head	1.4;
access;
symbols;
locks; strict;
comment	@// @;


1.4
date	2026.10.16.15.30.48;	author kikadf;	state Exp;
branches;
next	1.3;
commitid	VFEPPRPdl2FqqIZG;

1.3
date	2026.10.13.13.16.36;	author kikadf;	state Exp;
branches;
next	1.2;
commitid	SwaVzhjttul8MjZG;

1.2
date	2026.10.02.11.43.25;	author kikadf;	state Exp;
branches;
next	1.1;
commitid	H2vrlX55cZdkCTXG;

1.1
date	2026.09.29.07.42.52;	author kikadf;	state Exp;
branches;
next	;
commitid	hkmJ6D1WIKxgnuXG;


desc
@@


1.4
log
@chromium: update to 155.0.8059.79

* 155.0.8059.84
This update includes 10 security fixes. Please see the Chrome Security Page for more information.

[N/A][568719351] Critical CVE-2026-110922: Use after free in Prerender. Reported by Xinyang Ge on 2026-10-02
[N/A][567638392] High CVE-2026-110913: Memory corruption in DOM. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][568831769] High CVE-2026-110919: Use after free in V8. Reported by Xinyang Ge on 2026-10-02
[N/A][568937999] High CVE-2026-110918: Memory corruption in Core. Reported by Google on 2026-10-03
[TBD][569038297] High CVE-2026-110917: Memory corruption in SVG. Reported by C0rk1 on 2026-10-03
[N/A][569286602] High CVE-2026-110921: Use after free in V8. Reported by Xinyang Ge on 2026-10-05
[N/A][569659194] High CVE-2026-110920: Memory corruption in V8. Reported by Xinyang Ge on 2026-10-05
[N/A][501886301] Medium CVE-2026-110916: Improper input validation in Desktop. Reported by Google on 2026-04-12
[N/A][556272421] Medium CVE-2026-110915: Use after free in Compositing. Reported by Google on 2026-09-02
[N/A][563194341] Medium CVE-2026-110914: Memory corruption in Workers. Reported by Google on 2026-09-18


* 155.0.8059.79
This update includes 37 security fixes. Please see the Chrome Security Page for more information.

[TBD][567736859] Critical CVE-2026-110152: Buffer overflow in ANGLE. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-09-30
[N/A][568437149] Critical CVE-2026-110149: Use after free in Browser. Reported by Google on 2026-10-01
[N/A][568719364] Critical CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge on 2026-10-02
[N/A][568826881] Critical CVE-2026-110161: Use after free in Network. Reported by Google on 2026-10-02
[N/A][568827293] Critical CVE-2026-110165: Use after free in Core. Reported by Google on 2026-10-02
[N/A][570050934] Critical CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge on 2026-10-05
[N/A][570638834] Critical CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge on 2026-10-06
[$1,000][540499008] High CVE-2026-110162: Use after free in Desktop. Reported by Findingz on 2026-07-29
[N/A][496308073] High CVE-2026-110170: Use after free in Bindings. Reported by Google on 2026-03-25
[N/A][552510359] High CVE-2026-110160: Missing authorization in ReadingMode. Reported by Google on 2026-08-25
[N/A][554531101] High CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk. Reported by Google on 2026-08-29
[TBD][561039723] High CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin on 2026-09-14
[TBD][561334760] High CVE-2026-110150: Privilege elevation in Installer. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-09-14
[N/A][561892119] High CVE-2026-110156: Incorrect reference resolution in Extensions. Reported by Google on 2026-09-15
[N/A][561997899] High CVE-2026-110137: Use after free in WebRTC. Reported by Google on 2026-09-15
[N/A][562038980] High CVE-2026-110140: Type confusion in V8. Reported by Google on 2026-09-15
[N/A][562242421] High CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-16
[N/A][562243925] High CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-16
[TBD][564573066] High CVE-2026-110159: Incorrect authorization in Updater. Reported by Aria Akhavan - Haikhavan Security on 2026-09-21
[TBD][565252396] High CVE-2026-110144: Incorrect authorization in Mojo. Reported by Souma Ohsawa on 2026-09-23
[N/A][565742182] High CVE-2026-110153: Use after free in Media. Reported by xinyang on 2026-09-24
[TBD][566496747] High CVE-2026-110166: Buffer overflow in Animation. Reported by Syn4pse (@@ret2happy) on 2026-09-26
[N/A][567088929] High CVE-2026-110169: Use after free in V8. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28
[N/A][568010382] High CVE-2026-110168: Use after free in V8. Reported by Google on 2026-10-01
[TBD][568037533] High CVE-2026-110139: Use after free in Media. Reported by weihengqiuu on 2026-09-30
[N/A][568719352] High CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge on 2026-10-02
[N/A][568730794] High CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge on 2026-10-02
[N/A][568831102] High CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge on 2026-10-02
[N/A][568895734] High CVE-2026-110141: Observable discrepancy in Media. Reported by Google on 2026-10-02
[N/A][568899705] High CVE-2026-110138: Use after free in ShapeDetection. Reported by Google on 2026-10-02
[N/A][570047270] High CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge on 2026-10-05
[N/A][570050928] High CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge on 2026-10-05
[N/A][570167920] High CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge on 2026-10-05
[N/A][570167922] High CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge on 2026-10-05
[N/A][570461696] High CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge on 2026-10-06
[N/A][570675082] High CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge on 2026-10-06
[TBD][553525515] Medium CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni on 2026-08-27
@
text
@$NetBSD$

