-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 29 Apr 2026 04:36:38 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: armhf Version: 147.0.7727.137-1~deb12u1 Distribution: bookworm-security Urgency: high Maintainer: arm Build Daemon (arm-conova-01) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 1052440 Changes: chromium (147.0.7727.137-1~deb12u1) bookworm-security; urgency=high . [ Andres Salomon ] * New upstream security release. - CVE-2026-7363: Use after free in Canvas. Reported by heapracer. - CVE-2026-7361: Use after free in iOS. Reported by Google. - CVE-2026-7344: Use after free in Accessibility. Reported by Google. - CVE-2026-7343: Use after free in Views. Reported by Google. - CVE-2026-7333: Use after free in GPU. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-7360: Insufficient validation of untrusted input in Compositing. Reported by Google. - CVE-2026-7359: Use after free in ANGLE. Reported by Google. - CVE-2026-7358: Use after free in Animation. Reported by Google. - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ. - CVE-2026-7357: Use after free in GPU. Reported by Google. - CVE-2026-7356: Use after free in Navigation. Reported by Google. - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google. - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google. - CVE-2026-7352: Use after free in Media. Reported by Google. - CVE-2026-7351: Race in MHTML. Reported by Google. - CVE-2026-7350: Use after free in WebMIDI. Reported by Google. - CVE-2026-7349: Use after free in Cast. Reported by Google. - CVE-2026-7348: Use after free in Codecs. Reported by Google. - CVE-2026-7335: Use after free in media. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po). - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla. - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io. - CVE-2026-7347: Use after free in Chromoting. Reported by Google. - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google. - CVE-2026-7345: Insufficient validation of untrusted input in Feedback. Reported by Google. - CVE-2026-7338: Use after free in Cast. Reported by Krace. - CVE-2026-7342: Use after free in WebView. Reported by Google. - CVE-2026-7341: Use after free in WebRTC. Reported by Google. - CVE-2026-7339: Heap buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-7340: Integer overflow in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32. - CVE-2026-7355: Use after free in Media. Reported by Google. . [ Jianfeng Liu ] * d/patches: - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch: Fixes upstream issue https://crbug.com/501115509. This issue is introduced in v147, and unfortunately the fix won't get into v147. This issue affects both vaapi and v4l2 decoding under ozone wayland. - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine support on arm64. There is no official support for widevine on arm64 linux while there are libwidevine binaries extracted from chromeos, which can work on linux (closes: #1052440). Checksums-Sha1: 412ddf538d2f75d01188cb52967bf8571f6486d2 5729072 chromium-common-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 387dad8438219f52bb2e24b8298a43f61f8f76f6 25138000 chromium-common_147.0.7727.137-1~deb12u1_armhf.deb 53316bb8d71f445811056fd8046251d08379e4d7 35218204 chromium-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 6a67943fa0d5d81c10d2e215ad40ee07230326b5 7162252 chromium-driver_147.0.7727.137-1~deb12u1_armhf.deb 5697aa5b65039afe9e7dfdc6c75b7c87ace652a4 27466952 chromium-headless-shell-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 87b5214339c6bbd43a822bb6bc85c2e855056d5d 53967504 chromium-headless-shell_147.0.7727.137-1~deb12u1_armhf.deb 7fd59573df3fbf31b55595bbc0c94127fecc984f 18012 chromium-sandbox-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 4d77e0f41464aecdd7940a475a66b0d1e782a018 116432 chromium-sandbox_147.0.7727.137-1~deb12u1_armhf.deb 3f730609eddd9bdd243f5717f79f554aefef976b 29810008 chromium-shell-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb a95dd143630ef58f5db9c64d28effa8963d166c7 59000276 