-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 29 May 2026 11:48:56 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: i386 Version: 148.0.7778.215-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (148.0.7778.215-1~deb13u1) trixie-security; urgency=high . [ Andres Salomon ] * New upstream security release. - CVE-2026-9872: Out of bounds write in GPU. Reported by cinzinga. - CVE-2026-9873: Use after free in Network. Reported by cinzinga. - CVE-2026-9874: Use after free in Dawn. Reported by Anonymous. - CVE-2026-9875: Out of bounds read in WebGL. Reported by Anonymous. - CVE-2026-9876: Use after free in WebGL. Reported by happy2me. - CVE-2026-9877: Use after free in ANGLE. Reported by Google. - CVE-2026-9878: Use after free in ANGLE. Reported by Google. - CVE-2026-9879: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-9880: Insufficient validation of untrusted input in WebGL. Reported by Google. - CVE-2026-9881: Use after free in Bluetooth. Reported by Google. - CVE-2026-9882: Integer overflow in ANGLE. Reported by Google. - CVE-2026-9883: Use after free in Base. Reported by Google. - CVE-2026-9884: Use after free in Browser. Reported by Google. - CVE-2026-9885: Insufficient validation of untrusted input in UI. Reported by Google. - CVE-2026-9886: Use after free in Base. Reported by Google. - CVE-2026-9887: Use after free in Proxy. Reported by Google. - CVE-2026-9888: Use after free in WebView. Reported by Google. - CVE-2026-9889: Out of bounds read and write in Dawn. Reported by Google. - CVE-2026-9890: Use after free in XR. Reported by Google. - CVE-2026-9891: Use after free in Extensions. Reported by Google. - CVE-2026-9892: Inappropriate implementation in Skia. Reported by Google. - CVE-2026-9893: Use after free in Skia. Reported by Google. - CVE-2026-9894: Use after free in GPU. Reported by tohafrit. - CVE-2026-9895: Out of bounds read in GPU. Reported by 86ac1f1587b71893ed2ad792cd7dde32. - CVE-2026-9896: Out of bounds write in V8. Reported by 303f06e3. - CVE-2026-9897: Use after free in DOM. Reported by Google. - CVE-2026-9898: Insufficient validation of untrusted input in GPU. Reported by Google. - CVE-2026-9899: Use after free in ANGLE. Reported by Google. - CVE-2026-9900: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-9901: Use after free in ANGLE. Reported by Google. - CVE-2026-9902: Use after free in Accessibility. Reported by Google. - CVE-2026-9903: Insufficient validation of untrusted input in Site Isolation. Reported by Google. - CVE-2026-9904: Use after free in ANGLE. Reported by Google. - CVE-2026-9905: Use after free in Accessibility. Reported by Google. - CVE-2026-9906: Out of bounds write in GPU. Reported by Google. - CVE-2026-9907: Out of bounds read in Dawn. Reported by Google. - CVE-2026-9908: Out of bounds read in ANGLE. Reported by Google. - CVE-2026-9909: Integer overflow in Skia. Reported by Google. - CVE-2026-9910: Out of bounds memory access in ANGLE. Reported by Google. - CVE-2026-9911: Integer overflow in ANGLE. Reported by Google. - CVE-2026-9912: Inappropriate implementation in GPU. Reported by Google. - CVE-2026-9913: Inappropriate implementation in ANGLE. Reported by Google - CVE-2026-9914: Insufficient validation of untrusted input in ANGLE. Reported by Google. - CVE-2026-9915: Heap buffer overflow in ANGLE. Reported by Google. - CVE-2026-9916: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-9917: Uninitialized Use in WebGL. Reported by Google. - CVE-2026-9918: Inappropriate implementation in Tint. Reported by Google. - CVE-2026-9919: Out of bounds read in WebGL. Reported by Google. - CVE-2026-9920: Uninitialized Use in GPU. Reported by Google. - CVE-2026-9921: Uninitialized Use in WebGL. Reported by Google. - CVE-2026-9922: Use after free in GPU. Reported by Google. - CVE-2026-9923: Use after free in Skia. Reported by Google. - CVE-2026-9924: Heap buffer overflow in ANGLE. Reported