-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 24 Sep 2026 17:31:48 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: ppc64el Version: 154.0.8037.57-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: ppc64el Build Daemon (ppc64el-conova-02) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 1135653 1146746 Changes: chromium (154.0.8037.57-1~deb13u1) trixie-security; urgency=high . [ Andres Salomon ] * New upstream stable release. - CVE-2026-95350: Buffer overflow in ANGLE. Reported by Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, Pan Zhenpeng of STAR. - CVE-2026-95357: Out of bounds write in GPU. Reported by Anymous. - CVE-2026-95339: Use after free in ServiceWorker. Reported by Andrew Boni. - CVE-2026-95281: Buffer overflow in ANGLE. Reported by Muhammad Alifa Ramdhan of STAR Labs SG Pte. Ltd. - CVE-2026-95313: Use after free in Fullscreen. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-95349: Buffer overflow in WebGL. Reported by Google. - CVE-2026-95284: Buffer overflow in ANGLE. Reported by Muhammad Alifa Ramdhan (STARLABS SG). - CVE-2026-95322: Out of bounds write in GPU. Reported by David Sievers (@loknop). - CVE-2026-95329: Out of bounds write in WebGL. Reported by Google. - CVE-2026-95356: Use after free in WindowDialog. Reported by Xinyang Ge. - CVE-2026-95310: Use after free in AdFilter. Reported by Xinyang Ge. - CVE-2026-95301: Missing authorization in Extensions. Reported by OGINOME Tomohito. - CVE-2026-95291: UI misrepresentation in SecurityIndicators. Reported by NH DEV. - CVE-2026-95355: Incorrect authorization in Navigation. Reported by Google. - CVE-2026-95315: Use after free in Aura. Reported by Google. - CVE-2026-95298: Use after free in Browser. Reported by Google. - CVE-2026-95372: Use after free in Chromecast. Reported by Google. - CVE-2026-95324: Uninitialized resource in GPU. Reported by Google. - CVE-2026-95283: Buffer overflow in Tint. Reported by Google. - CVE-2026-95293: Uninitialized resource in GPU. Reported by TienPA - NGS Holdings. - CVE-2026-95274: Improper output encoding in DevTools. Reported by Google. - CVE-2026-95282: Use after free in Platform. Reported by Google. - CVE-2026-95373: Use after free in DevTools. Reported by Google. - CVE-2026-95277: Use after free in Views. Reported by Google. - CVE-2026-95348: Use after free in Bluetooth. Reported by Google. - CVE-2026-95335: Use after free in HID. Reported by WinD39 - Huynh Dinh Vu. - CVE-2026-95338: Use after free in PDFium. Reported by SeungMyung Lee (@sm1ee), Siung kim (@ksw9722). - CVE-2026-95318: Buffer overflow in Video. Reported by alex.laboirie. - CVE-2026-95286: Type confusion in Bindings. Reported by @bean5oup. - CVE-2026-95365: Type confusion in IndexedDB. Reported by HoneyBee. - CVE-2026-95343: Use after free in WebAudio. Reported by HoneyBee. - CVE-2026-95280: Race condition in V8. Reported by Google. - CVE-2026-95304: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-95306: Type confusion in V8. Reported by OpenAI Codex Security (amyb). - CVE-2026-95299: Use after free in GPU. Reported by Google. - CVE-2026-95351: Use after free in Views. Reported by Xinyang Ge. - CVE-2026-95287: Missing authorization in Navigation. Reported by Google - CVE-2026-95366: Use of released resource in