-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 27 Oct 2026 22:31:04 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: i386 Version: 156.0.8078.73-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: all / amd64 / i386 Build Daemon (x86-conova-02) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (156.0.8078.73-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. Checksums-Sha1: 1cba1b35b7b36793dbbd6b2eb423caa157fc6278 4144988 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_i386.deb d5ba20fde0148efbe039ee28a94a7e3fb9366cbd 31833124 chromium-common_156.0.8078.73-1~deb13u1_i386.deb 4a91e97e1f38f73bc5e078c1cb59f8c28d6b7cc2 37411352 chromium-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 2239cef493dc194cba23c554d69a2461f3a26e18 8829276 chromium-driver_156.0.8078.73-1~deb13u1_i386.deb ccc6b4cc57aecbc6681f78c936d21e9c9a88db43 31028392 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 4c488af427884eaa694ee8554ad3d3f24947ff34 65136932 chromium-headless-shell_156.0.8078.73-1~deb13u1_i386.deb f471677f0df4c50c6f0ae76521f227d1967ea19c 19372 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 0a65063abd568f40619c4140b4d50b62ccd758d0 161440 chromium-sandbox_156.0.8078.73-1~deb13u1_i386.deb 4856948f30689b420907366fedc1837a6e8f4fed 33422980 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 502e9ec66bf485653cfc3e0a32985d1d1b6e1204 69688232 chromium-shell_156.0.8078.73-1~deb13u1_i386.deb 9a09a80945e69f7f345c86310589662fad974751 31403 chromium_156.0.8078.73-1~deb13u1_i386-buildd.buildinfo a4c6aada365ba0a3617301e0426afb216797eb69 83293372 chromium_156.0.8078.73-1~deb13u1_i386.deb Checksums-Sha256: 5bdd6c81cf10fffcea26b5ae490c27ade19b664932ec21904fe61050fdcb49b5 4144988 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_i386.deb ecff50650523e5ae98f697671fd321d952aea8364581a2999940feee18064223 31833124 chromium-common_156.0.8078.73-1~deb13u1_i386.deb 3c4ff30e32d62dc85a399b05cf265bcf030974b14061f850b48cc5b49a36a13b 37411352 chromium-dbgsym_156.0.8078.73-1~deb13u1_i386.deb cd1387cb1be058c4d95c81033c9fdfbd1882c32721e615dd6ad87b15943d545a 8829276 chromium-driver_156.0.8078.73-1~deb13u1_i386.deb 020747c7745d2869e13e3e01edfadcebfa9dd49abc8cc23b23d9b79dd7a4317a 31028392 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 81c29e3b7fd3d0133907c156f37e6aa9bedac6494ebaf475c434d9ed987dda1d 65136932 chromium-headless-shell_156.0.8078.73-1~deb13u1_i386.deb 584d6e2017fd46990e3d5390d46b679c8edb0b7c38be14249e4832177ead4b76 19372 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_i386.deb e9bc7f00fdf5e9687c796f71e186dd4ad839a9cb8f3c9ccbd2e47dd60645cf01 161440 chromium-sandbox_156.0.8078.73-1~deb13u1_i386.deb 66194695b4e93750cb0d602fc3dc813d790bfa52a8f1688413b4e67f1bd7a052 33422980 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 8b8fdfa2864bfbbeb16812ff024a13b7f9753cc446db6fc04b5d5fbf6f0c0ca4 69688232 chromium-shell_156.0.8078.73-1~deb13u1_i386.deb c2312aa1c95eb8e6b5c2edbcf546308ffa8024fd8d68f7d59701efaab622d9c4 31403 chromium_156.0.8078.73-1~deb13u1_i386-buildd.buildinfo cc3360ede65fb7a2a36e82dd2b9562416ce1a1e1eafce0f760e383f910bf9e6c 83293372 chromium_156.0.8078.73-1~deb13u1_i386.deb Files: a818b57b5de391a1fa9722fae1ee376e 4144988 debug optional chromium-common-dbgsym_156.0.8078.73-1~deb13u1_i386.deb f0ae9faaf892759ab731f617c573cfec 31833124 web optional chromium-common_156.0.8078.73-1~deb13u1_i386.deb 4a325b39433851af0ac0cb02b774b26b 37411352 debug optional chromium-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 10d2ec0d0ec4276b4f2ab0c823f5962a 8829276 web optional chromium-driver_156.0.8078.73-1~deb13u1_i386.deb 3d4c5c313de6f7eb5b5441c5e6b86eea 31028392 debug optional chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 0cadc23feb24aad1cdf6d198babedc3c 65136932 web optional chromium-headless-shell_156.0.8078.73-1~deb13u1_i386.deb 75f38e14b550d6ecaf3267f36f5c3932 19372 debug optional chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 92328ec7f3b6d8c8284929ddc16f4cbe 161440 web optional chromium-sandbox_156.0.8078.73-1~deb13u1_i386.deb 13298312eb8dfb22f8d291ce233dc80c 33422980 debug optional chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_i386.deb 22e2bec61d9ff77c0d3f2db242979c97 69688232 web optional chromium-shell_156.0.8078.73-1~deb13u1_i386.deb 86ce0883b1d5922a16bbbefc6f93dc83 31403 web optional chromium_156.0.8078.73-1~deb13u1_i386-buildd.buildinfo c350d86bd8cd8bca1ceedb2835b0747a 83293372 web optional chromium_156.0.8078.73-1~deb13u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE+i/sCsF3puL4e7qIGNGWmfrqILEFAmrixnsACgkQGNGWmfrq ILHDSw//XGWk+cOU7T8/JiAuKg8MfXDGWHuaPlnHLkHWs/vFFI87IQeadKjpG6ZL 2ZhtCAlMt+G2zHjSEUu9V/NApirXVJh+EdCHQGDOinrT4wGUwfkDrbRYORnKC0fi uNYtjZgMATueECL34/hySw59K6au+PGYXaqgAqeTqP2ZnN/hDesTF7IhP5di0Z9f FHlRb/izfEAkzEeVqq0KBB4+hyfYtgtQzz/6HB+0Oc5CNVDeMROCVSC17cq43sTQ I3pE4x661PBUr58qAnOHAv2FBlq29xABCHHoUN/SdXPu5aIBQAASt6dTItFQ11dY 9HzBuxbLbn6J13YAJblGNoNKuMo4lhNtZ4jaSuDflyNf019l42SrUmeynGL0WTmU TefUU+tG4zHKEjStukcl9AJS9UiLiG7TYQ+g6JT2coW6KieZRpQRP1jYjZ7JecJP 1S9RV+GldPs97uhoPkOWy9L4Mu0FxdsQAZQNl3QJw4vattN94OgmnWUF/7WsMbQH YbWj6Tk/npb30bntg3VOdcc1kQYc+0suO2G9f0GILOYKvYsT49V3pEiUskStj0yZ d+C9HbyUuSslDgnjs11lVNIgsZ4k2wkhssdT94zaCPXOiGpAFf1DputLnnh17sIx 0XkgskMlc5SetuDRE4p/eYvgo8yyjiUNc2xzpfcyUy3En06CXqo= =XbXh -----END PGP SIGNATURE-----