by Google. - CVE-2026-9925: Use after free in ANGLE. Reported by Google. - CVE-2026-9926: Heap buffer overflow in ANGLE. Reported by Google. - CVE-2026-9927: Use after free in ANGLE. Reported by Google. - CVE-2026-9928: Out of bounds read in ANGLE. Reported by Jeff Muizelaar - Mozilla. - CVE-2026-9929: Inappropriate implementation in WebGL. Reported by Google - CVE-2026-9930: Out of bounds write in Dawn. Reported by Google. - CVE-2026-9931: Use after free in GPU. Reported by Google. - CVE-2026-9932: Use after free in ANGLE. Reported by Google. - CVE-2026-9933: Use after free in Input. Reported by Google. - CVE-2026-9934: Use after free in Aura. Reported by Google. - CVE-2026-9935: Uninitialized Use in ANGLE. Reported by Google. - CVE-2026-9936: Use after free in GFX. Reported by Google. - CVE-2026-9937: Use after free in UI. Reported by Google. - CVE-2026-9938: Inappropriate implementation in V8. Reported by Google. - CVE-2026-9939: Heap buffer overflow in WebCodecs. Reported by Google. - CVE-2026-9940: Heap buffer overflow in ANGLE. Reported by Google. - CVE-2026-9941: Use after free in ANGLE. Reported by Google. - CVE-2026-9942: Uninitialized Use in ANGLE. Reported by Google. - CVE-2026-9943: Out of bounds read in WebGL. Reported by Google. - CVE-2026-9944: Uninitialized Use in ANGLE. Reported by Google. - CVE-2026-9945: Use after free in Media. Reported by Google. - CVE-2026-9946: Use after free in ANGLE. Reported by Google. - CVE-2026-9947: Use after free in XML. Reported by Google. - CVE-2026-9948: Use after free in Views. Reported by Google. - CVE-2026-9949: Use after free in Core. Reported by Google. - CVE-2026-9950: Insufficient validation of untrusted input in iOS. Reported by Google. - CVE-2026-9951: Use after free in UI. Reported by Google. - CVE-2026-9952: Use after free in WebAudio. Reported by Google. - CVE-2026-9953: Out of bounds read in ANGLE. Reported by Google. - CVE-2026-9954: Use after free in TabStrip. Reported by yueliu of Microsoft. - CVE-2026-9955: Inappropriate implementation in iOS. Reported by Google. - CVE-2026-9956: Use after free in iOS. Reported by Google. - CVE-2026-9957: Use after free in PDF. Reported by Google. - CVE-2026-9958: Use after free in PDFium. Reported by Google. - CVE-2026-9959: Race in WebRTC. Reported by Google. - CVE-2026-9960: Integer overflow in PDFium. Reported by Google. - CVE-2026-9961: Use after free in SurfaceCapture. Reported by Google. - CVE-2026-9962: Use after free in WebRTC. Reported by Google. - CVE-2026-9963: Uninitialized Use in iOS. Reported by Google. - CVE-2026-9964: Use after free in Bluetooth. Reported by Google. - CVE-2026-9965: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-9966: Integer overflow in XML. Reported by Google. - CVE-2026-9967: Out of bounds write in GPU. Reported by Google. - CVE-2026-9968: Integer overflow in V8. Reported by Google. - CVE-2026-9969: Insufficient validation of untrusted input in ANGLE. Reported by Google. - CVE-2026-9970: Use after free in WebGL. Reported by TFGC. - CVE-2026-9971: Inappropriate implementation in iOS. Reported by Google. - CVE-2026-9972: Uninitialized Use in Gamepad. Reported by Google. - CVE-2026-9973: Out of bounds write in V8. Reported by amyb of OpenAI. - CVE-2026-9974: Out of bounds write in GPU. Reported by Google. - CVE-2026-9975: Out of bounds read and write in ANGLE. Reported by Google - CVE-2026-9976: Inappropriate implementation in USB. Reported by Google. - CVE-2026-9977: Insufficient validation of untrusted input in WebShare. Reported by Google. - CVE-2026-9978: Use after free in Glic. Reported by Google. - CVE-2026-9979: Insufficient validation of untrusted input in Input. Reported by Google. - CVE-2026-9980: Insufficient validation of untrusted input in Printing. Reported by Google. - CVE-2026-9981: Inappropriate implementation in Skia. Reported by Google. - CVE-2026-9982: Insufficient validation of untrusted