Core. Reported by Google. - CVE-2026-95382: Improper input validation in Auth. Reported by Google. - CVE-2026-95381: Improper input validation in Printing. Reported by Google. - CVE-2026-95331: Out of bounds write in ANGLE. Reported by Google. - CVE-2026-95297: Missing authorization in Contextual Tasks. Reported by Google. - CVE-2026-95375: Incorrect authorization in BrowserTag. Reported by Google. - CVE-2026-95302: Incorrect authorization in WebAPKs. Reported by Google. - CVE-2026-95362: Cross-site request forgery in DevTools. Reported by Google. - CVE-2026-95369: Inappropriate implementation in XML. Reported by Google - CVE-2026-95376: Externally controlled reference in DevTools. Reported by Google. - CVE-2026-95359: Uninitialized resource in GPU. Reported by Google. - CVE-2026-95294: UI misrepresentation in Browser. Reported by Google. - CVE-2026-95337: UI misrepresentation in Messages. Reported by Google. - CVE-2026-95346: UI misrepresentation in Chromoting. Reported by Google. - CVE-2026-95320: Missing authorization in Navigation. Reported by Google - CVE-2026-95317: Incorrect authorization in MediaCapture. Reported by Google. - CVE-2026-95345: Use after free in Actor. Reported by Google. - CVE-2026-95330: Improper state validation in Downloads. Reported by Google. - CVE-2026-95370: Inappropriate implementation in NFC. Reported by Google - CVE-2026-95303: Incomplete cleanup in SmartCard. Reported by Google. - CVE-2026-95360: Race condition in Editing. Reported by Google. - CVE-2026-95295: Information leak in Mobile. Reported by Google. - CVE-2026-95276: Improper input validation in Themes. Reported by Google - CVE-2026-95314: Incorrect authorization in HID. Reported by Google. - CVE-2026-95371: Missing authorization in Views. Reported by Google. - CVE-2026-95353: Use after free in Bindings. Reported by Google. - CVE-2026-95363: UI misrepresentation in FileSystem. Reported by Google. - CVE-2026-95341: Improper input validation in Desktop. Reported by Google. - CVE-2026-95354: Use after free in Verifier. Reported by Google. - CVE-2026-95384: Race condition in Transactions Platform. Reported by Google. - CVE-2026-95336: Information leak in Transactions Platform. Reported by Google. - CVE-2026-95290: Missing authorization in NFC. Reported by Google. - CVE-2026-95325: Use after free in ANGLE. Reported by Google. - CVE-2026-95275: Incorrect reference resolution in MediaStream. Reported by Zabith Mohammed (@nmzabith). - CVE-2026-95374: Incorrect authorization in Network. Reported by NH DEV. - CVE-2026-95300: Missing authorization in DevTools. Reported by Google. - CVE-2026-95321: UI misrepresentation in Payments. Reported by jodyritonga. - CVE-2026-95323: UI misrepresentation in Chromium. Reported by Wihdatu Nuuro Ahmadi. - CVE-2026-95332: Use of uninitialized variable in Tint. Reported by Google. - CVE-2026-95312: Information leak in Passwords. Reported by Google. - CVE-2026-95344: Race condition in DevTools. Reported by @bean5oup. - CVE-2026-95289: Incorrect authorization in Scroll. Reported by Vu Van Tien (@n0_Be3r). - CVE-2026-95347: Use after free in Updater. Reported by a45hif. - CVE-2026-95311: Free of non-heap memory in Fonts. Reported by Google. - CVE-2026-95358: Incorrect authorization in Mobile. Reported by