head	1.11;
access;
symbols
	pkgsrc-2026Q3:1.4.0.2
	pkgsrc-2026Q3-base:1.4;
locks; strict;
comment	@# @;


1.11
date	2026.11.08.15.39.14;	author kikadf;	state Exp;
branches;
next	1.10;
commitid	yrOYyJL0WaWYIF2H;

1.10
date	2026.10.23.15.05.39;	author kikadf;	state Exp;
branches;
next	1.9;
commitid	Gs5ouQXK62Pe3C0H;

1.9
date	2026.10.16.15.31.04;	author kikadf;	state Exp;
branches;
next	1.8;
commitid	VFEPPRPdl2FqqIZG;

1.8
date	2026.10.13.13.16.53;	author kikadf;	state Exp;
branches;
next	1.7;
commitid	SwaVzhjttul8MjZG;

1.7
date	2026.10.02.11.43.41;	author kikadf;	state Exp;
branches;
next	1.6;
commitid	H2vrlX55cZdkCTXG;

1.6
date	2026.09.29.07.43.09;	author kikadf;	state Exp;
branches;
next	1.5;
commitid	hkmJ6D1WIKxgnuXG;

1.5
date	2026.09.22.13.41.34;	author kikadf;	state Exp;
branches;
next	1.4;
commitid	NyittFkZkmblACWG;

1.4
date	2026.09.02.13.13.40;	author kikadf;	state Exp;
branches;
next	1.3;
commitid	NYx0jggsE4OL43UG;

1.3
date	2026.08.09.06.31.26;	author kikadf;	state Exp;
branches;
next	1.2;
commitid	8RN084OnLnGuCVQG;

1.2
date	2026.07.08.13.42.34;	author kikadf;	state Exp;
branches;
next	1.1;
commitid	TrothZVUWCiZ0RMG;

1.1
date	2026.07.06.13.07.02;	author kikadf;	state Exp;
branches;
next	;
commitid	5JFQu3OxURxXTAMG;


desc
@@


1.11
log
@
chromium: update to 157.0.8103.38

* 157.0.8103.38
This update includes 213 security fixes. Please see the Chrome Security Page for more information.

