-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 01 Nov 2026 22:51:42 -0500 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: arm64 Version: 156.0.8078.79-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: arm64 Build Daemon (arm-ubc-01) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 1150706 Changes: chromium (156.0.8078.79-1~deb13u1) trixie-security; urgency=high . [ Juan Manuel Méndez Rey ] * d/patches/upstream: new directory for fixes that are already upstream, with the two a component build needs. * d/rules: set use_mold=false and dcheck_always_on=false, which a component build needs because both default back on when is_official_build is off. * d/rules: turn off use_thin_lto in a component build. Thin lto adds -fwhole-program-vtables, which a component build makes unsound, and the browser then crashes in mojo at startup. * d/rules: keep dh_makeshlibs out of /usr/lib/chromium. That directory is private, and chromium-common was declaring libvulkan in its shlibs and activating an ldconfig trigger for it. * d/rules: add the component build configuration, off by default. Name an architecture in COMPONENT_BUILD_ARCHS to turn it on there. * d/rules: build chromium as a component build on armhf, the only configuration whose final link fits in a 32-bit address space. (Closes: #1150706) * d/README.armhf: new, why armhf is built this way and what to check on a version bump. . [ Andres Salomon ] * New upstream security release. - CVE-2026-76024: Memory corruption in MediaStream. Reported by Xinyang Ge. - CVE-2026-76025: Use after free in FileSystem. Reported by Google. - CVE-2026-76026: Memory corruption in Autofill. Reported by Google. - CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google. - CVE-2026-76028: Use after free in FileSystem. Reported by Google. - CVE-2026-76029: Memory corruption in Network. Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com). - CVE-2026-76030: Memory corruption in FileSystem. Reported by huntersnot4. - CVE-2026-76031: Use after free in Input. Reported by Arni Hardarson (Neonix Security). - CVE-2026-119260: Use after free in Frames. Reported by Google. - CVE-2026-119261: Improper input validation in Skia. Reported by Google. - CVE-2026-119262: Improper input validation in V8. Reported by Hyeonjun Ahn (@_deayzl). - CVE-2026-119263: Memory corruption in GarbageCollection. Reported by Xinyang Ge. - CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a. - CVE-2026-119265: Memory corruption in Quota. Reported by Google. - CVE-2026-119266: Use after free in Quota. Reported by Google. - CVE-2026-119267: Memory corruption in DOM. Reported by Xinyang Ge. - CVE-2026-119268: Integer overflow in Editing. Reported by Xinyang Ge. - CVE-2026-119269: Use after free in Blink. Reported by Google. - CVE-2026-119270: Improper input validation in CacheStorage. Reported by Google. - CVE-2026-119271: Use after free in Skia. Reported by Google. - CVE-2026-119272: Out of bounds read in FileSystem. Reported by Google. . [ Daniel Richard G. ] * d/deb_pre_gen.py: Rework script to be called directly by ninja, instead of being called by various upstream build scripts. * d/patches: - debianization/pre-gen.patch: stop patching various upstream scripts (eg, run_bindgen.py). - disable/node-ts.patch: drop, no longer needed with above rework. Checksums-Sha1: 13fbafde9fe1a95a4d64669a576e94384136cd49 4970708 chromium-common-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 257f1054af7bc232c4d3c17ee805cbb5d72ab1d9 36694960 chromium-common_156.0.8078.79-1~deb13u1_arm64.deb 833feee7da46bc6f55c74d90dd13f0aed44c7f47 35945708 chromium-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 3376c3999d98715618be7a6a8bb46333d2ae4ed4 7430764 chromium-driver_156.0.8078.79-1~deb13u1_arm64.deb 84fd476780fbfeecf1ba3b49624b2ce7e8e8461e 30134332 chromium-headless-shell-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb c7dd6256b75aebb87ec22663526a3d24f3735f7f 60758676 chromium-headless-shell_156.0.8078.79-1~deb13u1_arm64.deb 82aa80040ae647ce7ae5b7914a779a027dbf174f 21156 chromium-sandbox-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 8baddd996e08af0ec4cc5f59a50af76c309acf76 162400 chromium-sandbox_156.0.8078.79-1~deb13u1_arm64.deb 