Google. - CVE-2026-95333: Use after free in Metrics. Reported by sean geofrey. - CVE-2026-95307: UI misrepresentation in ExtensionsMenu. Reported by Hafiizh. - CVE-2026-95285: Missing authorization in WebView. Reported by Google. - CVE-2026-95278: Missing authorization in WakeLock. Reported by Google. - CVE-2026-95327: Information leak in Networking. Reported by Google. - CVE-2026-95334: Incorrect reference resolution in WebProtect. Reported by Google. - CVE-2026-95308: Integer overflow in Metrics. Reported by Google. - CVE-2026-95292: Incorrect authorization in Safebrowsing. Reported by Google. - CVE-2026-95352: Incorrect authorization in DevTools. Reported by Google - CVE-2026-95279: UI misrepresentation in Omnibox. Reported by Google. - CVE-2026-95367: Information leak in DataTransfer. Reported by Google. - CVE-2026-95385: Inappropriate implementation in PlatformIntegration. Reported by Google. - CVE-2026-95368: Incorrect authorization in DevTools. Reported by Google - CVE-2026-95319: Use after free in Printing. Reported by Google. - CVE-2026-95326: Incomplete cleanup in Bluetooth. Reported by Google. - CVE-2026-95309: UI misrepresentation in Mobile. Reported by Google. - CVE-2026-95361: Confused deputy in DevTools. Reported by Google. - CVE-2026-95288: UI misrepresentation in Mobile. Reported by Google. - CVE-2026-95380: Type confusion in V8. Reported by Google. - CVE-2026-95342: Missing authorization in V8. Reported by Hongwei Li, Zhun Wang, Ziyue Pan, Junmin Zhu, Saastha Vasan, and Wenbo Guo. - CVE-2026-95296: Missing authorization in Core. Reported by Quyền Sơn (@zer0qs1337). - CVE-2026-95316: Unchecked return value in Performance. Reported by Google. - CVE-2026-95328: Confused deputy in Mobile. Reported by Google. - CVE-2026-95340: Incorrect authorization in PictureInPicture. Reported by Google. - CVE-2026-95364: Improper input validation in Passwords. Reported by Google. - CVE-2026-95305: UI misrepresentation in Chromoting. Reported by Google. * d/control: - remove generate-ninja build-dep. - stop recommending chromium-sandbox (closes: #1135653). * d/copyright: stop deleting tools/gn/. * d/rules: restore old code that builds the bundled version of generate-ninja as part of the chromium build. Upstream keeps using brand new gn features (sometimes not even available in sid yet) and we're carrying too many patches to work around that. * d/patches: - debianization/pre-gen.patch: rework clang argument filtering due to upstream changes. - disable/tests.patch: refresh. - disable/catapult.patch: refresh. - llvm-22/clang22.patch: refresh. - ungoogled/disable-ai.patch: sync from u-c - ungoogled/disable-mei-preload.patch: sync from u-c - ungoogled/disable-privacy-sandbox.patch: sync from u-c - fixes/crubit.patch: drop - system/rust-cbor.patch: drop - ungoogled/crubit.patch: add a patch pulled from u-c, which includes stuff from fixes/crubit.patch and system/rust-cbor.patch.. plus more. - ungoogled/verification-tokens.patch: add a patch pulled from u-c to fix a build failure related to private verification tokens. Two week release cycle is awesomesauce. - fixes/tsc-split-comp.patch: add a build fix for debian's typescript. - ungoogled/disable-ai-search-shortcuts.patch: add patch to disable the new AI button and the @gemini/@aimode