-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 07 Aug 2026 12:19:50 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: arm64 Version: 151.0.7922.108-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: arm64 Build Daemon (arm-ubc-05) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (151.0.7922.108-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/deb_pre_gen.py: Minor fixes to the pre-gen framework: - Always record target outputs in an .OUTPUTS file, even if a target has only a single output. This incurs only a small (tarball) size penalty, and catches cases where there is disagreement on which is the first output file of a .ninja target. - Update the handling logic for generate_css_js_files.js, as the first output file of the .ninja target changed from v150. - Add an extra check to ensure that target outputs are unique. * d/patches/debianization/pre-gen.patch: Tweak a script so that it outputs a constant UUID, instead of one dependent on the build path. * d/patches/system/golang.patch: Prevent the Go compiler from writing things into our home dir, or accessing the network. * d/scripts/init-pre-gen.sh: Don't hard-code the package name, as we might be doing init-pre-gen for ungoogled-chromium. . [ Andres Salomon ] * New upstream security release. - CVE-2026-19137: Use after free in WebGL. Reported by anonymous. - CVE-2026-19149: Use after free in Aura. Reported by Google. - CVE-2026-19154: Use after free in Skia. Reported by Google. - CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. - CVE-2026-19172: Use after free in Views. Reported by Google. - CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@svn-dys). - CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg. - CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google. - CVE-2026-19139: Race in CredentialProvider. Reported by Google. - CVE-2026-19140: Use after free in GPU. Reported by Google. - CVE-2026-19141: Use after free in Resources. Reported by Google. - CVE-2026-19142: Use after free in Views. Reported by Google. - CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs. Reported by Google. - CVE-2026-19144: Use after free in HTML. Reported by Google. - CVE-2026-19145: Use after free in Translate. Reported by Google. - CVE-2026-19146: Uninitialized Use in GPU. Reported by Google. - CVE-2026-19147: Use after free in Aura. Reported by Google. - CVE-2026-19148: Out of bounds write in GPU. Reported by Google. - CVE-2026-19150: Inappropriate implementation in V8. Reported by Google. - CVE-2026-19151: Use after free in V8. Reported by Google. - CVE-2026-19152: Inappropriate implementation in Navigation. Reported by Google. - CVE-2026-19153: Insufficient validation of untrusted input in Workers. Reported by Google. - CVE-2026-19155: Use after free in Payments. Reported by Google. - CVE-2026-19156: Heap buffer overflow in Base. Reported by Viktoria Zlatinova. - CVE-2026-19158: Use after free in Views. Reported by Google. - CVE-2026-19159: Use after free in Views. Reported by Google. - CVE-2026-19160: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19161: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19162: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-19163: Use after free in Media. Reported by Google. - CVE-2026-19164: Insufficient validation of untrusted input in Codecs. Reported by Google. - CVE-2026-19165: Use after free in Extensions. Reported by @bean5oup. - CVE-2026-19166: Use after free in Web Authentication. Reported by heesun. - CVE-2026-19167: Integer overflow in GPU. Reported by Google. - CVE-2026-19171: Use after free in Media. Reported by Google. - CVE-2026-19173: Out of bounds write in Skia. Reported by Vu Van Tien (@n0_Be3r). - CVE-2026-19174: Integer overflow in V8. Reported by Seunghyun Lee (@0x10n) of QED Audit (qedaudit.io). - CVE-2026-19175: Use after free in Payments. Reported by Google. - CVE-2026-19176: Use after free in Skia. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-19177: Insufficient validation of untrusted input in UI. Reported by Fabian Wahle (Hap Security). Checksums-Sha1: 28a6b2d99d7ac8fd17fdaad9b4af59fb21d457ab 5625788 chromium-common-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb a6d6683774237b0177116a10be331d0d70ab19ab 34640736 chromium-common_151.0.7922.108-1~deb13u1_arm64.deb 482aead9b835b05fe43faf303cf9ccedddbc68c3 35878736 chromium-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb bffc2f670b27714d55c1efe6206039f8faeda2ad 7017832 chromium-driver_151.0.7922.108-1~deb13u1_arm64.deb 68403000953f882fb108252b1ec41f0e95db8107 29775384 chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb ef6bd4612f956a5c22884108ddff6cc113079c12 57228420 chromium-headless-shell_151.0.7922.108-1~deb13u1_arm64.deb f3b92b415f1d8d0784b6ff26dbeff14aa14a24e5 21056 chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 817fc8e6cf4a207b9122aedb52c48f1ae0a85b40 138832 chromium-sandbox_151.0.7922.108-1~deb13u1_arm64.deb 2ccba0e098622268831930a30f50527380485eb8 31366340 chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 9e3d38204c7be79bf997793e10719fcd42d5d044 57443688 chromium-shell_151.0.7922.108-1~deb13u1_arm64.deb 02b9b26c0d894b823d39ef8ec24a457331269ae9 31225 chromium_151.0.7922.108-1~deb13u1_arm64-buildd.buildinfo ed3d08351d4f302e9e57efbdd6a3e0c66486f85b 77095264 chromium_151.0.7922.108-1~deb13u1_arm64.deb Checksums-Sha256: caef09d116db92a804ecaf7039cf40e17b84f3d2d28599b3caead7805376b4f1 5625788 chromium-common-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 442460de8a41f4ef25e4aa4b7a11f760eb8d133b93b9c8c6aa84a7cd768b2eef 34640736 chromium-common_151.0.7922.108-1~deb13u1_arm64.deb 7f8db2eaf252850fff0520e4375ec8185dedab19beb45ea86fa3c8eead2f2476 35878736 chromium-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb b9f7c53b5d3e92aea4a6980b517e8e79f0905d055c5c37c0c99980cd0e64cf45 7017832 chromium-driver_151.0.7922.108-1~deb13u1_arm64.deb 9021970f6e539766c0bbf28897370676fed82b81885fc92e838d27040b5db9f4 29775384 chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 24c0b6f265681f581dd7c64186f59d23e86b46d52cb479d4dc9a8dc842a85718 57228420 chromium-headless-shell_151.0.7922.108-1~deb13u1_arm64.deb 742ab880eb4abc24a9d1296efa822e3b673fe2ccd439eed0d416f21d3df1b1e2 21056 chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb d60fb011d5a05f6a73500f209f64cd9e3ab8137f60a81b9399fb4224f770d427 138832 chromium-sandbox_151.0.7922.108-1~deb13u1_arm64.deb 8a7bab7c457d2620936168a7fa97d97d8cc20ec87c11b6ff48399b57c2c13920 31366340 chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb a290f311d4129368e06ed44e2b37d5d3f34e7f76a32ce54a86d299e88a3e6a5b 57443688 chromium-shell_151.0.7922.108-1~deb13u1_arm64.deb 219a4db2db3ba1f528b285f201c5bc2db37b542483539797b17a0170148d6982 31225 chromium_151.0.7922.108-1~deb13u1_arm64-buildd.buildinfo 487f639774e6f618261fc198c336ad573b766115e81cbef8d794833b4dc8df27 77095264 chromium_151.0.7922.108-1~deb13u1_arm64.deb Files: 0545e62847a649275fd9e02de9a18ae5 5625788 debug optional chromium-common-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 667679b56952d0ca2fa758c8f5506b0a 34640736 web optional chromium-common_151.0.7922.108-1~deb13u1_arm64.deb 17042a035304ab851cf07e178f6d0fd9 35878736 debug optional chromium-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 4b3efd0e4228f6b3537a1d484bbe2f81 7017832 web optional chromium-driver_151.0.7922.108-1~deb13u1_arm64.deb 014e7fd2a6351d70f24801852dae3b1f 29775384 debug optional chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 3e2f2fd0e4f48576b045dbd6395365a6 57228420 web optional chromium-headless-shell_151.0.7922.108-1~deb13u1_arm64.deb 0039df8d5e8314542d1efd3f60d5b7f8 21056 debug optional chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb d16487b6234119db75b4eea07cacc637 138832 web optional chromium-sandbox_151.0.7922.108-1~deb13u1_arm64.deb 64c94ec8f6b14c969472d7b9efeed878 31366340 debug optional chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_arm64.deb 6d94329413663b159830c1068bbee9c6 57443688 web optional chromium-shell_151.0.7922.108-1~deb13u1_arm64.deb 880273d779a41dc4236243a992e829a0 31225 web optional chromium_151.0.7922.108-1~deb13u1_arm64-buildd.buildinfo ea36eeb40939ea9cb5e44f13a2b7d5ca 77095264 web optional chromium_151.0.7922.108-1~deb13u1_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmp3t8YACgkQnwznazfj XToc0g/+IYmDg0YTF80sLpc5u+I9/lN8QIPhAdQNzieyBnMQzYL9NCKPVI4Oyzy/ IzDUC9z4/i9QY/ozdULcXxBiMK+t9rCvKG1NXvFNOi36v0JskZjhgz8NfVvuXZkd +IR+miJCZ+E3Q0L7MNSKZ5kerQtgpjE1XiIy7bGVCrQVIanwm01E7lW7k45xLavO V4ZHJzjb3fEhpmK+eWtMn65svNCUoYLFLOF+zkDEuGVcWGFsDVzjY1WggkHPQDbi JrUe0OoMflBkXlbLf/s2Aoncni0u3mxcY95ZDZWl3XC9MNGuvFoZyfTvb5r5pKHH 7oTvI5iSZp6HaH+sKRFYqzg3gUAQLJmc9QpN8zkfr85yaAAirZb3JKCnawnVfPWo +b5O7prQgzxLfYs3J/fx59y9pH0DSHuHNQ2kkV7hviaXW+vQqfUDWNc9Ci3r94fv gaOE7XQvTfjB+IrrZg6XVjhusYHpdgrrJKHDSUDbXdVKOBXM/YJ78KG0rbZyWMqP zoN7RSXwPdcVoEL8zMXck/d6sx7rKkcfmlv8Ql/h/NCO4XFV8G118b7bKDM3C7ma 58Vp6mNvD/KfQEjmHoA+J46i+Zela5X2RO8FCw+cc9XYfyB3zrrOfh4e6QiuQ3tH kjJLzcoPj03FF6YxoJ0yqyhGcomqqBihxZx18fxeqxdNwvhSjps= =yonq -----END PGP SIGNATURE-----