-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 29 Apr 2026 04:36:38 -0400 Source: chromium Binary: chromium chromium-common chromium-common-dbgsym chromium-dbgsym chromium-driver chromium-headless-shell chromium-headless-shell-dbgsym chromium-sandbox chromium-sandbox-dbgsym chromium-shell chromium-shell-dbgsym Architecture: arm64 Version: 147.0.7727.137-1~deb13u1 Distribution: trixie-security Urgency: high Maintainer: arm Build Daemon (arm-conova-03) Changed-By: Andres Salomon Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-headless-shell - web browser - old headless shell chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 1052440 Changes: chromium (147.0.7727.137-1~deb13u1) trixie-security; urgency=high . [ Andres Salomon ] * New upstream security release. - CVE-2026-7363: Use after free in Canvas. Reported by heapracer. - CVE-2026-7361: Use after free in iOS. Reported by Google. - CVE-2026-7344: Use after free in Accessibility. Reported by Google. - CVE-2026-7343: Use after free in Views. Reported by Google. - CVE-2026-7333: Use after free in GPU. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-7360: Insufficient validation of untrusted input in Compositing. Reported by Google. - CVE-2026-7359: Use after free in ANGLE. Reported by Google. - CVE-2026-7358: Use after free in Animation. Reported by Google. - CVE-2026-7334: Use after free in Views. Reported by Batuhan Eşref KOÇ. - CVE-2026-7357: Use after free in GPU. Reported by Google. - CVE-2026-7356: Use after free in Navigation. Reported by Google. - CVE-2026-7354: Out of bounds read and write in Angle. Reported by Google. - CVE-2026-7353: Heap buffer overflow in Skia. Reported by Google. - CVE-2026-7352: Use after free in Media. Reported by Google. - CVE-2026-7351: Race in MHTML. Reported by Google. - CVE-2026-7350: Use after free in WebMIDI. Reported by Google. - CVE-2026-7349: Use after free in Cast. Reported by Google. - CVE-2026-7348: Use after free in Codecs. Reported by Google. - CVE-2026-7335: Use after free in media. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po). - CVE-2026-7336: Use after free in WebRTC. Reported by Mozilla. - CVE-2026-7337: Type Confusion in V8. Reported by q@calif.io. - CVE-2026-7347: Use after free in Chromoting. Reported by Google. - CVE-2026-7346: Inappropriate implementation in Tint. Reported by Google. - CVE-2026-7345: Insufficient validation of untrusted input in Feedback. Reported by Google. - CVE-2026-7338: Use after free in Cast. Reported by Krace. - CVE-2026-7342: Use after free in WebView. Reported by Google. - CVE-2026-7341: Use after free in WebRTC. Reported by Google. - CVE-2026-7339: Heap buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792. - CVE-2026-7340: Integer overflow in ANGLE. Reported by 86ac1f1587b71893ed2ad792cd7dde32. - CVE-2026-7355: Use after free in Media. Reported by Google. . [ Jianfeng Liu ] * d/patches: - upstream/Fix-GL-native-pixmap-import-support-reset-in-GpuInit.patch: Fixes upstream issue https://crbug.com/501115509. This issue is introduced in v147, and unfortunately the fix won't get into v147. This issue affects both vaapi and v4l2 decoding under ozone wayland. - fixes/enable-widevine-on-arm64-linux-platform.patch: Enable widevine support on arm64. There is no official support for widevine on arm64 linux while there are libwidevine binaries extracted from chromeos, which can work on linux (closes: #1052440). Checksums-Sha1: a72fbf971df3ea758bf2bfa71ecb413109b68d88 6109300 chromium-common-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb f39e8a2ccbfd7d383476ceb61b90fd63696066c5 29935552 chromium-common_147.0.7727.137-1~deb13u1_arm64.deb 3518dce0bf3ef1de9951282dcbab197080cd08e1 33789868 chromium-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb b649b272effe08c3cedb265699d1188c081a71a1 6615652 chromium-driver_147.0.7727.137-1~deb13u1_arm64.deb e0b47682858a28169fb10d20bd8b76f742c4fd38 28058836 chromium-headless-shell-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 1c59600974a84c590bd4fd2071f1eee00ea6d901 54248780 chromium-headless-shell_147.0.7727.137-1~deb13u1_arm64.deb ef2c8aca16abfa04d7edd1e301a81c7deb827a7f 21080 chromium-sandbox-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 6446d3734a401f455b8aa180bc6947fbc50a7bfe 