-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 27 Oct 2026 22:31:04 -0400 Source: chromium Binary: chromium-l10n Architecture: all Version: 156.0.8078.73-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Andres Salomon Description: chromium-l10n - web browser - language packs Changes: chromium (156.0.8078.73-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. Checksums-Sha1: 9979f27bea7f6478abb88515b1bea012f7bdd634 8938196 chromium-l10n_156.0.8078.73-1~deb13u1_all.deb 905ccb7e8f724d72cb19a803920098055f0c6711 27985 chromium_156.0.8078.73-1~deb13u1_all-buildd.buildinfo Checksums-Sha256: 5bae8887fcd828ffb76b5feb839a121dc95a44af2b649e30528b1bd88347017f 8938196 chromium-l10n_156.0.8078.73-1~deb13u1_all.deb b1b6ce576357d129811d5e1de0b04b237f7b11d6201ae302e08d05065003717f 27985 chromium_156.0.8078.73-1~deb13u1_all-buildd.buildinfo Files: dc5cfe41b130ef2a958b3d0acaa47805 8938196 localization optional chromium-l10n_156.0.8078.73-1~deb13u1_all.deb bdefd9ae75eb63c2bc33e4746567602f 27985 web optional chromium_156.0.8078.73-1~deb13u1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmriTDEACgkQmgPNRvTf /zcKXRAAm0vmrfDd9NnLJ5Z13HKs2UEyC3CoeRDSslp04prrpvMlmaq7MG/ReqYr xlVynpFh8eVq3o4ziWeWdTjdKx5nXdsBgazbMwFWKs4K4FxaqgLNMrWPu1iXwap7 l6aiCeKZ+hPYuqGLzvaibj5TEwmkxk5sQreOrnETsAEI+FafeQ8JScRqIRiJR52Z d0Zi852OhRrVKCl6w2oBM0Gl+CmWoKOfuDmh24yIbepUTZFtgyFz2BTVv5AuUVyO 4M/NVmizHQOIN1xQ0XRarlbeJZ9+AFT05sAFcVNqG2SbocU/Ob5+/+9SNpTTNiEg qkiwed4o/L3/NkKsdKpTn/2UPh9Q38Nu9XlYyraTJCWrLaa4U2yuLuTv75sdgMfM n5pmau12/dFHk+aw1yd8Uv0GZcaaRUZJea0HUBsYPlmu1VsOKAasYEzUUDuE12LM id0ZJrAvyjdaONRBXN5YafnjHKWL8UNDmHfWcog6Fjw6rZMqPbvhJysoqPKVuHBo jnrGY+lGihIWltN/Ds3MQOa4etoKjzwTsl9ZVzpfxQrnCMqo1YOTXNtp7DQUF1IK ShxbNrCE5uUD+oJiW3EuYCJ9pQWc/VuEw2PDVnlR+6SZXOCXO4SUGYfDIfKDe+6L 8Y8QNO6pZFZXURvDY35yz8aAv/ae7KM2+2AeSyzhX8QW8FZKmCQ= =UG/5 -----END PGP SIGNATURE-----