-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 29 Apr 2026 04:36:38 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: i386 Version: 147.0.7727.137-1~deb12u1 Distribution: bookworm-security Urgency: high Maintainer: amd64 / i386 Build Daemon (x86-csail-01) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 1052440 Changes: chromium (147.0.7727.137-1~deb12u1) bookworm-security; urgency=high . [ Andres Salomon ] * New upstream security release. - CVE-2026-7363: Use after free in Canvas. Reported by heapracer. - CVE-2026-7361: Use after free in iOS. Reported by Google. - CVE-2026-7344: Use after free in Accessibility. Reported by Google. - CVE-2026-7343: Use after free in Views. Reported by Google. - CVE-2026-7333: Use after free in GPU. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-7360: Insufficient validation of untrusted input in Compositing. Reported by Google. - CVE-2026-7359: Use after free in ANGLE. Reported by Google. - CVE-2026-7358: Use after free in Animation. Reported by Google. - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ. - CVE-2026-7357: Use after free in GPU. Reported by Google. - CVE-2026-7356: Use after free in Navigation. Reported by Google. - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google. - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google. - CVE-2026-7352: Use after free in Media. Reported by Google. - CVE-2026-7351: Race in MHTML. Reported by Google. - CVE-2026-7350: Use after free in WebMIDI. Reported by Google. - CVE-2026-7349: Use after free in Cast. Reported by Google. - CVE-2026-7348: Use after free in Codecs. Reported by Google. - CVE-2026-7335: Use after free in media. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po). - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla. - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io. - CVE-2026-7347: Use after free in Chromoting. Reported by Google. - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google. - CVE-2026-7345: Insufficient validation of untrusted input in Feedback. Reported by Google. - CVE-2026-7338: Use after free in Cast. Reported by Krace. - CVE-2026-7342: Use after free in WebView. Reported by Google. - CVE-2026-7341: Use after free in WebRTC. Reported by Google. - CVE-2026-7339: Heap buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-7340: Integer overflow in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32. - CVE-2026-7355: Use after free in Media. Reported by Google. . [ Jianfeng Liu ] * d/patches: - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch: Fixes upstream issue https://crbug.com/501115509. This issue is introduced in v147, and unfortunately the fix won't get into v147. This issue affects both vaapi and v4l2 decoding under ozone wayland. - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine support on arm64. There is no official support for widevine on arm64 linux while there are libwidevine binaries extracted from chromeos, which can work on linux (closes: #1052440). Checksums-Sha1: 94a37889c3863120338f223740f70e7fe59b8c53 5293612 chromium-common-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 94a6e87200c402d965ce5b5ddab9f43089f3ad4e 25388752 chromium-common_147.0.7727.137-1~deb12u1_i386.deb 7d8c572fde61975f08f98ad8ef581bc4c05dbef7 35899036 chromium-dbgsym_147.0.7727.137-1~deb12u1_i386.deb e9f4d3879462cbb1edb9e729bb1536248c3d717e 7873640 chromium-driver_147.0.7727.137-1~deb12u1_i386.deb 1cff2181495ff842377c42636f9c6b3070c983cf 29651392 chromium-headless-shell-dbgsym_147.0.7727.137-1~deb12u1_i386.deb d21ace9e8f48d9957dac5372e8af7e773d86282d 58738672 chromium-headless-shell_147.0.7727.137-1~deb12u1_i386.deb 5f7af5fe3052002346b72bc3caf7d8183ec87a9d 17824 chromium-sandbox-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 854aa60864a9e287e27290a3554bf84fff7c7c5b 116668 chromium-sandbox_147.0.7727.137-1~deb12u1_i386.deb 6e05d84eab02a1e20ea7a6abfdc25da3ad7ef0dd 32466164 chromium-shell-dbgsym_147.0.7727.137-1~deb12u1_i386.deb