-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 21 Oct 2026 14:43:50 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: i386 Version: 156.0.8078.47-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: all / amd64 / i386 Build Daemon (x86-conova-02) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (156.0.8078.47-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/chromium-headless-shell.lintian-overrides: Add tiff embedded library to resolve a lintian error. * d/chromium-l10n.lintian-overrides: New override file to resolve several lintian "package-contains-documentation-outside-usr-share-doc" checks. * d/chromium.lintian-overrides: Drop the libjsoncpp embedded library, to resolve a lintian "mismatched-override" warning. * d/control: Add tsx build-dep, to allow executing TypeScript directly [sid]. * d/deb_pre_gen.py: Handle three new scripts, including a TypeScript one. * d/patches: - debianization/pre-gen.patch: Update edits to protoc_wrapper.py. - fixes/bindgen-paths.patch: Use rust_sysroot_absolute to locate rustfmt, instead of hard-coding /usr. This simplifies Ubuntu support. - system/node-ts.patch: New patch to use "tsx" instead of "node" when a .ts script is executed, as Node.js can't do that prior to v26. - system/tsc2.patch: Fix a couple of apparent TypeScript 6 vs. 7 incompatibilities. . [ Andres Salomon ] * New upstream stable release. - CVE-2026-110922: Use after free in Prerender. Reported by Xinyang Ge. - CVE-2026-110913: Memory corruption in DOM. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-110919: Use after free in V8. Reported by Xinyang Ge. - CVE-2026-110918: Memory corruption in Core. Reported by Google. - CVE-2026-110917: Memory corruption in SVG. Reported by C0rk1. - CVE-2026-110921: Use after free in V8. Reported by Xinyang Ge. - CVE-2026-110920: Memory corruption in V8. Reported by Xinyang Ge. - CVE-2026-110916: Improper input validation in Desktop. Reported by Google. - CVE-2026-110915: Use after free in Compositing. Reported by Google. - CVE-2026-110914: Memory corruption in Workers. Reported by Google. - CVE-2026-113341: Memory corruption in Skia. Reported by Google. - CVE-2026-113279: Memory corruption in Accessibility. Reported by Xinyang Ge. - CVE-2026-113072: Memory corruption in CSS. Reported by Xinyang Ge. - CVE-2026-113280: Memory corruption in Paint. Reported by Xinyang Ge. - CVE-2026-113271: Use after free in Accessibility. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-113303: Memory corruption in WebRTC. Reported by OpenAI Codex Security (kylebot). - CVE-2026-113101: Use after free in SiteIsolation. Reported by Quyen Son at VinFast (@zer0qs). - CVE-2026-113097: Use after free in FileSystem. Reported by nh.dev2022. - CVE-2026-113098: Memory corruption in CacheStorage. Reported by Salvatore Gulizia (nickname: Serotav). - CVE-2026-113242: Memory corruption in ANGLE. Reported by JonathanBouman. - CVE-2026-113058: Use after free in WebUI. Reported by OGINOME Tomohito. - CVE-2026-113082: Memory corruption in ANGLE. Reported by Zabith Mohammed. - CVE-2026-113119: Use after free in Network. Reported by JonathanBouman. - CVE-2026-113092: Use after free in Passwords. Reported by OGINOME Tomohito. - CVE-2026-113134: Memory corruption in ANGLE. Reported by Jinpyo Lee. - CVE-2026-113339: Use after free in SVG. Reported by Arni Hardarson (Neonix Security). - CVE-2026-113317: Memory corruption in Accessibility. Reported by Findingz. - CVE-2026-113193: Memory corruption in V8. Reported by Nebula Security (@nebusecurity). - CVE-2026-113117: Improper input validation in ANGLE. Reported by hamayanhamayan. - CVE-2026-113188: Memory corruption in GPU. Reported by Google. - CVE-2026-113104: Memory corruption in Frames. Reported by Google. - CVE-2026-113322: Memory corruption in Dawn. Reported by Google. - CVE-2026-113163: Use after free in WebGL. Reported by Google. - CVE-2026-113253: Use after free in Canvas. Reported by Google. - CVE-2026-113298: Use after free in Transactions Platform. Reported by Google. - CVE-2026-113315: Memory corruption in ANGLE. Reported by Google. - CVE-2026-113236: Use after free in Navigation. Reported by Google. - CVE-2026-113284: Memory corruption in XML. Reported by Google. - CVE-2026-113141: Use after free in Transactions Platform. Reported by