-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 01 Nov 2026 22:51:42 -0500
Source: chromium
Architecture: source
Version: 156.0.8078.79-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Chromium Team <chromium@packages.debian.org>
Changed-By: Andres Salomon <dilinger@debian.org>
Closes: 1150706
Changes:
 chromium (156.0.8078.79-1~deb13u1) trixie-security; urgency=high
 .
   [ Juan Manuel Méndez Rey ]
   * d/patches/upstream: new directory for fixes that are already upstream,
     with the two a component build needs.
   * d/rules: set use_mold=false and dcheck_always_on=false, which a component
     build needs because both default back on when is_official_build is off.
   * d/rules: turn off use_thin_lto in a component build. Thin lto adds
     -fwhole-program-vtables, which a component build makes unsound, and the
     browser then crashes in mojo at startup.
   * d/rules: keep dh_makeshlibs out of /usr/lib/chromium. That directory is
     private, and chromium-common was declaring libvulkan in its shlibs and
     activating an ldconfig trigger for it.
   * d/rules: add the component build configuration, off by default. Name an
     architecture in COMPONENT_BUILD_ARCHS to turn it on there.
   * d/rules: build chromium as a component build on armhf, the only
     configuration whose final link fits in a 32-bit address space.
     (Closes: #1150706)
   * d/README.armhf: new, why armhf is built this way and what to check on a
     version bump.
 .
   [ Andres Salomon ]
   * New upstream security release.
     - CVE-2026-76024: Memory corruption in MediaStream.
       Reported by Xinyang Ge.
     - CVE-2026-76025: Use after free in FileSystem. Reported by Google.
     - CVE-2026-76026: Memory corruption in Autofill. Reported by Google.
     - CVE-2026-76027: Memory corruption in CacheStorage. Reported by Google.
     - CVE-2026-76028: Use after free in FileSystem. Reported by Google.
     - CVE-2026-76029: Memory corruption in Network.
       Reported by Cristian Di Nicola (crih.exe) (https://crihexe.com).
     - CVE-2026-76030: Memory corruption in FileSystem.
       Reported by huntersnot4.
     - CVE-2026-76031: Use after free in Input.
       Reported by Arni Hardarson (Neonix Security).
     - CVE-2026-119260: Use after free in Frames. Reported by Google.
     - CVE-2026-119261: Improper input validation in Skia. Reported by Google.
     - CVE-2026-119262: Improper input validation in V8.
       Reported by Hyeonjun Ahn (@_deayzl).
     - CVE-2026-119263: Memory corruption in GarbageCollection.
       Reported by Xinyang Ge.
     - CVE-2026-119264: Memory corruption in Dawn. Reported by leegn4a.
     - CVE-2026-119265: Memory corruption in Quota. Reported by Google.
     - CVE-2026-119266: Use after free in Quota. Reported by Google.
     - CVE-2026-119267: Memory corruption in DOM. Reported by Xinyang Ge.
     - CVE-2026-119268: Integer overflow in Editing. Reported by Xinyang Ge.
     - CVE-2026-119269: Use after free in Blink. Reported by Google.
     - CVE-2026-119270: Improper input validation in CacheStorage.
       Reported by Google.
     - CVE-2026-119271: Use after free in Skia. Reported by Google.
     - CVE-2026-119272: Out of bounds read in FileSystem. Reported by Google.
 .
   [ Daniel Richard G. ]
   * d/deb_pre_gen.py: Rework script to be called directly by ninja, instead
     of being called by various upstream build scripts.
   * d/patches:
     - debianization/pre-gen.patch: stop patching various upstream scripts
       (eg, run_bindgen.py).
     - disable/node-ts.patch: drop, no longer needed with above rework.