[$10,000][567735302] Critical CVE-2026-121156: Buffer overflow in Dawn. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-09-30
[$1,000][562777838] Critical CVE-2026-121229: Memory corruption in ANGLE. Reported by @@mfx on 2026-09-17
[N/A][558870371] Critical CVE-2026-121246: Use after free in WebGL. Reported by Google on 2026-09-08
[N/A][567216197] Critical CVE-2026-121035: Use after free in Prerender. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28
[N/A][569161611] Critical CVE-2026-121247: Buffer overflow in Dawn. Reported by Google on 2026-10-03
[N/A][571065824] Critical CVE-2026-121203: Use after free in Geometry. Reported by Xinyang Ge on 2026-10-07
[N/A][571284308] Critical CVE-2026-121126: Use after free in Core. Reported by Wenbin Liu on 2026-10-08
[$10,000][485855931] High CVE-2026-121107: Incorrect authorization in BackgroundFetch. Reported by Johan Carlsson on 2026-02-19
[$2,000][566398391] High CVE-2026-121197: Out of bounds read in ANGLE. Reported by Arni Hardarson (Neonix Security) on 2026-09-26
[N/A][40063728] High CVE-2026-121112: Out of bounds read in Permissions. Reported by koocola(@@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2023-03-22
[N/A][496008447] High CVE-2026-121174: Missing authorization in BackgroundFetch. Reported by Google on 2026-03-25
[N/A][516958782] High CVE-2026-121098: Improper state validation in GPU. Reported by Google on 2026-05-27
[N/A][536617330] High CVE-2026-121074: Memory corruption in GPU. Reported by Google on 2026-07-19
[N/A][550489336] High CVE-2026-121173: Uninitialized resource in WebGL. Reported by Google on 2026-08-21
[TBD][552757015] High CVE-2026-121233: Type confusion in CacheStorage. Reported by Salvatore Gulizia (Serotav) on 2026-08-26
[TBD][557605839] High CVE-2026-121140: Out of bounds read in Internals. Reported by Popax21 on 2026-09-06
[N/A][558111285] High CVE-2026-121095: Uninitialized resource in WebGL. Reported by Google on 2026-09-07
[N/A][561994040] High CVE-2026-121071: Incorrect authorization in FileSystem. Reported by Google on 2026-09-15
[N/A][563359278] High CVE-2026-121207: Uninitialized resource in Dawn. Reported by Google on 2026-09-18
[N/A][565681453] High CVE-2026-121185: Use after free in PictureInPicture. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-24
[N/A][566111382] High CVE-2026-121166: Type confusion in PDFium. Reported by OpenAI Codex Security (amyb) on 2026-09-25
[N/A][566251701] High CVE-2026-121047: Buffer overflow in Media. Reported by OpenAI Codex Security (amyb) on 2026-09-25
[N/A][566313798] High CVE-2026-121124: Improper adherence to coding standards in XML. Reported by Google on 2026-09-25
[N/A][566377255] High CVE-2026-121118: Use after free in SVG. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-26
[N/A][566506819] High CVE-2026-121188: Use after free in PerformanceAPIs. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-26
[N/A][567106301] High CVE-2026-121113: Buffer overflow in PDFium. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28
[N/A][567222737] High CVE-2026-121082: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-28
[TBD][567321055] High CVE-2026-121083: Use after free in Compositing. Reported by Hafiizh on 2026-09-29
[N/A][567936263] High CVE-2026-121179: Use after free in PDFium. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30
[N/A][567936265] High CVE-2026-121180: Buffer overflow in Media. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30
[N/A][567936269] High CVE-2026-121181: Use after free in Editing. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-30
[N/A][568794851] High CVE-2026-121228: Type confusion in V8. Reported by Xinyang Ge on 2026-10-02
[N/A][568818122] High CVE-2026-121080: Use after free in Codecs. Reported by Xinyang Ge on 2026-10-02
[N/A][568832157] High CVE-2026-121044: Use after free in Layout. Reported by Xinyang Ge on 2026-10-02
[N/A][568901837] High CVE-2026-121051: UI misrepresentation in iOSWeb. Reported by Google on 2026-10-02
[N/A][568903801] High CVE-2026-121038: Information leak in Compositing. Reported by Google on 2026-10-02
[N/A][568936993] High CVE-2026-121090: Improper privilege management in Navigation. Reported by Google on 2026-10-03
[TBD][569129173] High CVE-2026-121052: Use after free in GPU. Reported by Team Allied (nag0x, h4nk3r1n, h4vrut4, HunSec, Hyeongeun Ji ) on 2026-10-04
[TBD][569415790] High CVE-2026-121037: Out of bounds write in ANGLE. Reported by Akshay Sharma - anonymous_blackzero on 2026-10-04
[N/A][569674218] High CVE-2026-121086: Buffer overflow in Skia. Reported by Xinyang Ge on 2026-10-05
[N/A][570026889] High CVE-2026-121131: Use after free in Mobile. Reported by Google on 2026-10-05
[N/A][570028521] High CVE-2026-121087: Improper input validation in Mobile. Reported by Google on 2026-10-05
[N/A][570029317] High CVE-2026-121178: Use after free in Aura. Reported by Google on 2026-10-05
