-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 27 Oct 2026 22:31:04 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: ppc64el Version: 156.0.8078.73-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (156.0.8078.73-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/clean: Drop files created by d/scripts/unbundle, as they are now cleaned up in the override_dh_auto_clean target in d/rules. * d/patches/ppc64le/regen: - regenerate_xnnpack_patch: Revised version of Tim's script for generating 0002-regenerate-xnn-buildgn.patch. - xnnpack_local_regen_hacks.patch: New standalone patch, also of Tim's, to support the regenerate_xnnpack_patch script. * d/rules: - Move the functionality of d/scripts/customize-typescript.sh into the override_dh_auto_configure target. - On cleaning, restore upstream files that were modified in said target. - Tweak what files get cleaned up, and delete any resulting empty dirs. - Don't clean up Cargo.toml.orig files, as the upstream tarball (not ours) has many of these. * d/scripts/autoregen/xnnpack/*: Move Tim's patch tooling from here. * d/scripts/check-upstream: Error out if the upstream tarball has anything named *.upstream, as we use that suffix for our purposes. * d/scripts/customize-typescript.sh: Drop, now handled in d/rules. * d/scripts/unbundle: Use Python calls (instead of shell commands) to create symlinks, and preserve existing files. . [ Andres Salomon ] * New upstream security release. - CVE-2026-118306: Memory corruption in FileSystem. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118331: Improper input validation in FileAPI. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118348: Improper input validation in Skia. Reported by Xinyang Ge. - CVE-2026-118344: Use after free in Layout. Reported by Xinyang Ge. - CVE-2026-118357: Use after free in FileSystem. Reported by Xinyang Ge. - CVE-2026-118318: Improper access control in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern). - CVE-2026-118350: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-118339: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118305: Memory corruption in Turbolev. Reported by Google. - CVE-2026-118317: Memory corruption in HTML. Reported by Xinyang Ge. - CVE-2026-118320: Memory corruption in V8. Reported by Google. - CVE-2026-118322: Memory corruption in ANGLE. Reported by Google. - CVE-2026-118329: Improper input validation in ANGLE. Reported by Google. - CVE-2026-118354: Improper input validation in Skia. Reported by Google. - CVE-2026-118340: Memory corruption in Skia. Reported by Google. - CVE-2026-118321: Improper input validation in Core. Reported by Google. - CVE-2026-118337: Improper access control in Forms. Reported by Xinyang Ge. - CVE-2026-118352: Memory corruption in Cache. Reported by Xinyang Ge. - CVE-2026-118355: Improper input validation in Command. Reported by Xinyang Ge. - CVE-2026-118307: Use after free in Paint. Reported by Xinyang Ge. - CVE-2026-118351: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118328: Improper input validation in WebRTC. Reported by Mozilla. - CVE-2026-118333: Missing authorization in Video. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118336: Improper input validation in Headless. Reported by Anonymous. - CVE-2026-118358: Memory corruption in WebAudio. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118353: Use after free in Paint. Reported by Anthropic and Ada Logics. - CVE-2026-118349: Memory corruption in Payments. