-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 02 Sep 2026 14:22:49 -0400
Source: chromium
Binary: chromium-l10n
Architecture: all
Version: 152.0.7977.75-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Description:
 chromium-l10n - web browser - language packs
Changes:
 chromium (152.0.7977.75-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-84353: Use after free in Shared Tab Groups. Reported by Google.
     - CVE-2026-84352: Use after free in WebGL. Reported by Google.
     - CVE-2026-84354: Incorrect authorization in FileSystem.
       Reported by Google.
     - CVE-2026-84359: Information leak in Skia. Reported by Google.
     - CVE-2026-84357: Improper input validation in Omnibox.
       Reported by Google.
     - CVE-2026-84324: Use after free in Proxy. Reported by Google.
     - CVE-2026-84349: Use after free in Browser. Reported by Google.
     - CVE-2026-84326: Uninitialized resource in V8. Reported by Jihyeon Jeong
       (Compsec Lab, Seoul National University / Research Intern).
     - CVE-2026-84333: Use after free in Dawn. Reported by Google.
     - CVE-2026-84351: Buffer overflow in GPU. Reported by Cassio Lima.
     - CVE-2026-84325: Improper input validation in DataTransfer.
       Reported by Google.
     - CVE-2026-84328: Missing authorization in FileSystem. Reported by Google.
     - CVE-2026-84347: Use after free in WebRTC. Reported by Google.
     - CVE-2026-84323: Missing authorization in FileSystem. Reported by Google.
     - CVE-2026-84355: Incorrect authorization in Navigation.
       Reported by Google.
     - CVE-2026-84358: Improper privilege management in Downloads.
       Reported by Google.
     - CVE-2026-84332: Incorrect authorization in SiteSettings.
       Reported by Google.
     - CVE-2026-84330: UI misrepresentation in FullScreen. Reported by Google.
     - CVE-2026-84334: Incorrect authorization in Chromoting.
       Reported by Google.
     - CVE-2026-84348: Information leak in MediaCapture. Reported by Google.
     - CVE-2026-84335: Incorrect authorization in TabStrip. Reported by Google.
     - CVE-2026-84327: Incorrect authorization in Autofill. Reported by Google.
     - CVE-2026-84329: Confused deputy in CredentialProvider.
       Reported by Google.
     - CVE-2026-84356: UI misrepresentation in FullScreen.
       Reported by Francesco Topol (k4tedu).
     - CVE-2026-84350: Use after free in TabStrip. Reported by Google.
     - CVE-2026-84331: Incorrect authorization in Actor. Reported by Google.
   * d/control: bump rustc-web build-dep versioning up to 1.96, now that we
     have that in bookworm-proposed-updates.
   * d/patches:
     - trixie/rust-no-alloc-shim.patch: drop, no longer needed with newer rust.
     - trixie/rust-sanitize.patch: drop, no longer needed with newer rust.
     - debianization/rust-disable-debugsym.patch: add --no-mmap-output-file
       to link flags (another attempt to reduce armhf memory usage).
     - rust-1.85/jxl-simd-avx512.patch: drop, no longer needed with newer rust
     - rust-1.85/jxl-features.patch: drop, no longer needed with newer rust.
     - rust-1.85/parsing.patch: drop, no longer needed with newer rust.
     - rust-1.85/image.patch: drop, no longer needed with newer rust.
     - rust-1.85/rust-is-multiple-of.patch: drop, no longer needed with newer
       rust.
     - rust-1.85/file_as_c_str.patch: drop, no longer needed with newer rust.
     - rust-1.85/mojo-features.patch: drop, no longer needed with newer rust.
     - rust-1.85/zip8.patch: drop, no longer needed with newer rust.
     - rust-1.85/std-from-utf8.patch: drop, no longer needed with newer rust.
     - rust-1.85/let-chains.patch: drop, no longer needed with newer rust.
     - trixie/adler1.patch: drop, now that we have a newer rustc-web in
       bookworm.
 .
   [ Daniel Richard G. ]
   * d/deb_pre_gen.py: Exclude a couple of targets from the pre-gen process as
     making them causes files to be written to the source tree.
 .
   [ Timothy Pearson ]
   * d/patches/ppc64le:
     - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       Fix FTBFS on ppc64le systems due to FFmpeg patch update.
Checksums-Sha1:
 df54224d2f27bac5da461bf4522b98e3432efc6c 9127028 chromium-l10n_152.0.7977.75-1~deb13u1_all.deb
 991b88f51c7125e71c1c2a773f3faee2627d440d 27929 chromium_152.0.7977.75-1~deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 8535ced841032ee05407ecae36320d1b47344fefa60a7bbc3523c9f9aed2e199 9127028 chromium-l10n_152.0.7977.75-1~deb13u1_all.deb
 8e9de66fe85a887143732aaef7a51a3686eb7144406fa6a0d1e37d16711a0ca5 27929 chromium_152.0.7977.75-1~deb13u1_all-buildd.buildinfo
Files:
 14acf8ebb26f68649d63fb58fadc4dd4 9127028 localization optional chromium-l10n_152.0.7977.75-1~deb13u1_all.deb
 05d1cc6f4c170704550c5ac0b902641f 27929 web optional chromium_152.0.7977.75-1~deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmqZHngACgkQaBVi67oX
tfnAaA/+MR3TACGw/i3utiJkcSv8cRB+s8HfzFOUnsjYgKflqP89UP3tGsyHLwQx
PP42od4p6z6vHP3TBjSo3ORdXqt3OTDNhW9FbfB5F3JQctIrthaLk0HJFFpSLhmo
tYS8Xv/R00WRpFhsnbUOX8kRfeGf7RZS+fKJ4oLbsuzMi4XzOQxXx8qqsM7H7aYV
Rcb2m6kQK0JBwwHBpOuhwlkQSULDBMdwhjmWJXxp3/1AqHGAPjXmR2fLwMbzgiAF
kIGOC4WrUUxqLFTr2eJCM8l2gF7iItkQFkF38siXqG6xddHCvcja5mmO5jfR2/Wi
vflbcl4FJPR1E/+MFFW23T3nCZWxY54ewWng1CRPQ1MNImkjIvX7onzNRPodgNjV
OKQQqHZZvVQyUCuZ3f6pd7PIKsg+aFGgoWBo6u3oOZXwVBZpSBZYNDWGgyXtbyTu
r4GZjy1OIBpLrejp8BXX7MUf7cVl0OM+jNfM/aw6y77uFpU6lbsRMomlYJKh9gb6
dxXB/nm99YJflBGcEsNr3UIflAfnwzXaSIPOiwKx8OKhCo3g/GHiWJlI7FMEmUz+
m6dxUCP4feUrGEasvH2MMr3cRUrGoMziSumtD0H3wAx3rbAsfj98OsJMvpa04qjI
juM1WYoGwYZ9bTMw81VABRB8tA0FfX1Hw0SF1kslUQsQlpMdrH4=
=tLJP
-----END PGP SIGNATURE-----