115492 chromium-sandbox_147.0.7727.137-1~deb13u1_arm64.deb f726bd2514202d1b2b02a4bd8e81a8dc1295a6b6 29456080 chromium-shell-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb b999ebbe6053dbcff9cd47decb891d10639cb571 53917528 chromium-shell_147.0.7727.137-1~deb13u1_arm64.deb 0d528ea9bcbfaf4d14174716951aefffd100ccf6 30406 chromium_147.0.7727.137-1~deb13u1_arm64-buildd.buildinfo 5a9ee9c9061b9a337c487b12a44020b783397cbe 72558904 chromium_147.0.7727.137-1~deb13u1_arm64.deb Checksums-Sha256: e90f1d55b0434be8e9dcec7a003def7d75a69d005a4e4676722b471b46e37492 6109300 chromium-common-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 00bad5fe04daa05ada70256fab600e0166b93fbde06b624d590fb3c5226fa9ab 29935552 chromium-common_147.0.7727.137-1~deb13u1_arm64.deb 58d650c66161e7f51d4650213ac719eec89b2a149993277a630a72a5c10e45f2 33789868 chromium-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 4e82accd20a6a088f28ed192e51321571dabb28b52cb867ea819aea762afa7e3 6615652 chromium-driver_147.0.7727.137-1~deb13u1_arm64.deb eef5b458614cfc15e6af2fbc675e574a3161504048b5354ee3b0ebd43592ce27 28058836 chromium-headless-shell-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 2672752a850cf90661e6497d185d336541da5a12c6640d461b06d2fef62fa51c 54248780 chromium-headless-shell_147.0.7727.137-1~deb13u1_arm64.deb dc6b9608e001a610b3b09244b4a945076cd2f81df9f2aebc5074b2990964a632 21080 chromium-sandbox-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 9cc5b6569cd96a919a0833e07f3d3a307b715886a97ea6b7053db60a28a284ba 115492 chromium-sandbox_147.0.7727.137-1~deb13u1_arm64.deb cd8e31327d97b34f8fe42076eac6a623d641c6c6da32adce330df3ce849f76ee 29456080 chromium-shell-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb aa57d89595c74d12fc92ddfdcb27a2cd46a49ed808c3ed09b8be11116be9a5c7 53917528 chromium-shell_147.0.7727.137-1~deb13u1_arm64.deb 14193496e3cc86db1dc491b575b5cbc0e06479c207b4d96e8c5983c1531d2e00 30406 chromium_147.0.7727.137-1~deb13u1_arm64-buildd.buildinfo 92880e88846938362901693317df6b252f0dfda27f829cc66582bca9de0eb3b4 72558904 chromium_147.0.7727.137-1~deb13u1_arm64.deb Files: 3e5091e1421a9ac6721e3b03c4510a28 6109300 debug optional chromium-common-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb abd4e53e8c5306cd2c1ec623f74adc5e 29935552 web optional chromium-common_147.0.7727.137-1~deb13u1_arm64.deb d8d5afcffd3a2266a118272bec3e8074 33789868 debug optional chromium-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 4effdc8d41e41f00f43f0b64b9f96756 6615652 web optional chromium-driver_147.0.7727.137-1~deb13u1_arm64.deb ef1bf837ad1c756ec8edeaf839f4df77 28058836 debug optional chromium-headless-shell-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 5f2708736250557988d7ee396bc99bec 54248780 web optional chromium-headless-shell_147.0.7727.137-1~deb13u1_arm64.deb 8f805569593d2abf5dcac79e3646d237 21080 debug optional chromium-sandbox-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb 282b805762efe0764d5258ecc2a212f1 115492 web optional chromium-sandbox_147.0.7727.137-1~deb13u1_arm64.deb 66b7fbca0be2384b9f028f9ef5f12175 29456080 debug optional chromium-shell-dbgsym_147.0.7727.137-1~deb13u1_arm64.deb e4f40d0e527dac949f04e745cc808acd 53917528 web optional chromium-shell_147.0.7727.137-1~deb13u1_arm64.deb 3dc9e329de2d1bfed8e993ed2b0f6f30 30406 web optional chromium_147.0.7727.137-1~deb13u1_arm64-buildd.buildinfo 57adc0d3b561a260b00fd88d61fab2e7 72558904 web optional chromium_147.0.7727.137-1~deb13u1_arm64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmn0R7oACgkQXVp1sEH/ 1mIY0xAAiE8L3uA/x3gBZ2t5q37NT+/9YPZIhhxJw+Fbiida1FOiK5qS06AGkVZT QISdKI0AHCi4fL64KkhmHAVIPx6uOiFhD/NPeykiKkskOWkY7FxNClnL+CIBTioz hBTLo0FSshja7TE7+QRrXz6ytPcmlFwx7iKF5GP5PELC01s4XWqSC4ppMsrk/ToT cV5fmy36Z8KcqqY9B1fyHy0puXq+UVLRm/gmqnuaqWp1UF5ADKUu+onsQukC5PgL 5mpHDSe+HkNJHUagWc7WVswqhNO4P176ALdmcrAelAF0k4Pp2tughCjFpz22/hbd BTii4Xx5rMrgcOzbML0YM1Y/Kf4Tm0FfYAwQIy+GFb3pJiuep4NVw+oaUb4Pd8xe VbLHi8SsAMQBOfSIJWI1e8orHPfYFcdnZhqaJV4aFCSi2LaRagVj8S0XfGZS9pCS 3X+AMiuZN2xcJxsk9cJgrH32wBVA98b10qEi5Jov//oY8xxa1ySBtQd9vTpemRf4 XLLiDC2BQP+Il31GXBX+tgHXsqcRwRSsdQYXvnPEEarEBUqY2Oa/Gc79DY091sxu Ug6vJmPgEDTpGrLg+PF2IwLba1rYpCcTFQkfwTG5C5DlEAP7emxrC4Wn/nB9S3E8 xfmO/XEB0Z742VgSynYuzWSapaeQexhXdCPmTPOnmy1oKaCMt3Q= =QFTD -----END PGP SIGNATURE-----