chromium-shell_147.0.7727.137-1~deb12u1_armhf.deb 821d6912a1b71e963200e6d1518432b2f88acc26 30297 chromium_147.0.7727.137-1~deb12u1_armhf-buildd.buildinfo 850045be4be050bc255eaff787377bef11780d76 70759216 chromium_147.0.7727.137-1~deb12u1_armhf.deb Checksums-Sha256: e2140b54a9f401a8e002e08ca190ace97b8f6987189d9da3e17ad5e0b03ae653 5729072 chromium-common-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 65c93625141788fbc9966d52a285b2fa065d1b57b174948271efbebbeac41212 25138000 chromium-common_147.0.7727.137-1~deb12u1_armhf.deb f69bb3d4c98c76ffa288dcfeefc8b4427c37abcbd45a90defdb0acee0085ea86 35218204 chromium-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 415eb5c144619ef2cc1b60c862364f3aa6cf4aa9f61e348c85ef92f5cb59afa7 7162252 chromium-driver_147.0.7727.137-1~deb12u1_armhf.deb 94d516131ebae69798840ee5a6e02b54d21c0efd910bc04ea345940c6788772f 27466952 chromium-headless-shell-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb c945ed7794508b6330ef5339dceeccd56e2459c0717b676190e1216a8828b81b 53967504 chromium-headless-shell_147.0.7727.137-1~deb12u1_armhf.deb 42c2b94e463be1be9f65a1932342e2a21abc790fd6a637f4304d6d1d8be108bf 18012 chromium-sandbox-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 6a1d93949a715923242110dc9069291e54832910a57e52b3ca383086e9a58505 116432 chromium-sandbox_147.0.7727.137-1~deb12u1_armhf.deb 89dbd4a2d5d470acd6aa1145259ddaee6719c3ed613d6f2ce2880a95ce6beb2c 29810008 chromium-shell-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb de00347200d6516ff5facf48f8a57f7e54851a0d1df4b3f7c14208f2928daf41 59000276 chromium-shell_147.0.7727.137-1~deb12u1_armhf.deb 5a88c2d5fce8ffcc7663537998391acd6cd0fc71e86bd635fd9f27d72702a5d9 30297 chromium_147.0.7727.137-1~deb12u1_armhf-buildd.buildinfo 21f5059164055782cbae9b637f2093589e7fb2bbfd954b012f9f702feac9646f 70759216 chromium_147.0.7727.137-1~deb12u1_armhf.deb Files: 0cbc3e02afe716d70b8388098b13d91a 5729072 debug optional chromium-common-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb f3688210f5bc17f080a6350dec3a761c 25138000 web optional chromium-common_147.0.7727.137-1~deb12u1_armhf.deb f30ce289e94e2c8474b31f388878ebcb 35218204 debug optional chromium-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 6fc109ac1f54f7a7f57d75f341684024 7162252 web optional chromium-driver_147.0.7727.137-1~deb12u1_armhf.deb b62f64d8c238377783da1aabbb3cc8fe 27466952 debug optional chromium-headless-shell-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb 3e9b1bd85a22a863b494c890ef6fa924 53967504 web optional chromium-headless-shell_147.0.7727.137-1~deb12u1_armhf.deb f1965b1056669a703c3823721af6cee4 18012 debug optional chromium-sandbox-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb efbd451f2591176bcf6b2d391b63f64e 116432 web optional chromium-sandbox_147.0.7727.137-1~deb12u1_armhf.deb 71cfa594f011b8c4f6e0a3f1af175f37 29810008 debug optional chromium-shell-dbgsym_147.0.7727.137-1~deb12u1_armhf.deb ce8d86475331acb33eb19758c7986222 59000276 web optional chromium-shell_147.0.7727.137-1~deb12u1_armhf.deb 29be0a34303918e397d22e179257be87 30297 web optional chromium_147.0.7727.137-1~deb12u1_armhf-buildd.buildinfo 4786f197bd6b4b1fc2795c9b9814b282 70759216 web optional chromium_147.0.7727.137-1~deb12u1_armhf.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO4qAQUSIo2p/kVRf8U6eOZMpj68FAmn0TzAACgkQ8U6eOZMp j684Ow//bJRhJuBHEP8lN0k5PXdVav+9fdkeekJds6ArrtDEzmrJl7caj7ZXf8ng /Ej1bMwHZQi54/wjsKHRv0gieLE4lR82kxe6LdIiX2Y375BL8nI9PuQMf1IZvaxk PBiRqlHYBbK4uGUrcuJlJm6t3rW0k64Cj0D3X15OBEuMhD2lXjRV9w6MTE6vMEOr D4PO61/eO5Qof9cVMMDoEE9yVyijwA1XsmNoFr+9azRhXFp76Z7lRsM40OzGAQDp VhMFQNgKMB2KyL8I1zzU9AB1Q0nincuYNlTIPmcZrCDbEVKxceLfk6G1rMfFyF2m yxLH41dAhNvwdlxNUaD55QvK3E/P++829oMH+nuqO7fNxf6/dePNFgBtBFEnuU0Q yxhxOhsYURRHnC3prid4rApgf4j1pDUzOsVDMPWxo29DrtqlRRqJoo48iOnlFHTl fD1PcEHZuj5W/vQ6TbSb62XExcbSwI7gihfhDwM8vGcRDGLsb0wxO5XpMwVagAms ZFJ9uAvKpDehfLQIsHECqLKccJkmgY+Vtw9KDWRABaenmU3mmBhWf29OessxieD2 vfBTODXzBWmW50KFoGlab0/3LqfkAuKYDc47J6tSgOzLM2kMsM9/WgtdMDhhocFn 7NS/a/J0U1zfZlW4CUFmAyI39UTOqqKPCy2BtjTQMTN98Fbj9Wo= =vVyl -----END PGP SIGNATURE-----