Google. - CVE-2026-113316: Improper input validation in Views. Reported by Google. - CVE-2026-113234: Memory corruption in ANGLE. Reported by Google. - CVE-2026-113252: Improper input validation in ANGLE. Reported by Google. - CVE-2026-113305: Use after free in Privacy. Reported by Hafiizh. - CVE-2026-113044: Use after free in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-113135: Memory corruption in PictureInPicture. Reported by Xinyang Ge. - CVE-2026-113266: Memory corruption in ANGLE. Reported by Google. - CVE-2026-113273: Memory corruption in ANGLE. Reported by Google. - CVE-2026-113293: Use after free in ANGLE. Reported by Google. - CVE-2026-113225: Memory corruption in Browser. Reported by Google. - CVE-2026-113210: Use after free in ANGLE. Reported by Google. - CVE-2026-113285: Memory corruption in ANGLE. Reported by Google. - CVE-2026-113324: Use after free in GPU. Reported by Google. - CVE-2026-113334: Improper input validation in ANGLE. Reported by Jinpyo Lee. - CVE-2026-113020: Improper input validation in Date. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-113222: Use after free in V8. Reported by zenneth (randomguy6407). - CVE-2026-113318: Memory corruption in ServiceWorker. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-113310: Out of bounds read in Bluetooth. Reported by James Burton. - CVE-2026-113338: Use after free in Turbolev. Reported by OpenAI Codex Security (amyb). - CVE-2026-113093: Memory corruption in DisplayLocking. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-113012: Improper input validation in GPU. Reported by Matthias Pleschinger (Popax21). - CVE-2026-113175: Improper input validation in FileSystem. Reported by huntersnot4. - CVE-2026-113192: Memory corruption in V8. Reported by Xinyang Ge. - CVE-2026-113309: Out of bounds read in Media. Reported by Xinyang Ge. - CVE-2026-113295: Out of bounds read in ANGLE. Reported by Google. - CVE-2026-113217: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-113040: Improper input validation in Proxy. Reported by o. - CVE-2026-113161: Use after free in WebRTC. Reported by C0rk1. - CVE-2026-113154: Memory corruption in Canvas. Reported by Xinyang Ge. - CVE-2026-113336: Memory corruption in Compositing. Reported by Xinyang Ge. - CVE-2026-113181: Use after free in Navigation. Reported by Xinyang Ge. - CVE-2026-113019: Use after free in Turbolev. Reported by Project WhatForLunch (@nebusecurity). - CVE-2026-113095: Out of bounds read in Focus. Reported by Xinyang Ge. - CVE-2026-113160: Use after free in Turbolev. Reported by Hoyong Jin. - CVE-2026-113212: Memory corruption in PDF. Reported by Xinyang Ge (Anthropic), assisted by Claude. - CVE-2026-113000: Memory corruption in Paint. Reported by Arni Hardarson (Neonix Security). - CVE-2026-113179: Use after free in Paint. Reported by Arni Hardarson (Neonix Security). - CVE-2026-112993: Use after free in Input. Reported by Arni Hardarson (Neonix Security). - CVE-2026-113055: Type confusion in FullScreen. Reported by Kirill Baev. - CVE-2026-113068: Use after free in Input. Reported by Hafiizh. - CVE-2026-113320: Memory corruption in Navigation. Reported by @RenwaX23. - CVE-2026-113231: Improper input validation in Extensions. Reported by Luan Herrera (@lbherrera_). - CVE-2026-113174: Use after free in Extensions. Reported by foxribeye. - CVE-2026-113022: Memory corruption in PDFium. Reported by Jamos Zhu, Sebastian Dowell. - CVE-2026-113079: Use after free in SiteIsolation. Reported by David Erceg. - CVE-2026-113191: Use after free in Internals. Reported by Google. - CVE-2026-113250: Use after free in ANGLE. Reported by mikey233 of HackerOne. - CVE-2026-113109: Memory corruption in API. Reported by Google. - CVE-2026-113113: Use after free in Extensions. Reported by Google. - CVE-2026-113069: Memory corruption in Compositing. Reported by Google. - CVE-2026-113006: Out of bounds read in Navigation. Reported by Google. - CVE-2026-113263: Use after free in Core. Reported by Google. - CVE-2026-113018: Memory corruption in IME. Reported by Google. - CVE-2026-113301: Memory corruption in WebAppInstalls. Reported by Google. - CVE-2026-113034: Memory corruption in FileSystem. Reported by Google. - CVE-2026-113094: Memory corruption in API. Reported by Google. - CVE-2026-113240: Use after free in