-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 07 Aug 2026 12:19:50 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: i386 Version: 151.0.7922.108-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Changes: chromium (151.0.7922.108-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/deb_pre_gen.py: Minor fixes to the pre-gen framework: - Always record target outputs in an .OUTPUTS file, even if a target has only a single output. This incurs only a small (tarball) size penalty, and catches cases where there is disagreement on which is the first output file of a .ninja target. - Update the handling logic for generate_css_js_files.js, as the first output file of the .ninja target changed from v150. - Add an extra check to ensure that target outputs are unique. * d/patches/debianization/pre-gen.patch: Tweak a script so that it outputs a constant UUID, instead of one dependent on the build path. * d/patches/system/golang.patch: Prevent the Go compiler from writing things into our home dir, or accessing the network. * d/scripts/init-pre-gen.sh: Don't hard-code the package name, as we might be doing init-pre-gen for ungoogled-chromium. . [ Andres Salomon ] * New upstream security release. - CVE-2026-19137: Use after free in WebGL. Reported by anonymous. - CVE-2026-19149: Use after free in Aura. Reported by Google. - CVE-2026-19154: Use after free in Skia. Reported by Google. - CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. - CVE-2026-19172: Use after free in Views. Reported by Google. - CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@svn-dys). - CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg. - CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google. - CVE-2026-19139: Race in CredentialProvider. Reported by Google. - CVE-2026-19140: Use after free in GPU. Reported by Google. - CVE-2026-19141: Use after free in Resources. Reported by Google. - CVE-2026-19142: Use after free in Views. Reported by Google. - CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs. Reported by Google. - CVE-2026-19144: Use after free in HTML. Reported by Google. - CVE-2026-19145: Use after free in Translate. Reported by Google. - CVE-2026-19146: Uninitialized Use in GPU. Reported by Google. - CVE-2026-19147: Use after free in Aura. Reported by Google. - CVE-2026-19148: Out of bounds write in GPU. Reported by Google. - CVE-2026-19150: Inappropriate implementation in V8. Reported by Google. - CVE-2026-19151: Use after free in V8. Reported by Google. - CVE-2026-19152: Inappropriate implementation in Navigation. Reported by Google. - CVE-2026-19153: Insufficient validation of untrusted input in Workers. Reported by Google. - CVE-2026-19155: Use after free in Payments. Reported by Google. - CVE-2026-19156: Heap buffer overflow in Base. Reported by Viktoria Zlatinova. - CVE-2026-19158: Use after free in Views. Reported by Google. - CVE-2026-19159: Use after free in Views. Reported by Google. - CVE-2026-19160: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19161: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19162: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-19163: Use after free in Media. Reported by Google. - CVE-2026-19164: Insufficient validation of untrusted input in Codecs. Reported by Google. - CVE-2026-19165: Use after free in Extensions. Reported by @bean5oup. - CVE-2026-19166: Use after free in Web Authentication. Reported by heesun. - CVE-2026-19167: Integer overflow in GPU. Reported by Google. - CVE-2026-19171: Use after free in Media. Reported by Google. - CVE-2026-19173: Out of bounds write in Skia. Reported by Vu Van Tien (@n0_Be3r). - CVE-2026-19174: Integer overflow in V8. Reported by Seunghyun Lee (@0x10n) of QED Audit (qedaudit.io). - CVE-2026-19175: Use after free in Payments. Reported by Google. - CVE-2026-19176: Use after free in Skia. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-19177: Insufficient validation of untrusted input in UI. Reported by Fabian Wahle (Hap Security). Checksums-Sha1: 264442b71802044d8298667a7d6c1e0c588efe69 4658056 chromium-common-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 41566931b1de3b9552ba420276ef7ed04b444f1c 29738044 chromium-common_151.0.7922.108-1~deb13u1_i386.deb 23047148d1e47ca941fc3af6ebc321cdc502e9c5 37233840 chromium-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 556482069781ba394dec65131cdefba0ad5abffb 8273100 chromium-driver_151.0.7922.108-1~deb13u1_i386.deb dd2a5973b93a7b3c5ace8a1e5287c8831456f7f8 30566520 chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 9c2daeccc3b15e31f853c92f28e2523701b01209 61678272 chromium-headless-shell_151.0.7922.108-1~deb13u1_i386.deb 75c297ab8ccfae1b5e206e930670468315cd7afb 18972 chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_i386.deb e35b1d4e3b41212b886420bdbe92aa254a23806a 137884 chromium-sandbox_151.0.7922.108-1~deb13u1_i386.deb ba8fe5af50214c4d4cfd4d2f6dfa6902ed55dbef 33515264 chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 38d7d3380508c022366c7c9118d6d073945d1d3d 67764024 chromium-shell_151.0.7922.108-1~deb13u1_i386.deb a9993de8616b33092f3fe51c1883ddf8fcfac77c 31109 chromium_151.0.7922.108-1~deb13u1_i386-buildd.buildinfo 653243f9d94f26df02642ffddff3aed807470088 81457492 chromium_151.0.7922.108-1~deb13u1_i386.deb Checksums-Sha256: d81f7f3ddecec84014143d748312137c2fa082b01652157fa7cf61b7f18eca9a 4658056 chromium-common-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 23c4a5f8079d88cdbfee001faded3b8b40821e88c155a85bf4b848af12a78206 29738044 chromium-common_151.0.7922.108-1~deb13u1_i386.deb 0d988b8b70c22ca3f1adf910472137c0846295ce2cc0525b9bdcc5f941c2d53a 37233840 chromium-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 23463b8a6e0241e0f7a63b378b04113f0fea6b3db6e7ec31040af5cbffc23380 8273100 chromium-driver_151.0.7922.108-1~deb13u1_i386.deb 0d97a5b1697c704905a9f693d29417bda151fe45f84863beae6b8c0180337f5f 30566520 chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_i386.deb d6f68aaa5b4b12347da64b3705d162f66708a6472b1a92b22e7ab43e18d7797f 61678272 chromium-headless-shell_151.0.7922.108-1~deb13u1_i386.deb 2a9b9b0fbe2865b6cf5d4d420253fd379def419158c6a3a77ea5dee3759fe696 18972 chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_i386.deb a90fce5bcbc70a0de1adfff4cb0a10359e89f811183154127927c21aeae59b6e 137884 chromium-sandbox_151.0.7922.108-1~deb13u1_i386.deb 186d172c989d8e740d89d3ff67dd93f5563945c8963439301508e5834f848d41 33515264 chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 6940e22faa1a57c0e918463725e1e903f379c252f5aa34d800d653b7a22cbfda 67764024 chromium-shell_151.0.7922.108-1~deb13u1_i386.deb 3a6da7a54a6ba626397d6200c3ec5966ccc9e5b379b1d084176c67b6c4bcb6c7 31109 chromium_151.0.7922.108-1~deb13u1_i386-buildd.buildinfo 9d10d7631c6c6ec42c953ac76f7f9efa9d6b7eddcebd3a4293f4859be9338aca 81457492 chromium_151.0.7922.108-1~deb13u1_i386.deb Files: 14044de17fd23d49fec9f0f082a50512 4658056 debug optional chromium-common-dbgsym_151.0.7922.108-1~deb13u1_i386.deb a2895b75c89c86848c6a4a312a0b8993 29738044 web optional chromium-common_151.0.7922.108-1~deb13u1_i386.deb f93c64fcfdf92f2aa7b816e9e265e63e 37233840 debug optional chromium-dbgsym_151.0.7922.108-1~deb13u1_i386.deb 4992cc00a46b8154829b466c542c16d4 8273100 web optional chromium-driver_151.0.7922.108-1~deb13u1_i386.deb c1fb93da5151279ccb1a72b70da962fd 30566520 debug optional chromium-headless-shell-dbgsym_151.0.7922.108-1~deb13u1_i386.deb b93175b1fbb30728ca70977bef57790f 61678272 web optional chromium-headless-shell_151.0.7922.108-1~deb13u1_i386.deb 3f7fc726b9890cbfe83e22c7cb3b4162 18972 debug optional chromium-sandbox-dbgsym_151.0.7922.108-1~deb13u1_i386.deb af43fb62f3504fe03cf76805ff937c82 137884 web optional chromium-sandbox_151.0.7922.108-1~deb13u1_i386.deb 248bcad31e4787902b98a61c2bbb4198 33515264 debug optional chromium-shell-dbgsym_151.0.7922.108-1~deb13u1_i386.deb d3575331ec3fa24a6ae3b6b511f6ac2d 67764024 web optional chromium-shell_151.0.7922.108-1~deb13u1_i386.deb 41c3d103bdd0e747aa70048e9b2d1d3f 31109 web optional chromium_151.0.7922.108-1~deb13u1_i386-buildd.buildinfo 64d99adf5a3ea632c71325e2d4fdcf69 81457492 web optional chromium_151.0.7922.108-1~deb13u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmp3414ACgkQbheoBegw XLIbvxAAhvg4e8cyX076PzYS1qcORta5MTLCP26X6BOHfX3VLLz97lTPXn3hnRx2 pO3LfAXVncXM4EqLqnQRsBkUUNu9rL488yDqAb3PhhemNEsc6HAa37ZIfyaN8IrW hmYlJTBFdVVdbdiU+s5hmOQFTN7Y+p77t/VFFm8Dgac6hN1knKkq4nUtWdcPZhVg DAhNHMC2i4mvjSdsSHIZGLycnxbVNAFHGspRa6vMxmjCl7ECXauH/9XWbpvVe0Kj BPE86bSbyoITYl+9PxtE3fNWfv+aHYeVNPXgVYGo7KZ8uTYc7G5bsgQ9wz6maZFl TcL+jG1y7fYz7CGGLS5woB3vW8fl+k82R3p1z+w5w6+9xLuvn8pnMYZ7NahZf1cq 9JOjlKiOY51Rc86gs/0RyTFzaf1R89MZ0+NGXsi80MX3CCXQE4dI5T3zYlKG4DqM w/JpxJV1xEpWCaKsnlYMwCZAtW9gx+AQWxKYPdBsA+uBqrKVEGRarBYr+LZ70Sr5 1ktF3ree6NBy9NpcqPGzjz5JbGDGdFG/Y4XW87Slv7SN+xnz52AMuJ35AChS/uSW LO8y0LCPk8p9a7CEgzV1LuaNvLdf42+hDXUpmrBMhdNNYD8wHqVwxJqIDdWdzvgA pduAekH5sK1+24XKbDmjZypqHXyuSdQnPa9VXv5a4tluUX4Dxxs= =WxRv -----END PGP SIGNATURE-----