input in ANGLE. Reported by Google. - CVE-2026-9983: Type Confusion in Skia. Reported by Google. - CVE-2026-9984: Use after free in UI. Reported by Google. - CVE-2026-9985: Insufficient validation of untrusted input in Media. Reported by Google. - CVE-2026-9986: Insufficient validation of untrusted input in OptimizationGuide. Reported by Google. - CVE-2026-9987: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google. - CVE-2026-9988: Use after free in WebRTC. Reported by Google. - CVE-2026-9989: Inappropriate implementation in Media. Reported by Google - CVE-2026-9990: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-9991: Inappropriate implementation in Media. Reported by Google - CVE-2026-9992: Use after free in Network. Reported by Google. - CVE-2026-9993: Use after free in Views. Reported by Google. - CVE-2026-9994: Use after free in Core. Reported by Google. - CVE-2026-9995: Use after free in WebXR. Reported by Google. - CVE-2026-9996: Out of bounds read in WebRTC. Reported by Google. - CVE-2026-9997: Use after free in Input. Reported by Google. - CVE-2026-9998: Integer overflow in Skia. Reported by Google. - CVE-2026-9999: Inappropriate implementation in ANGLE. Reported by Google - CVE-2026-10000: Use after free in Passwords. Reported by Google. - CVE-2026-10001: Use after free in PerformanceManager. Reported by Google - CVE-2026-10002: Use after free in PDFium. Reported by Google. - CVE-2026-10003: Use after free in Views. Reported by Google. - CVE-2026-10004: Insufficient validation of untrusted input in Passwords. Reported by Google. - CVE-2026-10005: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-10006: Race in WebAudio. Reported by Google. - CVE-2026-10007: Use after free in SVG. Reported by Google. - CVE-2026-10008: Uninitialized Use in GPU. Reported by Google. - CVE-2026-10009: Integer overflow in Skia. Reported by Google. - CVE-2026-10010: Inappropriate implementation in Input. Reported by Google. - CVE-2026-10011: Inappropriate implementation in Skia. Reported by Google - CVE-2026-10012: Use after free in Skia. Reported by Google. - CVE-2026-10013: Use after free in WebCodecs. Reported by Google. - CVE-2026-10014: Use after free in WebMIDI. Reported by Google. - CVE-2026-10015: Integer overflow in WTF. Reported by Google. - CVE-2026-10016: Use after free in DOM. Reported by pwn2addr. - CVE-2026-10017: Out of bounds read in Headless. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-10018: Integer overflow in ANGLE. Reported by Rahul Raj. - CVE-2026-10019: Integer overflow in ANGLE. Reported by Mufeed VH from Winfunc Research (winfunc.com). - CVE-2026-10020: Insufficient validation of untrusted input in Skia. Reported by Google. - CVE-2026-10021: Insufficient validation of untrusted input in USB. Reported by Google. - CVE-2026-10022: Type Confusion in V8. Reported by ggwhyp. Checksums-Sha1: 0f4a17974f71e6912983031a1e8319d9dfcfc854 5338612 chromium-common-dbgsym_148.0.7778.215-1~deb13u1_i386.deb c0110ee8fb400d9edbd38df578e222c4942a0c01 25692256 chromium-common_148.0.7778.215-1~deb13u1_i386.deb a786e0fc708f1f916a11eced44c586614923a5c2 36145184 chromium-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 24ab41d78f4013ac4d4ed66b06d9ec6ff9809e09 7935888 chromium-driver_148.0.7778.215-1~deb13u1_i386.deb b59b27e07fc7ac65aa587673006e5b52960d5a2e 29781220 chromium-headless-shell-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 8262f8aaa51a6de55d776aa55ad90c56088104c8 59243868 chromium-headless-shell_148.0.7778.215-1~deb13u1_i386.deb a3679f4191a7ef4aaca6313e8e6260d4dab43700 18980 chromium-sandbox-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 26557fd4853d72663665408666bf2682310bdcdc 119064 chromium-sandbox_148.0.7778.215-1~deb13u1_i386.deb d0e6edc355d060082b527665167db55c6f9060a3 32621536 chromium-shell-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 5f7066399cd3e8576f83eda1638e3ca322b73f73 64921820 