Chromecast. Reported by Google. - CVE-2026-113102: Out of bounds read in FileSystem. Reported by Google. - CVE-2026-113142: Memory corruption in Extensions. Reported by Google. - CVE-2026-113281: Memory corruption in SiteIsolation. Reported by Google. - CVE-2026-113035: Out of bounds read in API. Reported by Google. - CVE-2026-113211: Memory corruption in ServiceWorker. Reported by Google. - CVE-2026-113011: Use after free in CredentialProvider. Reported by Google. - CVE-2026-113198: Use after free in Extensions. Reported by Google. - CVE-2026-113257: Memory corruption in Media. Reported by Google. - CVE-2026-113070: Out of bounds read in GetUserMedia. Reported by Google. - CVE-2026-113176: Memory corruption in Omnibox. Reported by Google. - CVE-2026-113150: Memory corruption in Bindings. Reported by Google. - CVE-2026-113311: Use after free in ServiceWorker. Reported by Google. - CVE-2026-113078: Improper input validation in Compositing. Reported by Werner Kasselman. - CVE-2026-113033: Use after free in Streaming. Reported by Google. - CVE-2026-113026: Memory corruption in PDF. Reported by Google. - CVE-2026-113302: Use after free in Extensions. Reported by Google. - CVE-2026-113164: Memory corruption in Voice. Reported by Google. - CVE-2026-113239: Range error in SiteIsolation. Reported by Google. - CVE-2026-113131: Memory corruption in Bluetooth. Reported by Google. - CVE-2026-113333: Memory corruption in Extensions. Reported by Google. - CVE-2026-113147: Improper input validation in WebShare. Reported by Google. - CVE-2026-113337: Memory corruption in Scroll. Reported by Google. - CVE-2026-113127: Memory corruption in Browser. Reported by Google. - CVE-2026-113129: Improper access control in Extensions. Reported by Google. - CVE-2026-113264: Improper input validation in Extensions. Reported by Google. - CVE-2026-113105: Use after free in Extensions. Reported by Google. - CVE-2026-113220: Memory corruption in Extensions. Reported by Google. - CVE-2026-113275: Use after free in API. Reported by Google. - CVE-2026-113283: Memory corruption in CredentialProvider. Reported by Google. - CVE-2026-113014: Use after free in PerformanceAPIs. Reported by Google. - CVE-2026-113108: Use after free in Script. Reported by Google. - CVE-2026-113343: Memory corruption in Sandbox. Reported by Google. - CVE-2026-113319: Use after free in Accessibility. Reported by Google. - CVE-2026-113057: Improper access control in ComputePressure. Reported by Google. - CVE-2026-113219: Memory corruption in Contacts. Reported by Google. - CVE-2026-113005: Memory corruption in Bluetooth. Reported by Google. - CVE-2026-113209: Memory corruption in Navigation. Reported by Google. - CVE-2026-113166: Memory corruption in History. Reported by Google. - CVE-2026-113051: Memory corruption in CSS. Reported by Google. - CVE-2026-113196: Improper access control in Mobile. Reported by Google. - CVE-2026-113003: Memory corruption in HID. Reported by Florian Pradines. - CVE-2026-113155: Use after free in Glic. Reported by Google. - CVE-2026-113290: Use after free in Input. Reported by Google. - CVE-2026-113183: Memory corruption in FedCM. Reported by Google. - CVE-2026-113289: Improper input validation in PerformanceAPIs. Reported by Google. - CVE-2026-113146: Memory corruption in PerformanceAPIs. Reported by Google. - CVE-2026-113207: Use after free in SiteIsolation. Reported by Google. - CVE-2026-113205: Use after free in Variations. Reported by Google. - CVE-2026-113162: Improper input validation in Actor. Reported by Google. - CVE-2026-113118: Memory corruption in Extensions. Reported by Google. - CVE-2026-113232: Memory corruption in Search. Reported by Google. - CVE-2026-113327: Use after free in Chromecast. Reported by Google. - CVE-2026-112999: Use after free in API. Reported by Google. - CVE-2026-113249: Improper input validation in Mobile. Reported by Google. - CVE-2026-113272: Memory corruption in Extensions. Reported by Google. - CVE-2026-113112: Use after free in Extensions. Reported by Google. - CVE-2026-113321: Use after free in Extensions. Reported by Google. - CVE-2026-113059: Memory corruption in Sensor. Reported by Google. - CVE-2026-113137: Memory corruption in Extensions. Reported by Google. - CVE-2026-113208: Use after free in ContextualSearch. Reported by