Checksums-Sha1:
 f262c8c1f8e6adf44695470d4d8168ac33fbc28a 4415 chromium_156.0.8078.79-1~deb13u1.dsc
 b517e12ce018658f0aa2762b5a08a026ecffbdb9 18141952 chromium_156.0.8078.79.orig-pre-gen.tar.xz
 303ee58a331bb0e85ad070d18af52524c11fee68 801144748 chromium_156.0.8078.79.orig.tar.xz
 36b9f523f9b5292f363458a13c608a72730752f7 508920 chromium_156.0.8078.79-1~deb13u1.debian.tar.xz
 36f1fb2456e90f72d0b36664a687e781947c02cd 27972 chromium_156.0.8078.79-1~deb13u1_source.buildinfo
Checksums-Sha256:
 57c3e9730407d5ed11012ddefe1c175664aed173fb614abed3c0ed87bd5bf75c 4415 chromium_156.0.8078.79-1~deb13u1.dsc
 81da743a5cb52784043027e6adf3578cda7667c6e98bbedc41464feb82bc96d9 18141952 chromium_156.0.8078.79.orig-pre-gen.tar.xz
 5351bbf4e68def70819a25b3a07eafad8f97204bcd4a3e2002c1a1dd690b0e31 801144748 chromium_156.0.8078.79.orig.tar.xz
 1374b79c15a37b72c38d643d153d865567a61855a98414e726accfbeddbd30bf 508920 chromium_156.0.8078.79-1~deb13u1.debian.tar.xz
 432c45b7805496a5b3cff3dd0905463bc7b898fdf936508678687edbef35c8a0 27972 chromium_156.0.8078.79-1~deb13u1_source.buildinfo
Files:
 5963c1fc947f9ba4747377d67b7a39e8 4415 web optional chromium_156.0.8078.79-1~deb13u1.dsc
 6d2ff9da6832ad154cfe3389761ee204 18141952 web optional chromium_156.0.8078.79.orig-pre-gen.tar.xz
 d23ddb08c7feb5222cac20f6b615ce4a 801144748 web optional chromium_156.0.8078.79.orig.tar.xz
 83929d7beffccd66c8aba4b21f4276ef 508920 web optional chromium_156.0.8078.79-1~deb13u1.debian.tar.xz
 b96f7bb862c7d924b452881153eda19c 27972 web optional chromium_156.0.8078.79-1~deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmroHSQUHGRpbGluZ2Vy
QGRlYmlhbi5vcmcACgkQZF0CR8NudjcuZxAAqUet+t5rDQcctp4kb5rs9q3m82Dh
X4EL3/pZrTT3Y4AjcUi46OplGvD0Gq5pxhSqUqBhr0eEtKhCM1K+Riv3v0mSL2jS
DXkw98yeXxQhFpm7HGK5MeVOm3MdlaemEMCqiGZAL6LRxDVQocUdQQQxs7Pq22vt
baOH9t+oU9Q5xuqcu9cyj0yoSUsyUzO6Z8YTiGz5IY3KvGM3ejYguv4SoPEJzgPn
FLmH+AH31dLriyF25Zsn2Slw0jvFeF4ixB9IwgCJYFQYt7X5nz8NHGSkpsNwC+J9
EtXhtYqH3hDmFqdjzN5o2lJd3oC+A4l2dHMLMz8gAahf8xacOYKb9i63WLDHNeWJ
YK3AX9t9wik3c43Ia7NEyNn4+fM4VMMxEpZONvKz9R5V4zPXo05NOrOWIqlZByKj
FDywf97Ac7brZeVGftIq1xejY6So5pMfWXHl/RUblpy82jV54AZRSGuF/F/A8TJz
B2YDhyXSCZWB5/QqO8KOmAwXD+GMy2qFTKQxH0pZLGs+CDXkTGHIETtNZ7NnhhYO
iaszuvj28WFdRkyNhxFa9AjxIw6SkMOq1/PyO9w636D8duNigR+BD8DqFd5sVG7m
GNe8hmUG9bmihYu5/ARHjRmgoTx4IX8PKVrvHTDKCajz4UXetXLzg1/nSMFHx5q9
PZEXdY5lOP9tEqQ=
=gJis
-----END PGP SIGNATURE-----