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-118327: Memory corruption in Media. Reported by Please attribute Anthropic and Ada Logics. - CVE-2026-118359: Memory corruption in V8. Reported by zenneth (randomguy6407). - CVE-2026-118343: Improper input validation in ReadingList. Reported by malichamdan. - CVE-2026-118311: Memory corruption in Media. Reported by secbuddy(Ben). - CVE-2026-118334: Use after free in ImageCapture. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118332: Improper input validation in Compositing. Reported by e7be95afd6e4ad8d8abc6076c284c79db9e35cc2. - CVE-2026-118313: Use after free in Video. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118345: Use after free in PDFium. Reported by OpenAI Codex Security (kylebot). - CVE-2026-118304: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118316: Improper input validation in V8. Reported by Google. - CVE-2026-118346: Use after free in Compositing. Reported by Google. - CVE-2026-118342: Out of bounds write in Editing. Reported by Google. - CVE-2026-118310: Improper input validation in Views. Reported by Google. - CVE-2026-118335: Improper input validation in Metrics. Reported by Google. - CVE-2026-118308: Use after free in SVG. Reported by Google. - CVE-2026-118314: Improper input validation in UI. Reported by Google. - CVE-2026-118347: Use after free in FileSystem. Reported by Google. - CVE-2026-118341: Use after free in Modularization. Reported by Google. - CVE-2026-118330: Use after free in Browser. Reported by Google. - CVE-2026-118315: Improper input validation in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-118356: Use after free in WTF. Reported by malichamdan. - CVE-2026-118309: Improper input validation in UI. Reported by Google. - CVE-2026-118319: Memory corruption in Skia. Reported by Xinyang Ge. - CVE-2026-118312: Memory corruption in Paint. Reported by Google. - CVE-2026-118338: Use after free in Animation. Reported by flapjack-security-bugs-access. Checksums-Sha1: 0b50daf66594f592c5215965c2f07874a46c2d06 4754852 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 44f9e0bf2f5f15732ddc8dfc3a2e0a4ce251035d 37557384 chromium-common_156.0.8078.73-1~deb13u1_ppc64el.deb 10e23c8567fad5101ceef622589bf928b3156097 31202680 chromium-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb edf61b82d7baad0bb527d5485e864f5194b11f38 8192448 chromium-driver_156.0.8078.73-1~deb13u1_ppc64el.deb 543ee05c69a11559097e12881170f9dfde9b8f3d 25834656 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 2e64a4cbe7f3cdb51374399750222f008431508d 66518300 chromium-headless-shell_156.0.8078.73-1~deb13u1_ppc64el.deb 3ac10bc122942c978d7474a95940f347b58362ef 19868 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb aba0505ff61492485be2fea8630ac943421de3ca 161780 chromium-sandbox_156.0.8078.73-1~deb13u1_ppc64el.deb 511c51922eb575a7a1a77f46e10bf2fcb7e200ac 26315300 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb dc8f92764b284b0a5d25d024dc8f75e87fd1c68a 64286604 chromium-shell_156.0.8078.73-1~deb13u1_ppc64el.deb c395b8cf195202b192a65145b06510a91b473333 31414 chromium_156.0.8078.73-1~deb13u1_ppc64el-buildd.buildinfo 02abddbdc6ca6e7445d7d8bda81aa2dae7a1526c 88375816 chromium_156.0.8078.73-1~deb13u1_ppc64el.deb Checksums-Sha256: a472d2a94ae62f0dcc7b23b917c099d31db96774c017583383e72b9beb94df41 4754852 chromium-common-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 1f914eef359c5b99cfbdacb107d8c8cdf5b19d3dda467f57f9f33815174ff447 37557384 