-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 11 Mar 2026 20:01:51 -0400 Source: chromium Binary: chromium-l10n Architecture: all Version: 146.0.7680.71-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-csail-02) Changed-By: Andres Salomon Description: chromium-l10n - web browser - language packs Changes: chromium (146.0.7680.71-1~deb13u1) trixie-security; urgency=high . [ Andres Salomon ] * New upstream stable release. - CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand - CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga. - CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand - CVE-2026-3916: Out of bounds read in Web Speech. Reported by Grischa Hauser. - CVE-2026-3917: Use after free in Agents. Reported by Syn4pse. - CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse. - CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd - CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google. - CVE-2026-3921: Use after free in TextEncoding. Reported by Pranamya Keshkamat & Cantina.xyz. - CVE-2026-3922: Use after free in MediaStream. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-3923: Use after free in WebMIDI. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-3924: Use after free in WindowDialog. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-3925: Incorrect security UI in LookalikeChecks. Reported by NDevTK and Alesandro Ortiz. - CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c. - CVE-2026-3927: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K. - CVE-2026-3928: Insufficient policy enforcement in Extensions. Reported by portsniffer443. - CVE-2026-3929: Side-channel information leakage in ResourceTiming. Reported by Povcfe of Tencent Security Xuanwu Lab. - CVE-2026-3930: Unsafe navigation in Navigation. Reported by Povcfe of Tencent Security Xuanwu Lab. - CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd - CVE-2026-3932: Insufficient policy enforcement in PDF. Reported by Ayato Shitomi. - CVE-2026-3934: Insufficient policy enforcement in ChromeDriver. Reported by Povcfe of Tencent Security Xuanwu Lab. - CVE-2026-3935: Incorrect security UI in WebAppInstalls. Reported by Barath Stalin K. - CVE-2026-3936: Use after free in WebView. Reported by Am4deu$. - CVE-2026-3937: Incorrect security UI in Downloads. Reported by Abhishek Kumar. - CVE-2026-3938: Insufficient policy enforcement in Clipboard. Reported by vicevirus. - CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK - CVE-2026-3940: Insufficient policy enforcement in DevTools. Reported by Jorian Woltjer, Mian, bug_blitzer. - CVE-2026-3941: Insufficient policy enforcement in DevTools. Reported by Lyra Rebane (rebane2001). - CVE-2026-3942: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K. * d/rules: update rustc version string for new upstream expectations of no spaces. * d/patches: - upstream/disable-unrar.patch: drop, merged upstream. - disable/signin.patch: drop part of the patch. This patch should be reviewed in the future and coordinated w/ ungoogled-chromium, since it originally came from them. - disable/glic.patch: add a bunch more glic removals. - disable/license-headless-shell.patch: refresh. - disable/unrar.patch: refresh. - system/rollup.patch: refresh. - bookworm/foreach.patch: refresh. - ungoogled/disable-privacy-sandbox.patch: sync from ungoogled-chromium. - disable/catapult.patch: update to remove some more catapult deps. - fixes/force-rust-nightly.patch: drop, no longer needed. - llvm-22/ignore-for-ubsan.patch: add a build fix for a compiler flag/feature added to llvm-23. - fixes/bytemuck.patch: add rust build fix in bytemuck. - llvm-19/clang-19-crash.patch: add build fix; delete code that makes clang-19++ crash. - llvm-19/keyfactory.patch: add build fix for what I suspect is a clang-19 issue. - loongarch64/0018-fix-study-crash.patch: refresh. - ppc64le/breakpad/0001-Implement-support-for-ppc64-on-Linux.patch: refresh. - ppc64le/fixes/fix-study-crash.patch: refresh. - llvm-19/clone-traits.patch: add patch to remove a static assertion. - llvm-19/octal.patch: add patch to work around 0o666 vs 0666 support. - upstream/profile.patch: add header inclusion build fix from upstream. - trixie/value-or.patch: move to llvm-19/ directory & also add another place that clang-19 gets confused during build. - rust-1.85/jxl-features.patch: refresh [trixie, bookworm]. - rust-1.85/jxl-simd-avx512.patch: update for (numerous) upstream changes, and added unsafe{} blocks to the macro definitions to shrink this patch in the future [trixie, bookworm]. - fixes/missing-dep.patch: add patch for dependency-related build failure that only happens sometimes. . [ Timothy Pearson ] * d/patches/ppc64le: - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh for upstream changes - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch: refresh for upstream changes . [ Daniel Richard G. ] * d/patches: - disable/lint.patch: New patch to disable CSS/JS linting tools. - bookworm/node18-compat.patch: New patch to fix various compatibility issues with nodejs 18 [bookworm]. - trixie/gn-len.patch: Zap another instance of len() for older GN [trixie, bookworm]. Checksums-Sha1: 8fae405a5f1f5a340e756b659ba258f1a65fbd2b 8700500 chromium-l10n_146.0.7680.71-1~deb13u1_all.deb 48269eb3900dcca6e65525745b9416902a791ebb 26811 chromium_146.0.7680.71-1~deb13u1_all-buildd.buildinfo Checksums-Sha256: 58c925b91c99c500dc0dd32bf83f702a12aca360dbbef4c85a8fdb2bf7c56084 8700500 chromium-l10n_146.0.7680.71-1~deb13u1_all.deb 4f29207b8aa3df56675ecd5a6d31545a51b16e4beba896d586f0b51d51170a9b 26811 chromium_146.0.7680.71-1~deb13u1_all-buildd.buildinfo Files: e98660d538d2b74d4de01ec59989d612 8700500 localization optional chromium-l10n_146.0.7680.71-1~deb13u1_all.deb a8ec1637af602dc06809f678ed4ae36a 26811 web optional chromium_146.0.7680.71-1~deb13u1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmmyuhwACgkQaBVi67oX tfkQCBAAzpXMm0a1dPrflyqeCE1DGOsgoh+3dzVaHpe7p/3HZICsg5fDk1w11hii RVEADOfSQQmDVu50P1YTk63k5/QaVCN9WhZleVZ5fpB6khvdFdCcXYcqkfFReded A8qfpG0VnsMeVBrGlzjvVNAcZZM3QpZCtsNYvCRqeb+qhBhBPj1SA7D8JjJYovuO bcSeBOuupeEPBOS3EtDZZ0suh3c0wsxRBW6B6yj+KABYdXjOJe7k5mTVr1D6ju2h q5/V5wwJqx1HlKqPUNasWEs7eM7QVDn6ZcwzZuv4LItbMCj4quT9YrlQjQaxskCs ljfZ7vks4UKs4uUmz8LzlsT+IfIgkFyjDwBdRTIDeXBPTfSkVVNe0WgClzuk1Yc7 ekI2je1sig230i5fQP0iqUSL8ODCJLQlOsFGo4/fZgciaAsJhyNpTqwYYK3h8nCn tCcgwoHU8C3CuuSieXjI2EB/VHiM/WH5mY+mIAGFa3pdGz9w00LhWTcUvPVOI+E7 wZtWw/rrEAq7LEw1Uf8ie8mmvbpHa6hUChh0xWdO2dhBSj6PFWRjp93vVIy+HhYg xvJqQEk76ZQ9aHWiCWEBhBTtP0//n6M67qS3CA73EOsi1cEiJHIWtfMropWATJ9T RcXe85w8a1E4DwngZbjqDnTntzLJfEZyRF4hqd/13LkF/xW+L50= =9aZA -----END PGP SIGNATURE-----