e8fd10ff6fa0baf47e3dfce7b44944aa45e9e178 64114100 chromium-shell_147.0.7727.137-1~deb12u1_i386.deb ef4593c81b0d668ee29a3bd14321f32493666f48 30404 chromium_147.0.7727.137-1~deb12u1_i386-buildd.buildinfo fe60f8f8b187bde02c6d7e83f1ce3116af52d471 76826760 chromium_147.0.7727.137-1~deb12u1_i386.deb Checksums-Sha256: 03c75ac9985eaeccfe6231cc8f8fe0237ca09be003084760dd5c751b2cfecd00 5293612 chromium-common-dbgsym_147.0.7727.137-1~deb12u1_i386.deb a57c05f115a1ae016df5fff5645e3d05f5ecea8a6068e76e722914b660b6b3b9 25388752 chromium-common_147.0.7727.137-1~deb12u1_i386.deb 38d2b692b09bf584d7526b59e2b1e5dd027c2392947f44d5f7d99b90cf72ba01 35899036 chromium-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 5b0ec9ed5d4fffe9b6656c2918bd879ddb65f9f39a0d7167623828475283c3b0 7873640 chromium-driver_147.0.7727.137-1~deb12u1_i386.deb 189c88985a710758086923660285b1243dd75c763c9b0ab78b35a9a96f8c750a 29651392 chromium-headless-shell-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 4edf09bcf1a11bd8af746b88c58d58076929aa5116ee204471402793d9cdfa6e 58738672 chromium-headless-shell_147.0.7727.137-1~deb12u1_i386.deb 431d11feb0458afb623fffab7cae45a26aa80fe3f8128e5f772caca3a590e52f 17824 chromium-sandbox-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 8132d0cd492d92225c803689c14e0fcbd6bff6037c154a6112783d707e77cb04 116668 chromium-sandbox_147.0.7727.137-1~deb12u1_i386.deb 2514aaf7128980e8c516a2be6340bca42f47a7b525266fb97c1b8d0c9e326686 32466164 chromium-shell-dbgsym_147.0.7727.137-1~deb12u1_i386.deb db9612db37c0b2a8d128504021acb248f6826258f1b9088d462aaf1d3c6f29a0 64114100 chromium-shell_147.0.7727.137-1~deb12u1_i386.deb dbef9e4ea85bbabf1871899549c26b39825ab0efcf8fe14ae80aacb7da971648 30404 chromium_147.0.7727.137-1~deb12u1_i386-buildd.buildinfo e2c8e9871bfdc31b486d64e66c0a4e19f3b06e5cb77ac57917d36ea2b6616ac9 76826760 chromium_147.0.7727.137-1~deb12u1_i386.deb Files: 29edcc177bc336fd935d2725a12f3597 5293612 debug optional chromium-common-dbgsym_147.0.7727.137-1~deb12u1_i386.deb b8e8689cb4be98c4c1d09d23fd70166f 25388752 web optional chromium-common_147.0.7727.137-1~deb12u1_i386.deb 985460bd9ecc1dbd1ea8f1b5666b1e8d 35899036 debug optional chromium-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 0e859e3991ccd7d2edb92d1e356b4cd9 7873640 web optional chromium-driver_147.0.7727.137-1~deb12u1_i386.deb 45d113cbc488fa9fb50cd7a44bead489 29651392 debug optional chromium-headless-shell-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 1b18400cd208615cd31c63fa5fefbf6c 58738672 web optional chromium-headless-shell_147.0.7727.137-1~deb12u1_i386.deb ee07ba58a6358aec8281b5fee4bd3cf9 17824 debug optional chromium-sandbox-dbgsym_147.0.7727.137-1~deb12u1_i386.deb a525f6c3a58d9165bb8c7a8c5386fa42 116668 web optional chromium-sandbox_147.0.7727.137-1~deb12u1_i386.deb 5884bd3857680ce33f18307ed5a287ba 32466164 debug optional chromium-shell-dbgsym_147.0.7727.137-1~deb12u1_i386.deb 41655afe97ef7acaeec6d8848c888c04 64114100 web optional chromium-shell_147.0.7727.137-1~deb12u1_i386.deb f3358db04b501f1f39700997e9fc226f 30404 web optional chromium_147.0.7727.137-1~deb12u1_i386-buildd.buildinfo 41b123298edcc5024d71ff33990e005e 76826760 web optional chromium_147.0.7727.137-1~deb12u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmn0U08ACgkQYg9P9sm2 dfHvgg//fsMpM0ny9RfD40zriSYadhlXOSdpoIEd+dQc6PWkNbDizuTGGHGvqPxT GQsS5RPubp2tLGfBSo6q6WBGgcN8ycYJxARQvP7lZ/0dR881zdmsxm0gt04ZQhYo Hje2RZG5Ai77lKACo3Y0SuUsXo4UBg28TMBjaMDZsXZs3FU4H+sup3uoLYB7bNoJ Obk7UYTweIvLVqcaGuI0kbllx2+MNhHN0ZpQ+bCk142+cJAb535t7sUi60QJomVf qmZQ71RnreNDe6CbLQFBNvFcvLi6sYb4btHQFRMYZOnfl6lan+0peNnKbIimorhX CNspuWeqyeGYnUrexcBm3tCESbWj9iKZVHIg+0vvO8/Ap5b9l3W7GkaUTxUpIgQv 2F+8SrYtB4y/CpD4IsptK5fH2DpCXJsl/c3YAip4I1C8by9ygRbAIriTk3fdyxkO iAi3mbLirX1xkqlKL5+VOjtzElJgMh/a9+fZGjyzcKBFeD5MSQ87oB3++wdPZbG6 KwRuir+x+zEVE+I7seIB/FqEJ8Ozx101Cawffsd/N9YiTHVYSgkSE4H6B83V0TOg WEXPCgEassRsbiSPmzta+trzGfARExDjVjUkmCYhk1IUga/57ObOu7tLEihFcFdS 0ppUCW8kDxfCjhm+KfrBf4j4/nJhKQsjFf1+RcOlPjqbQVF0pF8= =GlBE -----END PGP SIGNATURE-----