chromium-common_156.0.8078.73-1~deb13u1_ppc64el.deb e7112b182fdc0752f8869458632ea13ec907255462c56163ad237f8560dfa5dc 31202680 chromium-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 647e5f2c1dc5a99a4bb72a4c024a09a54c989f9b97391ab906ffdb710cff9f73 8192448 chromium-driver_156.0.8078.73-1~deb13u1_ppc64el.deb 81b934ea0b197302a9b50529210d8d62f98cd1fca87ea927d1b663cac146206f 25834656 chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 2232ec935fbd2375baadf6b16ee50a4773018d17251d46fba3985b272511c0eb 66518300 chromium-headless-shell_156.0.8078.73-1~deb13u1_ppc64el.deb 6a16d93a2ccdbdb285caee90c8d69a1065f7a4558e48bb80feb2da4a976af88c 19868 chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 18b7adf3f5826586c5506c6f4d3cadfd38aa1f799e680f10d820999a4370acad 161780 chromium-sandbox_156.0.8078.73-1~deb13u1_ppc64el.deb 882125bb51a8f5d817d7e1a4c707078543b158e46c5d282ebdefec0101563ee4 26315300 chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 99d0d8ed3e8b1e1b16bfff31ea0a68703ee6f4ee8928600880a7cb1429e74f66 64286604 chromium-shell_156.0.8078.73-1~deb13u1_ppc64el.deb 721dc189aaeb54534502b2831048f156598e832c28843acf0dd7b6d46aabf9be 31414 chromium_156.0.8078.73-1~deb13u1_ppc64el-buildd.buildinfo 2b9fba74d0dd19256c7ab01efcba5713c94e64b8b7c7624143ca950e67f3fdb5 88375816 chromium_156.0.8078.73-1~deb13u1_ppc64el.deb Files: 409fd79d3e007a56cbf5d9fe3851c79d 4754852 debug optional chromium-common-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 35be2321bbe4b5fbec71c6beca148d46 37557384 web optional chromium-common_156.0.8078.73-1~deb13u1_ppc64el.deb fb17207522b673934c17b3a184b510e1 31202680 debug optional chromium-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb 8648496a101040b6a8eb437f65311297 8192448 web optional chromium-driver_156.0.8078.73-1~deb13u1_ppc64el.deb 75ecd0b1aaf91573c9a91cc0cc7052b6 25834656 debug optional chromium-headless-shell-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb c38d44c14f83927cef84c8d82852618c 66518300 web optional chromium-headless-shell_156.0.8078.73-1~deb13u1_ppc64el.deb 18724be20a4c8213660852ab7e1d55b2 19868 debug optional chromium-sandbox-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb c06c13bea0fb32eb77d907aac10edcf4 161780 web optional chromium-sandbox_156.0.8078.73-1~deb13u1_ppc64el.deb e5967ca17c70586bb094f1bd6a8c4b9a 26315300 debug optional chromium-shell-dbgsym_156.0.8078.73-1~deb13u1_ppc64el.deb b1d3f887ec14a15a5801cf502fec3bea 64286604 web optional chromium-shell_156.0.8078.73-1~deb13u1_ppc64el.deb bd4f79d9eb37b24d04df91c501a68acc 31414 web optional chromium_156.0.8078.73-1~deb13u1_ppc64el-buildd.buildinfo 976af7ae267beef026ea0b73a1ad27cf 88375816 web optional chromium_156.0.8078.73-1~deb13u1_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmri8GkACgkQV8ucRsMT puOZxQ//aast6yl5cuiaC1WY/51e8Os6xYyJXJLfxEm01J/8OJoZ7A0OCjVIMFDz Abso1h/c+79QvY//jMdQhvt6Ni++ZUKX9WA1+FccMReDyvzKl8PrANaOedTu5CUs scoiWKf3/SxiEL1/R0yf9gfNIgXay4P0THncCJbex5/PTJ19b0fuUSYBox/+KcUH eLPoMRUZNM+VVK2FoIclNLi1ZdN2PCO2dVO8I/sFM297REWDavL6RpZ9z3Fycgn7 xtQpQUMcbXBoHm8eTAjXXdoCch6HIyNTpqqgMBaJgzSU7DJxblUpKBM0vhrlxx7U Bx+iA2rUgSKVFnWFsYjuwTk23wPUYxZ+C9ly4jkA+iJzsxoiNxAzdvwmVB5FJlZ7 /3BtD6TS8vU0DkFltijcgh8JbluTHoNRzMLKBBi0mgEeZm0WNeqBey9de/5wgWn4 fiQbVK9/7TVL6plJPRzfBm4l7dztOc1XpHC4riEcQjMC5Bqyd+2jHBzC0SD9wmQO jCpHJz8wpEGLFVqu1r0mIbYAbeB+zkQwD/Lr259Lv3L2oW3zA80ADm0TciWEVcEB qoewUcPTqw582V5yZlJ+ZtPnOtbnYwiHrZ1ZNNDjrH9HWh29X9wXs1ZZu923lggc kLz2IL+U3tJrvEXSesvKG8dwVVq1/fZzIOHfwklHWVSfXlke7Y0= =0Nxw -----END PGP SIGNATURE-----