-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 27 Oct 2026 22:31:04 -0400 Source: chromium Architecture: source Version: 156.0.8078.73-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian Chromium Team Changed-By: Andres Salomon Changes: chromium (156.0.8078.73-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. Checksums-Sha1: b166a31811b31499d16063131df7cbbd00a11d2d 4415 chromium_156.0.8078.73-1~deb13u1.dsc 5cf5d9dd0cc10bf6fbc81d8d76258554e7068a58 18226388 chromium_156.0.8078.73.orig-pre-gen.tar.xz d570a2bb90f2ad64f2543056823824e5d82f4b5d 801098408 chromium_156.0.8078.73.orig.tar.xz 4ae820df5109343c167a0e3093faf98eed1a40a1 506892 chromium_156.0.8078.73-1~deb13u1.debian.tar.xz 46cac422b3522de55a073c8895ecd5ae06608044 27972 chromium_156.0.8078.73-1~deb13u1_source.buildinfo Checksums-Sha256: f83afce1fe021c1c8b27fe97d6528677041570a9925f8a6d0d796aacd33a82f1 4415 chromium_156.0.8078.73-1~deb13u1.dsc 0764ead49b237c01d07db608b113e014f807c8e5f246a2619901bc1e8616e665 18226388 chromium_156.0.8078.73.orig-pre-gen.tar.xz e36b2c1ea057e9befdc93dc28e3c0194d1041752b805501bcc7e89e3e9c98ba1 801098408 chromium_156.0.8078.73.orig.tar.xz 422ffd880f0b7d65c3549b084f25d2b319432f7896169090056fc406b427a43f 506892 chromium_156.0.8078.73-1~deb13u1.debian.tar.xz 5bef18d3d9d87090bcd8c99872e8ce5aa121e84df1253b20d46b14ab3e96a1ae 27972 chromium_156.0.8078.73-1~deb13u1_source.buildinfo Files: 7509bfc9a98c0f176e2514bf06db96b5 4415 web optional chromium_156.0.8078.73-1~deb13u1.dsc eefbb516dfe5208f44d7413d513468ce 18226388 web optional chromium_156.0.8078.73.orig-pre-gen.tar.xz ec50652fc234dff7efebd537c42ea7b6 801098408 web optional chromium_156.0.8078.73.orig.tar.xz 49a380ed89a3229d33969583d56e27de 506892 web optional chromium_156.0.8078.73-1~deb13u1.debian.tar.xz aefaa4afd8305633d6b19b2f5de37e62 27972 web optional chromium_156.0.8078.73-1~deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmrhvngUHGRpbGluZ2Vy QGRlYmlhbi5vcmcACgkQZF0CR8NudjcO/Q//WYkRQc9KaE4hH/vqmrn2Z3erqzZH lkgaMiM0xOEyxjKwWCu+U+gqsE/zC/aLk38messzDsf2+gmASSFZzeTpGY9EJEV4 1+ulqZOMM0aUJ0ekqy5Y2CCExV8v1SXsrPEpqP9Gg32Z0ubgH+KFyWqU4mjwMAUv 5kqP6G8rdk2q2KP/33vsROQAIb7iM0NsZGlgf8qyFottpow7YpLNXwIRc5jnDPP5 3FCFOdahn15hqeS0m8UCCuOlU5siDfKfC3ULs/Sql9rj+rke47B9M14nQn6wH7rV oeLH1mGqpo6RzQdRfeAut28mvwdqAFOpEoB/6Ly/Z+aFwdbgVjtqs6hNMwG/4dAW kc/n5aV8rEEjEaHdrBjhRnA+Q70P0b2dG5d+B+uWx5r7XByji2tSe9ofSaoLai+a UgwadKieehFSVd9MW25SXl6+Sk9phtyFveeZY3TFeu3rKXSo3P5zjljG51PRcovZ v/kABrBxAdcKIllJaeCgOAtLTozXiqNz/qZUbT2NVAoeHagV11To23t6j2vGgxL8 5/vgLwJDONrG6cuoeMAxLL6ji2E0FR4SqHZg/UyTCD6VsI6AIrSMquhhgCy1g244 KVESawoYYNeXdD8YBDDBg5zfP8YTkoGIUx1UtrftM3vI+mdLMcrooE/4M4bmqRhX zdLfszj+lWZRqY4= =KNQ5 -----END PGP SIGNATURE-----