Google. - CVE-2026-113238: Memory corruption in CustomTabs. Reported by Google. - CVE-2026-113194: Memory corruption in Core. Reported by Google. - CVE-2026-113189: Use after free in Core. Reported by Google. - CVE-2026-113060: Improper input validation in Bluetooth. Reported by Google. - CVE-2026-113115: Use after free in Transactions Platform. Reported by Google. - CVE-2026-113045: Out of bounds read in Offline. Reported by Google. - CVE-2026-113307: Memory corruption in Extensions. Reported by Google. - CVE-2026-113009: Use after free in WindowControlsOverlay. Reported by Google. - CVE-2026-113071: Use after free in Notifications. Reported by Google. - CVE-2026-113278: Use after free in Extensions. Reported by Google. - CVE-2026-113190: Use after free in ServiceWorker. Reported by TheKng. - CVE-2026-112992: Memory corruption in Canvas. Reported by Google. - CVE-2026-112995: Use after free in Animation. Reported by Google. - CVE-2026-113261: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-113172: Memory corruption in ServiceWorker. Reported by Bhavya. - CVE-2026-113332: Memory corruption in GPU. Reported by Google. - CVE-2026-113262: Use after free in Extensions. Reported by Google. - CVE-2026-113149: Memory corruption in FullScreen. Reported by Google. - CVE-2026-113206: Memory corruption in Omnibox. Reported by Google. - CVE-2026-113185: Memory corruption in Extensions. Reported by Google. - CVE-2026-113171: Memory corruption in Prompts. Reported by Google. - CVE-2026-113042: Use after free in Extensions. Reported by Google. - CVE-2026-113276: Memory corruption in Passwords. Reported by Google. - CVE-2026-113218: Use after free in DataTransfer. Reported by Google. - CVE-2026-113195: Improper input validation in Downloads. Reported by Google. - CVE-2026-113328: Improper input validation in Privacy. Reported by Google. - CVE-2026-113335: Memory corruption in Extensions. Reported by Google. - CVE-2026-113255: Use after free in CustomTabs. Reported by Google. - CVE-2026-113076: Use after free in Toolbar. Reported by Google. - CVE-2026-113325: Memory corruption in SignIn. Reported by Google. - CVE-2026-113084: Improper input validation in Permissions. Reported by Google. - CVE-2026-113308: Use after free in Core. Reported by Google. - CVE-2026-113224: Memory corruption in WebAppInstalls. Reported by Google. - CVE-2026-113148: Memory corruption in WebUI. Reported by Google. - CVE-2026-113010: Out of bounds read in Extensions. Reported by Google. - CVE-2026-113073: Use after free in Browser. Reported by Google. - CVE-2026-113265: Memory corruption in BFCache. Reported by Google. - CVE-2026-113329: Out of bounds read in Installer. Reported by Google. - CVE-2026-113043: Use after free in iOSWeb. Reported by Google. - CVE-2026-113202: Use after free in BrowserTag. Reported by Google. - CVE-2026-113016: Improper input validation in Extensions. Reported by Google. - CVE-2026-113246: Memory corruption in iOSWebView. Reported by Google. - CVE-2026-113041: Use after free in Actor. Reported by Google. - CVE-2026-113126: Memory corruption in PolicyContainer. Reported by Google. - CVE-2026-113031: Memory corruption in Media. Reported by Google. - CVE-2026-113081: Use after free in Compositing. Reported by Google. - CVE-2026-113139: Memory corruption in Autofill. Reported by Google. - CVE-2026-113128: Missing authorization in Animation. Reported by Google. - CVE-2026-113049: Memory corruption in Core. Reported by Google. - CVE-2026-113032: Memory corruption in Omnibox. Reported by Anonymous. - CVE-2026-113204: Use after free in TrustedWebActivities. Reported by jodyritonga. - CVE-2026-113144: Memory corruption in Speech. Reported by Cassio Lima. - CVE-2026-113054: Out of bounds read in SiteIsolation. Reported by a45hif. - CVE-2026-113123: Use after free in GPU. Reported by TIENPA. - CVE-2026-113277: Out of bounds read in CustomTabs. Reported by mute1008. - CVE-2026-113136: Memory corruption in DevTools. Reported by Google. - CVE-2026-113106: Memory corruption in Skia. Reported by Google. - CVE-2026-113001: Use after free in Workers. Reported by Google. - CVE-2026-113064: Memory corruption in OptimizationGuide. Reported by Google. - CVE-2026-113243: Memory corruption in DOM. Reported by Google. - CVE-2026-113326: Memory corruption in