shortcuts (closes: #1146746). - trixie/gn-string-hash.patch: drop, no longer needed with bundled gn. - trixie/gn-len.patch: drop, no longer needed with bundled gn [trixie, bookworm]. - trixie/gn-module-name.patch: drop, no longer needed with bundled gn [trixie, bookworm]. - trixie/gn-unused-vars.patch: drop, no longer needed with bundled gn [trixie, bookworm]. - trixie/gn-funcs.patch: drop, no longer needed with bundled gn [trixie, bookworm]. - bookworm/gn-revert-path-exists.patch: drop, no longer needed with bundled gn. - bookworm/foreach.patch: drop, no longer needed with newer clang [sid, trixie]. . [ Timothy Pearson ] * d/patches/ppc64le: - fixes/fix-rust-linking.patch: refresh for upstream changes - third_party/0002-regenerate-xnn-buildgn.patch: refresh for upstream changes - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch: refresh for upstream changes . [ Daniel Richard G. ] * d/deb_pre_gen.py: Handle new arg signature of generate_css_js_files.js, and the new run_with_restat.py script; also streamline regexes a bit. * d/patches: - debianization/pre-gen.patch: Handle run_with_restat.py script, and neuter run_with_stamp.py. - trixie/gn-unused-vars.patch: Refresh. * d/rules: Set njobs for the init-pre-gen target for a faster GN build. . [ Jianfeng Liu ] * d/patches: loongarch64/0020-user_agent-add-loongarch-architecture-support.patch: refresh for upstream changes Checksums-Sha1: b4846841a37138caa69f412aacbaee78159b5c52 2818016 chromium-common-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 5683dc629020ecf566f3f46ddf207708743b2026 36450716 chromium-common_154.0.8037.57-1~deb13u1_ppc64el.deb cb4314e9914e38dc18e20234141b7dbc2f59bd54 29206716 chromium-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 53cc4038b4f4e8e9406be0fab47cb283c447f389 8191100 chromium-driver_154.0.8037.57-1~deb13u1_ppc64el.deb bb038166f3d7eb03a27c35b0a11c471e40efa36e 23207392 chromium-headless-shell-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 80f85c4d1e8b8d82ddd9ad67cd4773ea6502f314 63696728 chromium-headless-shell_154.0.8037.57-1~deb13u1_ppc64el.deb 4f5846ea7692e680f7510b24f1b36ad51189dd45 19720 chromium-sandbox-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb d044df0872634246b16d594ca4a22dd0555fe0c0 151280 chromium-sandbox_154.0.8037.57-1~deb13u1_ppc64el.deb de606a73cd993aa89842ea8cc660043df6f3e043 24250372 chromium-shell-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 7035f82e5c800a4b7ffaadd846b2f094eba8c79b 63207100 chromium-shell_154.0.8037.57-1~deb13u1_ppc64el.deb 6ee081c8793cf2ee2a153884d1933cab6877e97b 31404 chromium_154.0.8037.57-1~deb13u1_ppc64el-buildd.buildinfo b2a88bbb10573c5fc1fdb96534097042503ed573 87524920 chromium_154.0.8037.57-1~deb13u1_ppc64el.deb Checksums-Sha256: bc4b8ad606a545f7f4a78db3a62d3790dc89ff47129f9e56a4df5591c833641d 2818016 chromium-common-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 936e6f83026b4aa85dde40dc97f9600597186d81ad346699f5f59ee0513115db 36450716 chromium-common_154.0.8037.57-1~deb13u1_ppc64el.deb 91662b3b26fbd6c31459e537481348fec4fa95b29aaa2e11d4155ad715905ff7 29206716 chromium-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 077fad8544d0b1dda7eaf38938c494fbdb1a5cc9c40630db37dbf4b671da1df8 8191100 chromium-driver_154.0.8037.57-1~deb13u1_ppc64el.deb 