-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 07 Aug 2026 12:19:50 -0400 Source: chromium Binary: chromium-l10n Architecture: all Version: 151.0.7922.108-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-csail-02) Changed-By: Andres Salomon Description: chromium-l10n - web browser - language packs Changes: chromium (151.0.7922.108-1~deb13u1) trixie-security; urgency=high . [ Daniel Richard G. ] * d/deb_pre_gen.py: Minor fixes to the pre-gen framework: - Always record target outputs in an .OUTPUTS file, even if a target has only a single output. This incurs only a small (tarball) size penalty, and catches cases where there is disagreement on which is the first output file of a .ninja target. - Update the handling logic for generate_css_js_files.js, as the first output file of the .ninja target changed from v150. - Add an extra check to ensure that target outputs are unique. * d/patches/debianization/pre-gen.patch: Tweak a script so that it outputs a constant UUID, instead of one dependent on the build path. * d/patches/system/golang.patch: Prevent the Go compiler from writing things into our home dir, or accessing the network. * d/scripts/init-pre-gen.sh: Don't hard-code the package name, as we might be doing init-pre-gen for ungoogled-chromium. . [ Andres Salomon ] * New upstream security release. - CVE-2026-19137: Use after free in WebGL. Reported by anonymous. - CVE-2026-19149: Use after free in Aura. Reported by Google. - CVE-2026-19154: Use after free in Skia. Reported by Google. - CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. - CVE-2026-19172: Use after free in Views. Reported by Google. - CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@svn-dys). - CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg. - CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google. - CVE-2026-19139: Race in CredentialProvider. Reported by Google. - CVE-2026-19140: Use after free in GPU. Reported by Google. - CVE-2026-19141: Use after free in Resources. Reported by Google. - CVE-2026-19142: Use after free in Views. Reported by Google. - CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs. Reported by Google. - CVE-2026-19144: Use after free in HTML. Reported by Google. - CVE-2026-19145: Use after free in Translate. Reported by Google. - CVE-2026-19146: Uninitialized Use in GPU. Reported by Google. - CVE-2026-19147: Use after free in Aura. Reported by Google. - CVE-2026-19148: Out of bounds write in GPU. Reported by Google. - CVE-2026-19150: Inappropriate implementation in V8. Reported by Google. - CVE-2026-19151: Use after free in V8. Reported by Google. - CVE-2026-19152: Inappropriate implementation in Navigation. Reported by Google. - CVE-2026-19153: Insufficient validation of untrusted input in Workers. Reported by Google. - CVE-2026-19155: Use after free in Payments. Reported by Google. - CVE-2026-19156: Heap buffer overflow in Base. Reported by Viktoria Zlatinova. - CVE-2026-19158: Use after free in Views. Reported by Google. - CVE-2026-19159: Use after free in Views. Reported by Google. - CVE-2026-19160: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19161: Uninitialized Use in Skia. Reported by Google. - CVE-2026-19162: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-19163: Use after free in Media. Reported by Google. - CVE-2026-19164: Insufficient validation of untrusted input in Codecs. Reported by Google. - CVE-2026-19165: Use after free in Extensions. Reported by @bean5oup. - CVE-2026-19166: Use after free in Web Authentication. Reported by heesun. - CVE-2026-19167: Integer overflow in GPU. Reported by Google. - CVE-2026-19171: Use after free in Media. Reported by Google. - CVE-2026-19173: Out of bounds write in Skia. Reported by Vu Van Tien (@n0_Be3r). - CVE-2026-19174: Integer overflow in V8. Reported by Seunghyun Lee (@0x10n) of QED Audit (qedaudit.io). - CVE-2026-19175: Use after free in Payments. Reported by Google. - CVE-2026-19176: Use after free in Skia. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-19177: Insufficient validation of untrusted input in UI. Reported by Fabian Wahle (Hap Security). Checksums-Sha1: da25b5927c493fe15968f8dc97ea2df63e9e26dd 8959828 chromium-l10n_151.0.7922.108-1~deb13u1_all.deb e5e50209fd6322f677a927d2c7d5d4a82a448a7e 27661 chromium_151.0.7922.108-1~deb13u1_all-buildd.buildinfo Checksums-Sha256: c2fd0da64d7421b6a1c4401ac209f2aa0b72d65efa2b29aa277d27261e729d03 8959828 chromium-l10n_151.0.7922.108-1~deb13u1_all.deb 30e7cfc99c661f72befe346a3f336c512b066c050edcb7f90f2e6f44ae73ebb8 27661 chromium_151.0.7922.108-1~deb13u1_all-buildd.buildinfo Files: ade0f626518f7c8daa324ac3e120fb7e 8959828 localization optional chromium-l10n_151.0.7922.108-1~deb13u1_all.deb b6811c689ce256ec75bb8d7db67cd594 27661 web optional chromium_151.0.7922.108-1~deb13u1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmp3ZacACgkQaBVi67oX tfnTvg/5AYja2IFZ4Wxo4sIpBOGGQCwQsXzCUgISQSjGAEccWElbONavSTWZiImx rVWNLSFyBvIb+5XKhh/z7GMFORmDXWpudqYBy9vM9yys50bAL20BB/9hfCe6ONLy mTuHpaBMYXXna6RvWZkE9Iw1iylVmJ2BaEMVufzY3H+I4xWloWiBlH5R/Uu9qe/Y Gfsfx0zeTqOQadegUSKw3W2Rt6PgWJrDhl9JtfaQzvSLtWzvnWDlnlFVoIgSs8vf bN6A4i42VUsulH9S/3/loARsvKRR1mjxes0xCkHAUD9VNVHNc1FF9FSjLb6jWQRN 59lYNHdegq+QJWwaGcMdw/UBnchmnHjPBAXmFS9EAn77w++F8D2A524zaA9U4sTU iNmZODWGQ2ViK7FSUDFuGBkbwj9yGcGwOz54+jpyeseDN46kaCHD+2FvVOvDq2np oAleIIWkrfEh+hqlxSXxmZRSf/9ZHrmWQsMXeONpNf75uOjI+Af7y3+UaY1LJ+To ZDeVfGCSObxChfYRjNtKdnUEPjXHEZrMHUUj4U/ALNLJeKpnM+9gMJ6FZNNeAXWb bRiCNSdkH4vbgWeiGQKInvfl7OX2Fp4qWPM9TyLlDQK2RDrh2MY8zxIemWJT9Qlk 9hca0BAmapp+2h75Ot1Av6/CAPskE9IR6OuoOqsEgr8KEfII83w= =nLQE -----END PGP SIGNATURE-----