Core. Reported by Google. - CVE-2026-113124: Memory corruption in DataTransfer. Reported by Google. - CVE-2026-113230: Improper input validation in Browser. Reported by Google. - CVE-2026-113090: Memory corruption in Interstitials. Reported by Google. - CVE-2026-113158: Use after free in Streaming. Reported by Google. - CVE-2026-113077: Memory corruption in Core. Reported by Google. - CVE-2026-113282: Use after free in Views. Reported by Google. - CVE-2026-113165: Use after free in Core. Reported by Google. - CVE-2026-113178: Memory corruption in Views. Reported by Google. - CVE-2026-113110: Memory corruption in ShadowDOM. Reported by Zabith Mohammed. - CVE-2026-113007: Memory corruption in Permissions. Reported by Anonymous. - CVE-2026-113187: Use after free in DOM. Reported by Zabith Mohammed. - CVE-2026-113075: Use after free in DevTools. Reported by Google. - CVE-2026-113259: Use after free in Frames. Reported by Zabith Mohammed. - CVE-2026-113228: Use after free in Network. Reported by Google. - CVE-2026-113099: Improper input validation in Omnibox. Reported by Google. - CVE-2026-113216: Use after free in Navigation. Reported by Google. - CVE-2026-113270: Use after free in Internals. Reported by weihengqiuu. - CVE-2026-113087: Use after free in Actor. Reported by Joshua Uphold. - CVE-2026-113267: Memory corruption in Video. Reported by weihengqiuu. - CVE-2026-113304: Memory corruption in GPU. Reported by Google. - CVE-2026-113177: Use after free in FileSystem. Reported by Hoyong Jin. - CVE-2026-113151: Out of bounds read in Actor. Reported by Google. - CVE-2026-113028: Use after free in Media. Reported by Google. - CVE-2026-113120: Improper input validation in Media. Reported by Google. - CVE-2026-112997: Memory corruption in CSS. Reported by caveeroo. - CVE-2026-113037: Use after free in WebSockets. Reported by HoneyBee. - CVE-2026-113153: Memory corruption in SiteIsolation. Reported by Hoyong Jin. - CVE-2026-113138: Memory corruption in WebAppInstalls. Reported by phamtien.ohr.s. - CVE-2026-113030: Improper access control in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-113100: Memory corruption in Audio. Reported by Google. - CVE-2026-113221: Use after free in Google Lens. Reported by OGINOME Tomohito. - CVE-2026-113344: Use after free in Performance. Reported by Google. - CVE-2026-113342: Memory corruption in Network. Reported by Google. - CVE-2026-113159: Improper access control in DevTools. Reported by Google. - CVE-2026-113233: Out of bounds read in Core. Reported by Google. - CVE-2026-113065: Use after free in Media. Reported by Google. - CVE-2026-113002: Memory corruption in Transactions Platform. Reported by Google. - CVE-2026-113199: Out of bounds read in Payments. Reported by Google. - CVE-2026-113197: Use after free in Forms. Reported by Google. - CVE-2026-113203: Use after free in CSS. Reported by Google. - CVE-2026-113170: Use after free in Autofill. Reported by Google. - CVE-2026-113258: Memory corruption in Chromoting. Reported by Google. - CVE-2026-113297: Improper access control in Ozone. Reported by Google. - CVE-2026-113062: Improper input validation in API. Reported by Google. - CVE-2026-113096: Memory corruption in Text. Reported by Google. - CVE-2026-113050: Out of bounds read in HID. Reported by Google. - CVE-2026-113008: Memory corruption in Transactions Platform. Reported by Google. - CVE-2026-113111: Use after free in Compositing. Reported by Shubham Raj, Causal Security. - CVE-2026-113200: Use after free in ANGLE. Reported by Google. - CVE-2026-113143: Memory corruption in ANGLE. Reported by Google. - CVE-2026-113157: Information leak in ANGLE. Reported by Google. - CVE-2026-113235: Improper input validation in Passwords. Reported by Google. - CVE-2026-113089: Improper input validation in PrintPreview. Reported by Google. - CVE-2026-113340: Memory corruption in ANGLE. Reported by Jinpyo Lee. - CVE-2026-113052: Memory corruption in V8. Reported by gundyman. - CVE-2026-113133: Memory corruption in PlatformIntegration. Reported by Roshan Singh. - CVE-2026-113086: Improper input validation in Input. Reported by Google. - CVE-2026-113251: Use after free in PDF. Reported by kirtikumarar. - CVE-2026-113215: Use after free in Extensions. Reported by David Erceg. - CVE-2026-113053: Use after free in