* Part of patchset to build chromium on NetBSD
* Based on OpenBSD's chromium patches, and
  pkgsrc's qt5-qtwebengine patches

--- chrome/browser/ui/webui/intro/intro_ui.cc.orig	2026-10-14 21:09:54.000000000 +0000
+++ chrome/browser/ui/webui/intro/intro_ui.cc
@@@@ -54,7 +54,7 @@@@ int GetBackupCardDescriptionId(bool is_f
              : IDS_UNO_FRE_BACKUP_CARD_DESCRIPTION_WITH_PASSWORDS;
 }
 
-#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
+#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_BSD)
 bool IsDefaultBrowserDisabledByPolicy() {
   const auto* local_state = g_browser_process->local_state();
   return local_state->IsManagedPreference(
@@@@ -64,7 +64,7 @@@@ bool IsDefaultBrowserDisabledByPolicy() 
 #endif  // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
 
 bool ShouldShowDefaultBrowserToggle() {
-#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
+#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_BSD)
   return !IsDefaultBrowserDisabledByPolicy() &&
          shell_integration::CanSetAsDefaultBrowser();
 #else
@@@@ -74,7 +74,7 @@@@ bool ShouldShowDefaultBrowserToggle() {
 
 bool ShouldShowMetricsOptIn() {
 #if BUILDFLAG(GOOGLE_CHROME_BRANDING) && \
-    (BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX))
+    (BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_BSD))
   return !metrics::IsMetricsReportingPolicyManaged();
 #else
   return false;
@


1.3
log
@
chromium: update to 155.0.8059.39

* 155.0.8059.39
This update includes 247 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html
@
text
@d7 1
a7 1
--- chrome/browser/ui/webui/intro/intro_ui.cc.orig	2026-10-06 00:06:58.000000000 +0000
@


1.2
log
@chromium: update to 154.0.8037.97

* 154.0.8037.92
This update includes 32 security fixes. Please see the Chrome Security Page for more information.

