-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 07 Aug 2026 12:19:50 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: amd64 Version: 151.0.7922.108-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (151.0.7922.108-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/deb_pre_gen.py: Minor fixes to the pre-gen framework: - Always record target outputs in an .OUTPUTS file, even if a target has only a single output. This incurs only a small (tarball) size penalty, and catches cases where there is disagreement on which is the first output file of a .ninja target. - Update the handling logic for generate_css_js_files.js, as the first output file of the .ninja target changed from v150. - Add an extra check to ensure that target outputs are unique. * d/patches/debianization/pre-gen.patch: Tweak a script so that it outputs a constant UUID, instead of one dependent on the build path. * d/patches/system/golang.patch: Prevent the Go compiler from writing things into our home dir, or accessing the network. * d/scripts/init-pre-gen.sh: Don't hard-code the package name, as we might be doing init-pre-gen for ungoogled-chromium. . [ Andres Salomon ] * New upstream security release. - CVE-2026-19137: Use after free in WebGL. Reported by anonymous. - CVE-2026-19149: Use after free in Aura. Reported by Google. - CVE-2026-19154: Use after free in Skia. Reported by Google. - CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. - CVE-2026-19172: Use after free in Views. Reported by Google. - CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@svn-dys). - CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg. - CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google. - CVE-2026-19139: Race in CredentialProvider. Reported by Google. - CVE-2026-19140: Use after free in GPU. Reported by Google. - CVE-2026-19141: Use after free in Resources. Reported by Google. - CVE-2026-19142: Use after free in Views. Reported by Google. - CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs. Reported by Google. - CVE-2026-19144: Use after free in HTML. Reported by Google. - CVE-2026-19145: Use after free in Translate. Reported by Google. - CVE-2026-19146: Uninitialized Use in GPU. Reported by Google. - CVE-2026-19147: Use after free in Aura. Reported by Google. - CVE-2026-19148: Out of bounds write in GPU. Reported by Google. - CVE-2026-19150: Inappropriate implementation in V8. Reported by Google. - CVE-2026-19151: Use after free in V8. Reported by Google. - CVE-2026-19152: Inappropriate implementation in Navigation. Reported by Google. - CVE-2026-19153: Insufficient validation of untrusted input in Workers. Reported by Google. - CVE-2026-19155: Use after free in Payments. Reported by Google. - CVE-2026-19156: Heap buffer overflow in Base. Reported by Viktoria Zlatinova. - CVE-2026-19158: Use after free in Views. Reported by Google. - CVE-2026-19159: Use after free in Views. Reported by Google. - CVE-2026-19160: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19161: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19162: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-19163: Use after free in Media. Reported by Google. - CVE-2026-19164: Insufficient validation of untrusted input in Codecs. Reported by Google. - CVE-2026-19165: Use after free in Extensions. Reported by @bean5oup. - CVE-2026-19166: Use after free in Web Authentication. Reported by heesun. - CVE-2026-19167: Integer overflow in GPU. Reported by Google. - CVE-2026-19171: Use after free in Media. Reported by Google. - CVE-2026-19173: Out of bounds write in Skia. Reported by Vu Van Tien (@n0_Be3r). - CVE-2026-19174: Integer overflow in V8. Reported by Seunghyun Lee (@0x10n) of QED Audit (qedaudit.io). - CVE-2026-19175: Use after free in Payments. Reported by Google. - CVE-2026-19176: Use after free in Skia. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-19177: Insufficient validation of untrusted input in UI. Reported by Fabian Wahle (Hap Security). Checksums-Sha1: fed5cc38318128a432fdc734a2264263470e17f6 4744716 chromium-common-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 8318d8fca0e9dd5a15822bafe1d1e2d09bb8e491 29602952 chromium-common_151.0.7922.108-1~deb13u1_amd64.deb b22e45ea7b594c1074f77793417739a231eab876 34284024 chromium-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 42b6999a13bbf4d415203eaee65f138eadcf803a 8002640 chromium-driver_151.0.7922.108-1~deb13u1_amd64.deb ad1028cd898c737064375b167895e1243c3b1f56 28893460 chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 06248cb9c536a6856ecc165240ab36cf5a5eb23f 65820448 chromium-headless-shell_151.0.7922.108-1~deb13u1_amd64.deb 9139d5f4c70a550b187a5cfc5c992babe3ac5f5c 20232 chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 92bf2f3b79cf9528eb4bdefe8f065e9123755a4b 138088 chromium-sandbox_151.0.7922.108-1~deb13u1_amd64.deb 810abd921c85dbf1a57f125de847f1ad29d1e6e9 30600304 chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb dab0cfa7bdfe606a4fb8eff57036cebfaf43ad14 65382964 chromium-shell_151.0.7922.108-1~deb13u1_amd64.deb a51c58f35e619e3bf6cbb7de12565110541f845f 31187 chromium_151.0.7922.108-1~deb13u1_amd64-buildd.buildinfo 4d45fde98787b2d593776ab6d0248ce918e4cb22 89581008 chromium_151.0.7922.108-1~deb13u1_amd64.deb Checksums-Sha256: 12dda750530cb3f92c4cd697bcd356bd6f88dce16491cedbe38b90aa41450b7f 4744716 chromium-common-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 6eaa601c158a87769d7cd73b924f88443761649f6c320497a69f98dc5cd46058 29602952 chromium-common_151.0.7922.108-1~deb13u1_amd64.deb 5017aba89510433198076c20ed4271f0efa529883f6899427dd435a1a3ab6b1c 34284024 chromium-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 1e7de6e69eea916225a6d01f49c9429f2db5539e7d2b9372d5698fa1a96cdceb 8002640 chromium-driver_151.0.7922.108-1~deb13u1_amd64.deb 6a5eb9a978d342556c353a3e6f683d51d4811e57030ea02aba5b12049ac7a005 28893460 chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 1e1803c72b8aeed6820cc37e4a9de1d3d4a12a93b634b2f05152212f87fe98aa 65820448 chromium-headless-shell_151.0.7922.108-1~deb13u1_amd64.deb f2994e6c8de82fc687875854cccd5132c181ecf1cb286c7f00670013002ba102 20232 chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 4daa1865bbfff9f01e8bd5bc5540426932f116bb030ceb51d0990a391de5c506 138088 chromium-sandbox_151.0.7922.108-1~deb13u1_amd64.deb 093d3d5f77338f02b10e1154bfaecbbd7279d945dae89516dd0c0df06402f143 30600304 chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 646e98e351a5652ebb88be3c71b1eddc4d723c0dae23423aa448411f44a11a06 65382964 chromium-shell_151.0.7922.108-1~deb13u1_amd64.deb ed2b56386ebb901ed30b718e766946d12218e983989a66b85c6e43887ed5ec64 31187 chromium_151.0.7922.108-1~deb13u1_amd64-buildd.buildinfo 7f14f52563f7ba52702847a095db8bf32854a5f2938a750302ffd04daff15bf0 89581008 chromium_151.0.7922.108-1~deb13u1_amd64.deb Files: 11a025a286db51764d2725a0caa6f409 4744716 debug optional chromium-common-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 4b61a19fcef85d02de18a08f08de773d 29602952 web optional chromium-common_151.0.7922.108-1~deb13u1_amd64.deb 682181a0acb8a0ea2bb1fb6a2dae0613 34284024 debug optional chromium-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 130b36571bb74dbf1cf7b181d0b9945c 8002640 web optional chromium-driver_151.0.7922.108-1~deb13u1_amd64.deb f28b93f0c6280774b4ff642312973e25 28893460 debug optional chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb ad5363c64cc32e6b68fdd4a1b327187a 65820448 web optional chromium-headless-shell_151.0.7922.108-1~deb13u1_amd64.deb c649f5fd76b8e69389b5a5f6d6b3c440 20232 debug optional chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb 2bbbcbc4a5d1ae71cb8a2aa6693b6338 138088 web optional chromium-sandbox_151.0.7922.108-1~deb13u1_amd64.deb b38f488d7343ea0d27992c46ab8f2a02 30600304 debug optional chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_amd64.deb b9ec4f89f4812150bf7f800ce8e9a9b9 65382964 web optional chromium-shell_151.0.7922.108-1~deb13u1_amd64.deb fe28d399727aadedd325cf81a75c20f7 31187 web optional chromium_151.0.7922.108-1~deb13u1_amd64-buildd.buildinfo 808ba0e9cfdb9c8eba32e49fb89c8857 89581008 web optional chromium_151.0.7922.108-1~deb13u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEEmtr4KUMaso2EQ6NrTwt/65ON6zcFAmp3wOkACgkQTwt/65ON 6zcG+A/47/1EdkVREM5bxyY/v7xqJHYZS+4H40BnpxXyqjX3GohOm0G42DQ4ZR/W xF3c5EG2g90tlx5O97sjfVMeYjmEU0XDRFTEtMv5RsX93Nhn9GV9UnS4Cjt+0XJQ lQHwCZciyB/d7ThsfroKKyZdmvt0eiZn8tz0KwilKw4EIypWfVQ4FFALdEKLtCfM FscwWLAx6YzZaxw9IyV/7o2jQb6GEgxhqhpDqA4vD0T88msGSl8kBhhpSgWXRl3h ovhyQCGoiokxGR08xprk6UqX+yTiroEl/CdhrDv3QTz4LtnE1dKfkVOu4Z2IIIJX ghLkoApMJRzd1t3pYvEo2aMh6/Ig3xF4EyJcokMdE74kOip5/jRzH08uVzbLycs2 p27YqZ4zq7g0Hd2xfNaJ8jwqx3jQPTCDM+YykOT3gU+c4nXE5SdXCPch/hcQ5fqU iGxhgvadp1TSlxyEpY9RSzOhOTyI+6Lu5DMDsqRV14uqbvqXxEkpIH9uOjeckPTK qn16vyz6E20iECiZlsIFenMxBaLF+YCn7E4/Dv0oRAx6OpyHB61tRY2areUkrmq9 vxvKoYWkCQ+TW3gU4YPUhZUPzE7GxCidG9V5LZWKYifg4wWP9hzeX2KVVAxIjLcT r/GxaIpGMbDYnu10LWOPb4mhaPjtCxUbRpL/A+49/TGK2uitww== =xQck -----END PGP SIGNATURE-----