chromium-shell_148.0.7778.215-1~deb13u1_i386.deb d5090806fda2d6a3147efc54b2c389244032b1cc 30602 chromium_148.0.7778.215-1~deb13u1_i386-buildd.buildinfo 52009fa49e637f681f3ac883cedc939f62b12675 77611744 chromium_148.0.7778.215-1~deb13u1_i386.deb Checksums-Sha256: 964dfc26e5499b904ffec2d63f884284313ec3fbfeaa605e83308afdfe309d2e 5338612 chromium-common-dbgsym_148.0.7778.215-1~deb13u1_i386.deb ad9812ad60d1db7acd491af82644bf87af15a5c9f7cd8f990c1616420a358ffa 25692256 chromium-common_148.0.7778.215-1~deb13u1_i386.deb 70a4d4e3221b27ba073b96b3feb653badc46f4ae90353121539358573ef81992 36145184 chromium-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 919e1c35e117f0960dd8bb6c733e8740417d7c55357d71123b667a1784788756 7935888 chromium-driver_148.0.7778.215-1~deb13u1_i386.deb 59f697e9b2245d14aa659d6d5cfceb3d2c130c0121dac0e9f7e4bedfe9d805e6 29781220 chromium-headless-shell-dbgsym_148.0.7778.215-1~deb13u1_i386.deb e865968c76e962afbf0bf3af5ca2a49e7485f0a3da25b29d02aa36a510048a31 59243868 chromium-headless-shell_148.0.7778.215-1~deb13u1_i386.deb 5f2ec1087d7d28b816f30eb597fcbf758362b567973e8261007fd5123cd5cd69 18980 chromium-sandbox-dbgsym_148.0.7778.215-1~deb13u1_i386.deb b3b8b976bf5c3359c8167c580eade9eb5441d558eaacb28c167f36c1b8f97127 119064 chromium-sandbox_148.0.7778.215-1~deb13u1_i386.deb fb955c378e68faecaf0aca3bc354bae541bc8dd78218f3e123dae788cf718f44 32621536 chromium-shell-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 498619d9eba120c0f01e6b24ab04427e84b08771d0946af5a8249778e97c6cfc 64921820 chromium-shell_148.0.7778.215-1~deb13u1_i386.deb 8fcdddd45fb04078e3b989eaebd6d0179bc274f87cb875b4d694dec925352b2d 30602 chromium_148.0.7778.215-1~deb13u1_i386-buildd.buildinfo 31bde21fa506b4a6f1ebb028e861bb6e9de03972b1c8e5db6f2143bf0ff2883c 77611744 chromium_148.0.7778.215-1~deb13u1_i386.deb Files: 09ef072665390861ea197d01648f9469 5338612 debug optional chromium-common-dbgsym_148.0.7778.215-1~deb13u1_i386.deb e3dff0b308f7613664f7273879a383d3 25692256 web optional chromium-common_148.0.7778.215-1~deb13u1_i386.deb 12fcc1568588420dc9cb9e731c0619d5 36145184 debug optional chromium-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 9f77e1463038f81a6d6c704844e879eb 7935888 web optional chromium-driver_148.0.7778.215-1~deb13u1_i386.deb 0da9039ee0b51be7c76011ca2f918947 29781220 debug optional chromium-headless-shell-dbgsym_148.0.7778.215-1~deb13u1_i386.deb a84959964244c60317422fca44a67bd5 59243868 web optional chromium-headless-shell_148.0.7778.215-1~deb13u1_i386.deb 6bc705ebca8ceb73ba38c29032c7882f 18980 debug optional chromium-sandbox-dbgsym_148.0.7778.215-1~deb13u1_i386.deb b063846bdb2e9728854b8b6704cef57f 119064 web optional chromium-sandbox_148.0.7778.215-1~deb13u1_i386.deb 731db8292b0f9fe56da0691ca34f19ac 32621536 debug optional chromium-shell-dbgsym_148.0.7778.215-1~deb13u1_i386.deb 862546e3e59b1d3b85c2f2ccf50fb1be 64921820 web optional chromium-shell_148.0.7778.215-1~deb13u1_i386.deb 7b4dfd9bef4d38f1dba6e36b5359f486 30602 web optional chromium_148.0.7778.215-1~deb13u1_i386-buildd.buildinfo 34bf37d035baae41bcc3b39d13230151 77611744 web optional chromium_148.0.7778.215-1~deb13u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmocjgkACgkQbheoBegw XLKfBQ/+M92d1+wzh9AKr1E6bzjSh7WfF1gZMiHyJ8QvWrMHBmNYlsJkgC1F0OOG SsH7jqhuyRGw41cTwxp7FFWaplElFMe7+n3m+rv/tZMpiXtFe1gjmcLusp8gnkzd 1miesEi0AwTvaoI24mZzELq1nefbyJ8bA9zGFhU6Ws7j6hjyFIYiOfSyq20W3Enc C5jthFLglLRD9746JZ0+pcDB5oxTy0ox8JCX5AZwfK9deY1AzuFAmYqwwUpdOnCw W17Q6eKY7rN7bHR47CDaKSaMXFqPW34EfMilzRFFk0ks6C62KIT+4VS5JDNIpUEr xGiYeVJeoy7G0rD5rvoTiyaW0oDorW1CvLuQZsnTsPE8RBTxG9gMIOWlUaPyasv0 5OwmqrzGQcEqf5oQkl3+2c7tGsqI4qcxTNyA4baFb5SuqH5JqQJyHmNntsh1f7GX 2fWBt068SedhUij74zU3V1S6HENJVi3KYe/VEJbNxVZYJ3hzDaEIJ2qIZ1gOlgW1 e9/v5NhrZWpFU5pZAbqEIS0xrgV6PbWdLU8vxjv9s5AN+RR7icLHceL+yYALbqxa O9qmPBTL4IuaVuOvyGft6klIQAO45QkmQ1FhUMrHabST7wqQ5B7Jmv2VpgC+rhFd eS4fKf+9mPdR3580B/UASWJE1OmvO90LdG3cNd7u8UD3Ow02tyk= =Vqv0 -----END PGP SIGNATURE-----