-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 01 Nov 2026 22:51:42 -0500
Source: chromium
Binary: chromium-l10n
Architecture: all
Version: 156.0.8078.79-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Description:
 chromium-l10n - web browser - language packs
Closes: 1150706
Changes:
 chromium (156.0.8078.79-1~deb13u1) trixie-security; urgency=high
 .
   [ Juan Manuel Méndez Rey ]
   * d/patches/upstream: new directory for fixes that are already upstream,
     with the two a component build needs.
   * d/rules: set use_mold=false and dcheck_always_on=false, which a component
     build needs because both default back on when is_official_build is off.
   * d/rules: turn off use_thin_lto in a component build. Thin lto adds
     -fwhole-program-vtables, which a component build makes unsound, and the
     browser then crashes in mojo at startup.
   * d/rules: keep dh_makeshlibs out of /usr/lib/chromium. That directory is
     private, and chromium-common was declaring libvulkan in its shlibs and
     activating an ldconfig trigger for it.
   * d/rules: add the component build configuration, off by default. Name an
     architecture in COMPONENT_BUILD_ARCHS to turn it on there.
   * d/rules: build chromium as a component build on armhf, the only
     configuration whose final link fits in a 32-bit address space.
     (Closes: #1150706)
   * d/README.armhf: new, why armhf is built this way and what to check on a
     version bump.
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-76024: Memory corruption in MediaStream.
       Reported by Xinyang Ge.
     - CVE-2026-76025: Use after free in FileSystem. Reported by Google.
     - CVE-2026-76026: Memory corruption in Autofill. Reported by Google.
     - CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google.
     - CVE-2026-76028: Use after free in FileSystem. Reported by Google.
     - CVE-2026-76029: Memory corruption in Network.
       Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com).
     - CVE-2026-76030: Memory corruption in FileSystem.
       Reported by huntersnot4.
     - CVE-2026-76031: Use after free in Input.
       Reported by Arni Hardarson (Neonix Security).
     - CVE-2026-119260: Use after free in Frames. Reported by Google.
     - CVE-2026-119261: Improper input validation in Skia. Reported by Google.
     - CVE-2026-119262: Improper input validation in V8.
       Reported by Hyeonjun Ahn (@_deayzl).
     - CVE-2026-119263: Memory corruption in GarbageCollection.
       Reported by Xinyang Ge.
     - CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a.
     - CVE-2026-119265: Memory corruption in Quota. Reported by Google.
     - CVE-2026-119266: Use after free in Quota. Reported by Google.
     - CVE-2026-119267: Memory corruption in DOM. Reported by Xinyang Ge.
     - CVE-2026-119268: Integer overflow in Editing. Reported by Xinyang Ge.
     - CVE-2026-119269: Use after free in Blink. Reported by Google.
     - CVE-2026-119270: Improper input validation in CacheStorage.
       Reported by Google.
     - CVE-2026-119271: Use after free in Skia. Reported by Google.
     - CVE-2026-119272: Out of bounds read in FileSystem. Reported by Google.
 .
   [ Daniel Richard G. ]
   * d/deb_pre_gen.py: Rework script to be called directly by ninja, instead
     of being called by various upstream build scripts.
   * d/patches:
     - debianization/pre-gen.patch: stop patching various upstream scripts
       (eg, run_bindgen.py).
     - disable/node-ts.patch: drop, no longer needed with above rework.
Checksums-Sha1:
 a6ac12bcc30117b8220810c84908746951b4cff1 8900096 chromium-l10n_156.0.8078.79-1~deb13u1_all.deb
 dd4f710ab3957a1a0b2c5003301bdcd8b278773e 27985 chromium_156.0.8078.79-1~deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 a8e155cfd157379087bf52a0962038e197d5bb9a9278f2a161d21a397d9003e9 8900096 chromium-l10n_156.0.8078.79-1~deb13u1_all.deb
 90599b0f2cdd79e2a058494fd7ec56741ef9cc4e41e5237e6462f4133b72a62b 27985 chromium_156.0.8078.79-1~deb13u1_all-buildd.buildinfo
Files:
 e7699fbf8f9c1301f5eef70b6c2e2f17 8900096 localization optional chromium-l10n_156.0.8078.79-1~deb13u1_all.deb
 9d4932440c18998fa940e8c9bac23df4 27985 web optional chromium_156.0.8078.79-1~deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmroqZgACgkQaBVi67oX
tfmhbw//YNM35vf7eqbjl+xNvFo4hySjFLvEubkPL8Qo6LvQid2Hxdt4TipJpxac
DJqkldfgPXuAA7HA7EFtn5LbUmHeS8inqIz70EYd8VZg8jJSVo4bKekwtr1Q0aeb
CNAvr7NpwOqYgeH1WVUZGj+TQKj85iExh9nfCZdQpIyGNHlGPTwIupP2yzGizJSL
9S4TsCy4NVn0ObyrwvMHqMTL05vnTkeieIKEft6p2hnCFMCZnSVS5yQBHa+X7Xth
cksAdLHul0WQAaIR2yub9qnd5raoxbol+mX3S3tp8Eou0Py+KEHF6ymzq6YVGep5
S/yi2u4TFhmSTVha79Kntwea6SEwGe2Pfqc2QK8p3h1qyDrNmLeTOq7G1hb/pXIU
u/tB75qd4+jHdsEpRe9LskUuxt9gUsr4ICXH9tWj7AfcUInN5oYdNri+Nl3B8h2k
SxsiYxzSbqfQ6FcsfUXtoOJF4lVChooaW9jpcYkbp4+PoOzS/KLFJwCxh8Lo289J
qnvedRcLBrUgQ+hkZR7DOFoQSO3r2y9AKTSQL2FPaLaQKWmfElmE2VVv10EXEU2Z
98qBEXs1lCrasUyc2Id71paj8VW390TsbPG2yjg6vJ8NpVOn51zMpJ6pyhwn534f
akJE2mK9UagUUH1W0apf0hjPVqb7knI3rWRjS/zMaMGzRMuK9Sg=
=ORas
-----END PGP SIGNATURE-----