73d23c4a1c7505b9480b282077 60751216 chromium-headless-shell_156.0.8078.73-1~deb13u1_arm64.deb d94bab00db9238b4eaba84594faa64dee2bd6864 21148 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb aed97a5ade49f7fe98f63e8d0675d03f94e7cf14 162220 chromium-sandbox_156.0.8078.73-1~deb13u1_arm64.deb eab2bb9eea9a64b18e7972212387cea07f0e1cdb 31093864 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 45a2ad2d931c633c75dc449393feda50c214ed76 59042456 chromium-shell_156.0.8078.73-1~deb13u1_arm64.deb bce4d9a7f669e3fddc00e190950eb4f4315f973c 31519 chromium_156.0.8078.73-1~deb13u1_arm64-buildd.buildinfo 2b8cca8183f2d61fa0624da177c4b78fa22e0c08 79447932 chromium_156.0.8078.73-1~deb13u1_arm64.deb Checksums-Sha256: 084602ea1d8209d52e798b4d046846de20f1f47ab599616e92de61008f53ad97 4997152 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb dfa875abf3aa6e484b48485dc14bd7dd0f2e5192d54703b642e3bfef0f474a9c 36729468 chromium-common_156.0.8078.73-1~deb13u1_arm64.deb 9ab9498e103c403f2f747dc575ae96babdd3b1ba5127fce224e17f3531a95db3 35953816 chromium-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 4882ffdd2fec6b31249bb4d267a3a55b3d661061d7217552e66889da6ccf5689 7430012 chromium-driver_156.0.8078.73-1~deb13u1_arm64.deb ac2f808a3008cdd4e6acd565cf8c4d6ae45823040c754399b2731903ca7287ba 30132332 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb efa7cf2682c8f37fbec56880d4ada98aca510eccabd154bd980fdce4734bcdb8 60751216 chromium-headless-shell_156.0.8078.73-1~deb13u1_arm64.deb 2df7eefe4bc86ab2b0f63781739c070a118110b1e2164735dd9e92c4c877a19a 21148 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 4eaf8fa3565b9fec126a38b64334304b49d6554bfac97eb824c0f50c60149555 162220 chromium-sandbox_156.0.8078.73-1~deb13u1_arm64.deb 916dde294f37758676ab59ac392ebb0c2504e336c9bba49b63ddfcc46ecf1407 31093864 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb f46b18797c5641ebedbd8299c4b035685afc8a406864dc632c65e968f1b45f9f 59042456 chromium-shell_156.0.8078.73-1~deb13u1_arm64.deb fdd2c122fc6901705b20b7d63abe1943d093aa7405d021275c908efef9021616 31519 chromium_156.0.8078.73-1~deb13u1_arm64-buildd.buildinfo cd29412f6ea5e1e54efa7e1427431cdac1e5eb95e22a41a3edd22f5136faf15a 79447932 chromium_156.0.8078.73-1~deb13u1_arm64.deb Files: 51dd9c444460a6d4a66f01837b784144 4997152 debug optional chromium-common-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 80cbef897c44cd8a3d8a1bdb92ae73f5 36729468 web optional chromium-common_156.0.8078.73-1~deb13u1_arm64.deb 152a68b357a27ae8e11784ef3585b316 35953816 debug optional chromium-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb f8b1ed9e53fe067915d17191cf46cb8c 7430012 web optional chromium-driver_156.0.8078.73-1~deb13u1_arm64.deb 11117651c319776ade07f61ec2d8d420 30132332 debug optional chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb ebf270e4a029f30d8d18ce34efde0738 60751216 web optional chromium-headless-shell_156.0.8078.73-1~deb13u1_arm64.deb 1368316ca6fd2816ba54b21c669127e2 21148 debug optional chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 35b3c3998d7782514a373ea97904c541 162220 web optional chromium-sandbox_156.0.8078.73-1~deb13u1_arm64.deb 5ccf676e25f961659e0ebc1bb7118f75 31093864 debug optional chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_arm64.deb 74883ee9613fbbf3911ef72f9c6ca82d 59042456 web optional chromium-shell_156.0.8078.73-1~deb13u1_arm64.deb 4547b51ac513ff875971f9a85e19c840 31519 web optional chromium_156.0.8078.73-1~deb13u1_arm64-buildd.buildinfo c6e94f70dc88f3270b1a4b57096b6caa 79447932 web optional chromium_156.0.8078.73-1~deb13u1_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmrimtUACgkQXVp1sEH/ 1mJAgxAAky/7cBjJz5MLGpob1uvs7E4oc4Q6xTTHeyfgj6agocnA9i2hxT2BeFeI 4RMrf/VkiKjHWkXg7OrE1dSs+GU0Z6qyzoAc9BNVvftBWSQXtDWnLDh5eaF0B+1K CRfmbSO9txis0Lobbe/hH4IiKiuO7GpkzM3kplFZLNh/YkR4MH3S07jsVSx1vsHR GMOaSncMtogkwIULgIIYLu/531t/UgHtU/5+lcakB1xdLf3p7pvoMoXH+KjLsUbK 8fvZlWeVEzrRfKVJUDZg7DGsxG90cL4dunhktOWbYjwKCzm06GEHvg33R7krchVV ZynSrxt8LSZEH1damZEJhaZgwDRxc6K3x9rjTS8deK98OW17ijgWTtjt9SEp1NFZ arSE6x/GI8ka0otL2ndOiFb+T5LTPp4fP1edyup2V35+I0pSfeUKutK6j+TbYAkt O2mmj3ar2f0OLCBQxGntGR/lroyjDnriSfqPFjOUQ/R7x1/OeeOJx+mgY5Cl10y4 v28Lm8ejjQujgbfVencL5qaWKnGtYMSd3fB40KOKicIOOtByngY9emudndbB89+y TIWq52QXqF2bvHVeUPziy1CAub1PSboatQeCuqBLLa0YdaUP+yqXmsxEJYext6jf yUlmIqQjLwIW34cSz9Rsq0TBFDzJ3f/wkzra+GLX2MAJ6ZHA4UA= =AjnR -----END PGP SIGNATURE-----