Cookies. Reported by Luan Herrera (@lbherrera_). - CVE-2026-113312: Memory corruption in Autofill. Reported by Manojkumar Jaganathan Aka TheWhiteEvil with HackerBro Technologies. - CVE-2026-113323: Use after free in Chrome for iOS. Reported by Qadhafy Muhammad Tera. - CVE-2026-113114: Use after free in SignIn. Reported by Google. - CVE-2026-113015: Use after free in Workers. Reported by Google. - CVE-2026-113091: Use after free in PerformanceAPIs. Reported by Google. - CVE-2026-113168: Use after free in Permissions. Reported by Google. - CVE-2026-113229: Use after free in Loader. Reported by Google. - CVE-2026-113256: Use after free in Permissions. Reported by Google. - CVE-2026-113103: Use after free in WebProtect. Reported by Google. - CVE-2026-113056: Memory corruption in PerformanceAPIs. Reported by Google. - CVE-2026-113201: Memory corruption in Google Lens. Reported by Google. - CVE-2026-113027: Memory corruption in WebFonts. Reported by Google. - CVE-2026-113214: Improper input validation in FullScreen. Reported by Google. - CVE-2026-113004: Memory corruption in Sync. Reported by Google. - CVE-2026-113300: Out of bounds write in Forms. Reported by Google. - CVE-2026-113213: Memory corruption in DevTools. Reported by Google. - CVE-2026-113167: Memory corruption in Network. Reported by Google. - CVE-2026-113223: Memory corruption in DevTools. Reported by Google. - CVE-2026-113291: Memory corruption in FullScreen. Reported by Google. - CVE-2026-113241: Memory corruption in Toolbar. Reported by Google. - CVE-2026-113244: Improper input validation in UI. Reported by Google. - CVE-2026-113048: Memory corruption in DevTools. Reported by Google. - CVE-2026-113247: Memory corruption in DevTools. Reported by Google. - CVE-2026-113023: Improper input validation in Extensions. Reported by Google. - CVE-2026-113330: Memory corruption in CustomTabs. Reported by Google. - CVE-2026-113226: Memory corruption in Model. Reported by Google. - CVE-2026-113152: Memory corruption in SignIn. Reported by Google. - CVE-2026-113029: Improper access control in ANGLE. Reported by Google. - CVE-2026-113296: Memory corruption in Actor. Reported by Google. - CVE-2026-113306: Improper input validation in Network. Reported by Google. - CVE-2026-113245: Memory corruption in DevTools. Reported by Google. - CVE-2026-113299: Memory corruption in WebProtect. Reported by Google. - CVE-2026-113024: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-113025: Use after free in Input. Reported by Google. - CVE-2026-113080: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-113186: Memory corruption in DevTools. Reported by Google. - CVE-2026-113180: Memory corruption in ContentCapture. Reported by Google. - CVE-2026-113140: Use after free in ANGLE. Reported by Google. - CVE-2026-113184: Memory corruption in Scheduling. Reported by Google. - CVE-2026-113017: Use after free in Views. Reported by Google. - CVE-2026-112998: Memory corruption in Views. Reported by Google. - CVE-2026-113021: Use after free in WebAppInstalls. Reported by Google. - CVE-2026-113145: Memory corruption in Messages. Reported by Google. - CVE-2026-113292: Improper input validation in Omnibox. Reported by Google. - CVE-2026-113156: Use after free in Messages. Reported by Google. - CVE-2026-113116: Use after free in DevTools. Reported by Google. - CVE-2026-113047: Memory corruption in BrowserTag. Reported by Google. - CVE-2026-113173: Improper input validation in UI. Reported by Google. - CVE-2026-113260: Memory corruption in Core. Reported by Google. - CVE-2026-113269: Memory corruption in BrowserTag. Reported by Google. - CVE-2026-113036: Memory corruption in HTML. Reported by Google. - CVE-2026-113268: Memory corruption in Navigation. Reported by Google. - CVE-2026-113038: Memory corruption in DevTools. Reported by Google. - CVE-2026-113313: Memory corruption in DevTools. Reported by Google. - CVE-2026-113061: Memory corruption in Chromoting. Reported by Google. - CVE-2026-113248: Memory corruption in FileSystem. Reported by Google. - CVE-2026-113288: Memory corruption in Core. Reported by Google. - CVE-2026-113085: Use after free in Media. Reported by Google. - CVE-2026-113107: Use after free in Media. Reported by Google. - CVE-2026-113066: Memory corruption in Fonts. Reported by