[TBD][551673541] Critical CVE-2026-102331: Buffer overflow in ANGLE. Reported by @@mfx on 2026-08-24
[N/A][517312707] High CVE-2026-102317: Improper privilege management in Mojo. Reported by Google on 2026-05-28
[TBD][551668264] High CVE-2026-102312: UI misrepresentation in Omnibox. Reported by jodyritonga on 2026-08-24
[N/A][556789073] High CVE-2026-102313: Uninitialized resource in ANGLE. Reported by Google on 2026-09-03
[TBD][556908674] High CVE-2026-102299: Type confusion in V8. Reported by Andrew Boni on 2026-09-04
[N/A][556926296] High CVE-2026-102306: Use after free in Bluetooth. Reported by Google on 2026-09-04
[N/A][556959073] High CVE-2026-102307: Uninitialized resource in Dawn. Reported by Google on 2026-09-04
[TBD][559266114] High CVE-2026-102323: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-10
[N/A][559727039] High CVE-2026-102303: Uninitialized resource in GPU. Reported by Google on 2026-09-10
[N/A][559737160] High CVE-2026-102311: Uninitialized resource in GPU. Reported by Google on 2026-09-10
[TBD][560062638] High CVE-2026-102300: Uninitialized resource in WebGPU. Reported by Arni Hardarson (Neonix Security) on 2026-09-11
[TBD][560233248] High CVE-2026-102326: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-11
[TBD][560238698] High CVE-2026-102316: Use after free in Views. Reported by Xinyang Ge on 2026-09-11
[TBD][560251736] High CVE-2026-102304: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-11
[TBD][560536732] High CVE-2026-102328: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-12
[TBD][560867085] High CVE-2026-102309: Use after free in FullScreen. Reported by sean geofrey on 2026-09-13
[N/A][561994362] High CVE-2026-102325: Uninitialized resource in Skia. Reported by Google on 2026-09-15
[N/A][561997480] High CVE-2026-102308: Use after free in Views. Reported by Google on 2026-09-15
[N/A][562004351] High CVE-2026-102301: Out of bounds write in GPU. Reported by Google on 2026-09-15
[N/A][562042411] High CVE-2026-102319: Uninitialized resource in GPU. Reported by Google on 2026-09-15
[TBD][562174487] High CVE-2026-102324: Use after free in PictureInPicture. Reported by Blockian Creator of Kritt and Open-Kritt on 2026-09-15
[N/A][562279351] High CVE-2026-102318: Out of bounds read in WebGL. Reported by Google on 2026-09-16
[TBD][563297615] High CVE-2026-102329: Cross-site scripting in WebUI. Reported by chipsec on 2026-09-18
[N/A][563351482] High CVE-2026-102315: Uninitialized resource in Media. Reported by Google on 2026-09-18
[N/A][563716534] High CVE-2026-102302: Buffer overflow in V8. Reported by Google on 2026-09-19
[TBD][565328105] High CVE-2026-102321: Type confusion in V8. Reported by Taisic Yun (@@taisic_) of Theori, with Xint on 2026-09-23
[TBD][554038924] Medium CVE-2026-102320: Missing authorization in CORS. Reported by Anonymous on 2026-08-28
[$1,000][477726837] Low CVE-2026-102310: Missing authorization in Payments. Reported by Autodidact on 2026-01-22
[N/A][496212975] Low CVE-2026-102327: Incorrect authorization in WebView. Reported by Google on 2026-03-25
[N/A][498793976] Low CVE-2026-102330: Incorrect authorization in SiteIsolation. Reported by Google on 2026-04-02
[N/A][514059780] Low CVE-2026-102314: UI misrepresentation in TabStrip. Reported by Google on 2026-05-17
[N/A][533021953] Low CVE-2026-102305: UI misrepresentation in SignIn. Reported by Google on 2026-07-09

* 154.0.8037.97

See: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html
@
text
@d7 1
a7 1
--- chrome/browser/ui/webui/intro/intro_ui.cc.orig	2026-09-22 00:09:16.000000000 +0000
d9 1
a9 1
@@@@ -53,7 +53,7 @@@@ int GetBackupCardDescriptionId(bool is_f
d18 1
a18 1
@@@@ -63,7 +63,7 @@@@ bool IsDefaultBrowserDisabledByPolicy() 
d27 1
a27 1
@@@@ -73,7 +73,7 @@@@ bool ShouldShowDefaultBrowserToggle() {
@


1.1
log
@
chromium: update to 154.0.8037.57

* 154.0.8037.57
This update includes 108 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html
@
text
@@