902b9e524068e98e61e4cd01ceb957a9d500f71a 31072952 chromium-shell-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 875bc2a304dcbcd08050da1a9dd0a4143fcf83c7 59055292 chromium-shell_156.0.8078.79-1~deb13u1_arm64.deb 3cbf3a16de2b737bb1ada42ca71ecdd0b5c57ef1 31519 chromium_156.0.8078.79-1~deb13u1_arm64-buildd.buildinfo b57f29db71a122287df47dc5cf40aa9538f6a1bd 79459588 chromium_156.0.8078.79-1~deb13u1_arm64.deb Checksums-Sha256: fba89a06a8006a4d75cd51e93090079fb2425873b9549d9e712c02c260e3d3f4 4970708 chromium-common-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 80b0fe734394208d7a9d5daf160dfaea8bc8645214239e941f45bc2903d29f02 36694960 chromium-common_156.0.8078.79-1~deb13u1_arm64.deb 85055cc575d3828caf72ca2f45efc28c206ea6f3e00597fb7d88b65b7476ca28 35945708 chromium-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 510563c1862fa5a2302d9a6e6d902a338ff8fd64b6c3bf17065e91dcf39dff7f 7430764 chromium-driver_156.0.8078.79-1~deb13u1_arm64.deb 95b8b87cdf80479eb83e2d0ae4a8ad211366fa97259a8cc730ce7bd0d5fff646 30134332 chromium-headless-shell-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb ccecd0a51e2f5fdb32d5eef3a3af9cb85372e19671468ea9ee09ce0aea5bf76c 60758676 chromium-headless-shell_156.0.8078.79-1~deb13u1_arm64.deb ede5b87f56c51c0fce190b632f2a00f2a3519f3b551614daed1b6a241d92cbca 21156 chromium-sandbox-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb ba854364547ab91ecdc9c1547643ac29953eec8ab28e92240c97ddc2b5cfc430 162400 chromium-sandbox_156.0.8078.79-1~deb13u1_arm64.deb 12a913abb031c8a8c74eb4db052e7114f6aa771c27f4a408cdcb3b6842a21c13 31072952 chromium-shell-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 9a6e23bdee3b95488d4558da6fcaf07c35bdddd1977386b0808b0503e1db1535 59055292 chromium-shell_156.0.8078.79-1~deb13u1_arm64.deb c551be248517372136f932214250ae029fc0c3d7d856d259c1cfd4ff507eba84 31519 chromium_156.0.8078.79-1~deb13u1_arm64-buildd.buildinfo 9d653adaa334c661144330bd1374bf6564ad510841d0c74f06be40f164218841 79459588 chromium_156.0.8078.79-1~deb13u1_arm64.deb Files: 339b9cbbd7b0c19f416e45c54bce8d8f 4970708 debug optional chromium-common-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 98a5949f6bcf26ee24abca4bce8aa109 36694960 web optional chromium-common_156.0.8078.79-1~deb13u1_arm64.deb 657389a6e40746a62ecc6cb6deb37298 35945708 debug optional chromium-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 8927c26bc62508a44a48ef0571b7e7b6 7430764 web optional chromium-driver_156.0.8078.79-1~deb13u1_arm64.deb 5858c57d46319d78ee7a46f43b24aece 30134332 debug optional chromium-headless-shell-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb e16e5f86ae0be3eee98533331a2a0f22 60758676 web optional chromium-headless-shell_156.0.8078.79-1~deb13u1_arm64.deb 8bf6b95da6846de163547a1a44a538a2 21156 debug optional chromium-sandbox-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 0d54d500127bd9a4d359ef156cb5504a 162400 web optional chromium-sandbox_156.0.8078.79-1~deb13u1_arm64.deb 782eb3435bba02bcc784a24d9f5a2de6 31072952 debug optional chromium-shell-dbgsym_156.0.8078.79-1~deb13u1_arm64.deb 8953afc03c6afe84ade6d6c73c375d98 59055292 web optional chromium-shell_156.0.8078.79-1~deb13u1_arm64.deb 1170ab1297b4c57c0203b1c125e0fb01 31519 web optional chromium_156.0.8078.79-1~deb13u1_arm64-buildd.buildinfo 5cbe814c677ce8ece9ee66cd9e1b551f 79459588 web optional chromium_156.0.8078.79-1~deb13u1_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0Ha//LlsGOpbQ/H4xqCFmsOWgoYFAmrpAvwACgkQxqCFmsOW goaiOA//daRl1Nkqav4/uAXiGXmIu6Rh5Iv+kYqfb8lykeWWlAuQWfxQJU55w7xl 8AIDLYzR0kKqxI/6KT37aaWUKvmpdRDJ7vkUHXVJJjY5LC+8/pMDrJObEh0m97so OW/HuorK3IuD8G/bYYRfiW32yFqerPCQgwtsrI2I9vIkS6wMPyUX7fyKrJ0WBjx/ bNO8EsppCn+YF2n1x9/uW4crrRFCKkm/H9FR9P2rYXRSrQejrNT8V+QDBu+WIvzN 6M/+K6nhSIs0mqemGtBWScMDIlWjE15jI3BzFI2LvPKRcC4VVMuMC2O212wgon6/ JxYpFb4fyU5nCTSSS1TP/cnOd+mK0VpYA1kdqitYxfeAJ1fofKwX4a2ltP3QU0lN olROyXc74A9zNVXU1xxC5qYK6LXBxPk8MTS5AglXJ+eIupIV6PEZFN6jIrd5weBE xq97QRQirJ1kBhdIk/O0AB6YgeaN3JBkPbrZCV/sfwP4BB32KTl+L16fC/oS8hyO GjPIe0U8xI4Ngi2piThRGSKs8FxekDw/d2hv50quLAVeGOQ+ZLMlMYDFIVNbqJNi G66KOIGg6DAG9Ef/Q5vsJop7oL2Cobdxh8MpcZu2o7P4qo3AhUJEm8/oTA6nw3RN YdLzmhBdiGGhaB8DjbaT/gc4PH7nNCPU9CHfVSVqgkSCCthlCqE= =/76T -----END PGP SIGNATURE-----