Google. - CVE-2026-113121: Memory corruption in ContextMenu. Reported by Google. - CVE-2026-113287: Use after free in Prompts. Reported by Google. - CVE-2026-113132: Memory corruption in DevTools. Reported by Google. - CVE-2026-113169: Memory corruption in WebAppInstalls. Reported by Google. - CVE-2026-113254: Memory corruption in DevTools. Reported by Google. - CVE-2026-113063: Improper input validation in Chromoting. Reported by Google. - CVE-2026-112994: Memory corruption in Browser. Reported by Google. - CVE-2026-113314: Use after free in Media. Reported by Google. - CVE-2026-113237: Memory corruption in Chromoting. Reported by Google. - CVE-2026-113331: Memory corruption in Controls. Reported by Google. - CVE-2026-113182: Memory corruption in Passwords. Reported by Google. - CVE-2026-113046: Improper input validation in Passwords. Reported by Google. - CVE-2026-113067: Use after free in Chromoting. Reported by Google. - CVE-2026-113074: Use after free in Media. Reported by Google. - CVE-2026-113130: Use after free in Actor. Reported by Google. - CVE-2026-113294: Improper input validation in Loader. Reported by Google. - CVE-2026-112996: Memory corruption in Loader. Reported by Google. - CVE-2026-113122: Memory corruption in Loader. Reported by Google. - CVE-2026-113227: Use after free in Editing. Reported by Google. - CVE-2026-113286: Memory corruption in Google Lens. Reported by Google. - CVE-2026-113083: Memory corruption in Actor. Reported by Google. - CVE-2026-113088: Memory corruption in Mobile. Reported by Google. - CVE-2026-113013: Memory corruption in DevTools. Reported by Google. - CVE-2026-113125: Memory corruption in DevTools. Reported by Google. - CVE-2026-113039: Use after free in Bookmarks. Reported by NH DEV. - CVE-2026-113274: Use after free in ReadingMode. Reported by chipsec. * d/copyright: - delete all of third_party/oak/src/mcp/ for some remote proxy binaries. - delete third_party/tflite/src/tensorflow/lite/*/*/compatibility/ due to binary blobs. * d/patches: - debianization/pre-gen.patch: refresh (and drop compile_ts.py part). - fixes/only-address-sanitizer.patch: refresh. - fixes/crubit.patch: sync from u-c. - fixes/verification-tokens.patch: sync from u-c. - disable/catapult.patch: refresh. - ungoogled/disable-ai.patch: sync from u-c. - ungoogled/disable-mei-preload.patch: sync from u-c. - ungoogled/disable-privacy-sandbox.patch: sync from u-c. . [ Timothy Pearson] * d/patches/ppc64le: - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: refresh for upstream changes - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream changes - third_party/0005-blink-add-audio-vector-support.patch: resync with upstream amd64 SSE2 file . [ Trung Lê ] * d/patches/ppc64le: - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: read the first syscall argument from orig_gpr3 instead of gpr[3] in the SIGSYS ucontext, and drop the trap.cc hack that negated it. Linux 7.2.x with GENERIC_ENTRY leaves -ENOSYS in gpr[3] for SECCOMP_RET_TRAP, which made the pid checks for sched_getaffinity/sched_getparam fail and crashed every renderer with "seccomp-bpf failure". . [ Dominique Belhachemi] * d/rules: use esbuild native binary instead of esbuild-wasm to speed up builds and avoid riscv64 esbuild-wasm crashing [sid]. . [ Jianfeng Liu ] * d/patches/loongarch64: - 0004-loong64-sandbox-sandbox-linux-Update-syscall-helpers.patch: refresh for upstream changes. - 0012-sandbox-linux-add-statx-support-for-loongarch64.patch: refresh for upstream changes. - 0024-optimize-nested-128-bit-additions.patch: remove since merged by upstream. Checksums-Sha1: f21349622e428e38ca2edc9b92c8e843208243bd 4170320 chromium-common-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 45a72c0b7f9e5b1254be5ac5db9a85574e89b4fb 31828552 chromium-common_156.0.8078.47-1~deb13u1_i386.deb d60d5c6bc05db42753b0bfa011c87551364f3594 37408368 chromium-dbgsym_156.0.8078.47-1~deb13u1_i386.deb e0afe4d6452d0ac60092db598163c37671c7ec5d 8827452 chromium-driver_156.0.8078.47-1~deb13u1_i386.deb 03a1b1df2e9248c3c581fdc83c84661430e98a2a 31031596 chromium-headless-shell-dbgsym_156.0.8078.47-1~deb13u1_i386.deb efd8c183698972859a45efebf19025b455937fad 65130452 chromium-headless-shell_156.0.8078.47-1~deb13u1_i386.deb 33e4739467eaf0d0519c8ca490a9a81eec5e89d3 19372 