-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 30 Sep 2026 03:47:05 -0400
Source: chromium
Binary: chromium-l10n
Architecture: all
Version: 154.0.8037.92-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Description:
 chromium-l10n - web browser - language packs
Changes:
 chromium (154.0.8037.92-1~deb13u1) trixie-security; urgency=high
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-102331: Buffer overflow in ANGLE. Reported by @mfx.
     - CVE-2026-102317: Improper privilege management in Mojo.
       Reported by Google.
     - CVE-2026-102312: UI misrepresentation in Omnibox.
       Reported by jodyritonga.
     - CVE-2026-102313: Uninitialized resource in ANGLE. Reported by Google.
     - CVE-2026-102299: Type confusion in V8. Reported by Andrew Boni.
     - CVE-2026-102306: Use after free in Bluetooth. Reported by Google.
     - CVE-2026-102307: Uninitialized resource in Dawn. Reported by Google.
     - CVE-2026-102323: Type confusion in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-102303: Uninitialized resource in GPU. Reported by Google.
     - CVE-2026-102311: Uninitialized resource in GPU. Reported by Google.
     - CVE-2026-102300: Uninitialized resource in WebGPU.
       Reported by Arni Hardarson (Neonix Security).
     - CVE-2026-102326: Type confusion in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-102316: Use after free in Views. Reported by Xinyang Ge.
     - CVE-2026-102304: Use after free in Passwords. Reported by Xinyang Ge.
     - CVE-2026-102328: Type confusion in V8.
       Reported by OpenAI Codex Security (amyb).
     - CVE-2026-102309: Use after free in FullScreen. Reported by sean geofrey.
     - CVE-2026-102325: Uninitialized resource in Skia. Reported by Google.
     - CVE-2026-102308: Use after free in Views. Reported by Google.
     - CVE-2026-102301: Out of bounds write in GPU. Reported by Google.
     - CVE-2026-102319: Uninitialized resource in GPU. Reported by Google.
     - CVE-2026-102324: Use after free in PictureInPicture.
       Reported by Blockian Creator of Kritt and Open-Kritt.
     - CVE-2026-102318: Out of bounds read in WebGL. Reported by Google.
     - CVE-2026-102329: Cross-site scripting in WebUI. Reported by chipsec.
     - CVE-2026-102315: Uninitialized resource in Media. Reported by Google.
     - CVE-2026-102302: Buffer overflow in V8. Reported by Google.
     - CVE-2026-102321: Type confusion in V8.
       Reported by Taisic Yun (@taisic_) of Theori, with Xint.
     - CVE-2026-102320: Missing authorization in CORS. Reported by Anonymous.
     - CVE-2026-102310: Missing authorization in Payments.
       Reported by Autodidact.
     - CVE-2026-102327: Incorrect authorization in WebView. Reported by Google.
     - CVE-2026-102330: Incorrect authorization in SiteIsolation.
       Reported by Google.
     - CVE-2026-102314: UI misrepresentation in TabStrip. Reported by Google.
     - CVE-2026-102305: UI misrepresentation in SignIn. Reported by Google.
   * d/patches:
     - disable/omnibox-ai-mode.patch: add patch that *actually* removes the
       AI Mode button from the new tab page's omnibox.
Checksums-Sha1:
 8f9b46dc178969582cb85a9390c4509c35397940 8787936 chromium-l10n_154.0.8037.92-1~deb13u1_all.deb
 8a328aa8a6d85ddca8c37ba4343a7c9d45b003e9 27975 chromium_154.0.8037.92-1~deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 8b781895f2d5feac0443501366263e26b0465665fe499da0fbbc14801816e04d 8787936 chromium-l10n_154.0.8037.92-1~deb13u1_all.deb
 d9bcd1dd3bc78b6c233dd0d15e4f9e598387688c546e10dcb2af5124e838deaa 27975 chromium_154.0.8037.92-1~deb13u1_all-buildd.buildinfo
Files:
 704b91ef195429532d0221b8cd7b00dd 8787936 localization optional chromium-l10n_154.0.8037.92-1~deb13u1_all.deb
 82b60f8cf97e64001c79686bda77761b 27975 web optional chromium_154.0.8037.92-1~deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmq97HoACgkQmgPNRvTf
/zeVaQ/+NBGoMOF5efvTWOU2K3TpMDo6IBkgYN5jyPsz/mbTpgQhC5mjdASaj+te
XcbrUb2cGrGzlQ0BD9gs376kWz5ZkI2z6zZ7a3Q4yjnYtcKS2qGpaAndGk01yoY8
Tz6IZhf1JqgA1yVbzyBtJeNHX0T6mmcZcbeMQm9tDf6UpJCT4EHLTbd2YZiv4fgG
+bBwB53JJzvlUqsBi4OrbJWgWa/VT/goR9j6mYCU39yU355t4+V97I/WZa2ufBfp
rho0j438nPG8vixl7FEn+1h3wGYZaxbz0shp+bBuKzO2crDag+R/+mb9TTohDxs2
eLDpMdg5Nj0X6+x66WN+Uo24Xt5eR1tt5uZCsUYXOHW4dSmX/MXL3/FGBdZsfCL1
EEhXrpzeIwr8ki0Om6tSu593czVKXVautuKZFIAUcpeqUMLiFi+0MIjBWSwEVeWJ
S8ZQNkBhxoKEvMuniDy7U/iWOGKC5jkaNYKkYiJOdOw2LUy6AQZyOQCPJyNePdeM
kGq8CaIgIGe4o8e/GesOlVNGcvIDwo2GiYEU3bIEj6mODlPxruQnYXpTWJuGgfud
WKP85Sr1OYgJ+3PFzQ9LEH7r4F/VAoO0y4FPwJwI6i18nz6CWJi3oX23/Q22F2X7
PsIhQveMLC/gUNAHMgR0jb17ExANTj+UaBh6fO3ba8FYErTaoCY=
=QOFX
-----END PGP SIGNATURE-----