2d48176a1bb9d58251263a8d0dc17fc4b1b59a344e06e42f8dbd34b6ad306343 23207392 chromium-headless-shell-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 553882ae66bfce152666a63e5398b79da1293932af6cee73329b9184bf436eef 63696728 chromium-headless-shell_154.0.8037.57-1~deb13u1_ppc64el.deb ab3b0365df062a7ed9e2c9280df319a0b0bb7b4dc7b0f0dabc25af00f1c393df 19720 chromium-sandbox-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb ef7588862dace83129d237fa9396b0fbb78a6b3c1df75ba9a3c3c64085b890a9 151280 chromium-sandbox_154.0.8037.57-1~deb13u1_ppc64el.deb 3594f2b8d0e95f94fc1f4b993b153cb5932558a38cdd58b7b1e4b6e0529ca398 24250372 chromium-shell-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 26849eba45717f831ae923f1519397d45436a32081af98462ad538773671774a 63207100 chromium-shell_154.0.8037.57-1~deb13u1_ppc64el.deb 60ca7986478be948c2fb5f223bfaa0964c378c0fd34ae3591977f93bf99eb87a 31404 chromium_154.0.8037.57-1~deb13u1_ppc64el-buildd.buildinfo 3197ad3ebc2d7f174dc1a9c72a0cfe58bf167d69b8e60d7733d8fc92e844709a 87524920 chromium_154.0.8037.57-1~deb13u1_ppc64el.deb Files: 3130a667b00ad40ca5d1aca0c90af4a1 2818016 debug optional chromium-common-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb a9d119c60349aebf28a29963d692b88b 36450716 web optional chromium-common_154.0.8037.57-1~deb13u1_ppc64el.deb 0dc795d8889cfc33b73ca7fda14b9f6f 29206716 debug optional chromium-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 573e932b4a1095d83ca33075abd7b19e 8191100 web optional chromium-driver_154.0.8037.57-1~deb13u1_ppc64el.deb 5754a99d6d0280f6788873d70e3994be 23207392 debug optional chromium-headless-shell-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb f722cd6df12a02a6e4cce5c171ec1f35 63696728 web optional chromium-headless-shell_154.0.8037.57-1~deb13u1_ppc64el.deb 0dead081eb7701c42d720f575f7c39e3 19720 debug optional chromium-sandbox-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb 31248b81538e26eeef286ccf147d96a4 151280 web optional chromium-sandbox_154.0.8037.57-1~deb13u1_ppc64el.deb 522eaa3225f91e787d3e7ff6757f5bd0 24250372 debug optional chromium-shell-dbgsym_154.0.8037.57-1~deb13u1_ppc64el.deb e8d3a461c07bbfe4b06016e46bf08c67 63207100 web optional chromium-shell_154.0.8037.57-1~deb13u1_ppc64el.deb a4b58df70a6962d077980130f0d6ca10 31404 web optional chromium_154.0.8037.57-1~deb13u1_ppc64el-buildd.buildinfo a4134904fa06a3b31ac60059f317bffc 87524920 web optional chromium_154.0.8037.57-1~deb13u1_ppc64el.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEySUEQfg5pZeb/U372FRWNm40e2YFAmq21+EACgkQ2FRWNm40 e2aozxAAl/Avr+UZLPd4SglkWzHmkRYRmhBN7sLZ119tJeR+aYYvbr10llFWQF1P hHYLAg72P062H6Llky1wqpauigEbjO90SJVKuJl4iwZ6XLXQBQquv1tHqrFoqc2+ yLT0ke6WWUp40iBFSCWSMKrYzXJXdaHFfCnSpjbUf87bzZlI9r9MEL89C8fxIYPD ahEQECfxNuA1fHvpHp6ElnBrBUeZ4rAVGnOeRDG5DMVSqHdNPi6T+0Qz+Dk5jWQY zQY0u40Lj6JyMcCiyvJpofjslcVyBaYFKayIkVORKARxIPzmg0+4T8AEpvjN6abT cywZhrQU0hJIuibM9uGcLXnFxN/+SwiTYyxcaOZ5DJw9nWF8k3ULgjPT7uDZopmo fe8sAr50DVC5Mwr3qM0p7PL5yqwbQ+M9sYBfRB1PPuw8nPT89zdT9q0h4z6obqVd ExPqqXltNHPJI9vxHEQhf5SW2+oVbOUrtVBpWOY+pu6ESRVH6UvOQW5J6umuaQ9x cw64BRjGmfuGISH3A2XQtx+6+J7AB/laz3pSeeh48ARXb+vZ0MaVsQMvb2yjXpTO qsS7bjn4cUvc/RyRPfIuXrh/XKE3n8ANVmWC0KZohq4lIlPYVxKxsYvKrSZobfBS iggVJF9czXQYMUeC5g1D1iCPAIHhXv83nDFLS8ihHPswF8qpNhY= =MkWi -----END PGP SIGNATURE-----