chromium-sandbox-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 62b802e6b3b8c083feb56647609f98a9197fab44 160296 chromium-sandbox_156.0.8078.47-1~deb13u1_i386.deb 12a6b1d127e03954b2143d63f15d9aefa5446d72 33442728 chromium-shell-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 79a38e922baa9d1401aa010d703dca281df7b3cb 69670012 chromium-shell_156.0.8078.47-1~deb13u1_i386.deb b6dfc509d653bbccb62592004ada43ef4351d086 31393 chromium_156.0.8078.47-1~deb13u1_i386-buildd.buildinfo 78e0248dfeeb8e2b9ddfbf91f02c0ffbf7220a91 83265384 chromium_156.0.8078.47-1~deb13u1_i386.deb Checksums-Sha256: a61212db2714036c762e4b27db6615d29ce9665839619d1978c37e65a24d1da1 4170320 chromium-common-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 4a3177df5ebad2f973ff296b4049768d2c33f4252ba789320fa45feced3483f1 31828552 chromium-common_156.0.8078.47-1~deb13u1_i386.deb efcd79b0da44da1aa6db23f1fe1f7dc32fa1dd0d66ddbebc8470a89c4c1cbbe9 37408368 chromium-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 2ea0f22675f23bb1e02445898c9aae2ff5e13010013e25e4aaea62093a961501 8827452 chromium-driver_156.0.8078.47-1~deb13u1_i386.deb 6fb27918c20b209d34b0f1ef1c86d5dc960ead678abe681060e93f310efe6765 31031596 chromium-headless-shell-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 02d7720c62190f545d4a42cc34038be6b495aa51d6a4cc4ec1c2e7c29801f527 65130452 chromium-headless-shell_156.0.8078.47-1~deb13u1_i386.deb e77aec77ede11e294b0d93f0640443aa8dbed42d4c1e06d34878e96c991a636b 19372 chromium-sandbox-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 302ade1d8de2bf411085d6a544a80906f2aed168eb6575739d40936248f78d9f 160296 chromium-sandbox_156.0.8078.47-1~deb13u1_i386.deb 14583c09f0bc62161aea91de9c1a13a779a8f8d29ba6067fc76efa3511b8dded 33442728 chromium-shell-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 74e76006699a56a3779a8d3c3f9153c038aad0a52eed88a24730fd0e4733d43f 69670012 chromium-shell_156.0.8078.47-1~deb13u1_i386.deb cbba26867d992134440e67b6c52c7787e871ffa8453d89a252132e5ff2719289 31393 chromium_156.0.8078.47-1~deb13u1_i386-buildd.buildinfo c5564fd49dbf77699268e19778e055b6dac3dd240280087507bfe2a7ff3ca818 83265384 chromium_156.0.8078.47-1~deb13u1_i386.deb Files: b60a5f215cad5ac3ed6045daea780004 4170320 debug optional chromium-common-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 6fb0281b000a5d17673c449d5cacefa8 31828552 web optional chromium-common_156.0.8078.47-1~deb13u1_i386.deb e7f6bc9100013df5604b93eeb1abdc6a 37408368 debug optional chromium-dbgsym_156.0.8078.47-1~deb13u1_i386.deb dd755f40fcc1f1e0d53e1ad86cf3c096 8827452 web optional chromium-driver_156.0.8078.47-1~deb13u1_i386.deb c42178bc7886268f80206fa22c8d85d5 31031596 debug optional chromium-headless-shell-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 7afb3c08178a073d7f68cfaf11581b74 65130452 web optional chromium-headless-shell_156.0.8078.47-1~deb13u1_i386.deb aa9297a198b5d53149a8c1e0c41110dd 19372 debug optional chromium-sandbox-dbgsym_156.0.8078.47-1~deb13u1_i386.deb ea4d64aa9e10c2918bcaa96827ca7288 160296 web optional chromium-sandbox_156.0.8078.47-1~deb13u1_i386.deb 1740120ec4f09142da15068fb126bfa3 33442728 debug optional chromium-shell-dbgsym_156.0.8078.47-1~deb13u1_i386.deb 3754e0e8728cc7eec40d8b6561fae7ee 69670012 web optional chromium-shell_156.0.8078.47-1~deb13u1_i386.deb 3d9c1d5aeb82363c5548ae3275df6245 31393 web optional chromium_156.0.8078.47-1~deb13u1_i386-buildd.buildinfo 9f64449a75a764b905682f20448bec51 83265384 web optional chromium_156.0.8078.47-1~deb13u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE+i/sCsF3puL4e7qIGNGWmfrqILEFAmraHoIACgkQGNGWmfrq ILE50A//avY1ECU6t0atuvqj53IO/KkcQ33Yg+XurUTeZO2NL/PrLmHi8162t5rw 0lo8JDFxJFED47Y96jo8S7lvfSl/CZR+32kRkeJF5NEDTBka4QCtCXG+NDOPGDCG JjBs0MXQ8p9pfde7CBO25sXuhfs8vfnGAFFxWYzvoqMDaMBRw+x1WCwMV6IxCksy PVvjKcOmL6UppBFRhbrXIztJZ8+8SRL340KpWoyAAl2M6atcj3Jp3f8EnQEtkPha jTwN/hn9HcLSMB0CdJCksfRJ3NnEmbW7GEtp/M0RFaaKW+0PQc53MdBhJyYSHjZP uz5nfd4ZqeD7L0tYoRT3fo7F04NM8G3cUJyt5PaQXs6DPALkf3niDWwf4lWeBOIZ iOf+tPkc4ygbWBaBqyPdaxFgf06Q5A/ZvqTPqKOt2zacai7NQ5BlDLz3lNEnmYLU OxqYI5vdd5wuN9/SyaUizr2AifFzkAJdEpwSEMgVHoUICWCbG8iHFPs8eWwHNi5/ sGuXWfx+qC6EDLtHcRY4Z13ZEHPhaA+gO3+ZePzYp7GxffcXfn/0dQEzyln5w/m1 95sCHrA8XSW+qZr5GcIJxAPOVZXO/za+PknxcAtNn/8yLcAhehtR/S9UZqVzy5mP upJphCBvaeDH4wgJUUcO+ApOG2v210twr6fpWTxAMn+c4DqSOK0= =yqQF -----END PGP SIGNATURE-----