[N/A][570796613] High CVE-2026-121100: Use after free in DOM. Reported by Xinyang Ge on 2026-10-07
[N/A][571059182] High CVE-2026-121148: Use after free in ANGLE. Reported by xinyang on 2026-10-07
[TBD][571648522] High CVE-2026-121089: Use after free in WebGPU. Reported by apalov on 2026-10-09
[TBD][572991399] High CVE-2026-121250: Use after free in Extensions. Reported by Daisuke Hatakeyama and Keita Sode (SYZD Research) on 2026-10-13
[N/A][573263908] High CVE-2026-121032: Out of bounds read in Skia. Reported by Google on 2026-10-13
[TBD][573387527] High CVE-2026-121114: Use after free in TabStrip. Reported by malichamdan on 2026-10-14
[N/A][573836121] High CVE-2026-121127: Use after free in WebAudio. Reported by kylebot on 2026-10-15
[TBD][574021176] High CVE-2026-121210: Type confusion in V8. Reported by zenneth (randomguy6407) on 2026-10-15
[N/A][574038247] High CVE-2026-121057: Type confusion in V8. Reported by OpenAI Codex Security (kylebot) on 2026-10-15
[N/A][574193110] High CVE-2026-121201: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-10-16
[N/A][574214629] High CVE-2026-121084: Out of bounds read in Skia. Reported by Google on 2026-10-16
[N/A][574339635] High CVE-2026-121094: Type confusion in V8. Reported by Vlad Stolyarov (Anthropic), assisted by Claude on 2026-10-16
[TBD][574351803] High CVE-2026-121079: Race condition in V8. Reported by Hyeonjun Ahn (@@_deayzl) on 2026-10-16
[N/A][574376940] High CVE-2026-121143: Uninitialized resource in GPU. Reported by Google on 2026-10-16
[N/A][574409275] High CVE-2026-121097: Use after free in Printing. Reported by Google on 2026-10-16
[N/A][574412369] High CVE-2026-121214: Use after free in Passwords. Reported by Google on 2026-10-16
[N/A][574604188] High CVE-2026-121133: Incorrect reference resolution in Images. Reported by Google on 2026-10-16
[TBD][574752676] High CVE-2026-121249: Buffer overflow in ANGLE. Reported by Atte Kettunen on 2026-10-17
[N/A][574762568] High CVE-2026-121213: Uninitialized resource in Images. Reported by Xinyang Ge on 2026-10-17
[N/A][574791491] High CVE-2026-121241: Use after free in Navigation. Reported by Google on 2026-10-17
[N/A][574922421] High CVE-2026-121224: Security issue in Desktop. Reported by Google on 2026-10-17
[N/A][575318807] High CVE-2026-121117: Use after free in Paint. Reported by Google on 2026-10-19
[N/A][576097084] High CVE-2026-121123: Use after free in Canvas. Reported by Vlad Stolyarov (Anthropic), assisted by Claude on 2026-10-21
[N/A][576169244] High CVE-2026-121182: Use after free in DOM. Reported by Xinyang Ge on 2026-10-21
[N/A][576723181] High CVE-2026-121061: Use after free in Modularization. Reported by Vlad Stolyarov (Anthropic), assisted by Claude on 2026-10-22
[N/A][576937680] High CVE-2026-121227: Uninitialized resource in Skia. Reported by Google on 2026-10-23
[N/A][577318603] High CVE-2026-121226: Type confusion in V8. Reported by Google on 2026-10-24
[N/A][577327383] High CVE-2026-121068: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-10-25
[N/A][577352626] High CVE-2026-121137: Type confusion in DevTools. Reported by Google on 2026-10-24
[N/A][577352772] High CVE-2026-121160: Out of bounds read in Skia. Reported by Google on 2026-10-24
[N/A][577378379] High CVE-2026-121036: Use after free in CSS. Reported by Google on 2026-10-24
[N/A][577400245] High CVE-2026-121104: Incorrect authorization in FileSystem. Reported by Google on 2026-10-24
[N/A][577400880] High CVE-2026-121034: Use after free in Views. Reported by Google on 2026-10-24
[N/A][577402416] High CVE-2026-121208: Out of bounds read in Media. Reported by Google on 2026-10-24
[N/A][577403757] High CVE-2026-121129: Use after free in WebRTC. Reported by Google on 2026-10-24
[TBD][577719868] High CVE-2026-121211: Use after free in PowerBookmarks. Reported by octo on 2026-10-25
[N/A][578083257] High CVE-2026-121078: Type confusion in V8. Reported by Google on 2026-10-26
[TBD][578500839] High CVE-2026-121060: Incorrect authorization in FileSystem. Reported by tmemabo1 on 2026-10-27
[N/A][578670966] High CVE-2026-121076: Use after free in WebXR. Reported by Google on 2026-10-28
[N/A][578688670] High CVE-2026-121221: Type confusion in V8. Reported by Google on 2026-10-28
[N/A][578691880] High CVE-2026-121119: Use after free in Controls. Reported by Google on 2026-10-28
[$2,000][479258455] Medium CVE-2026-121244: UI misrepresentation in FileAPI. Reported by Luan Herrera (@@lbherrera_) on 2026-01-27
[$2,000][566857543] Medium CVE-2026-121242: Improper input validation in WebPackaging. Reported by Cassio Lima(JaxT) on 2026-09-28
[$2,000][571058818] Medium CVE-2026-121105: Information leak in Network. Reported by a45hif on 2026-10-07
[$1,000][503201581] Medium CVE-2026-121237: Improper state validation in FileSystem. Reported by Dwij Mehta on 2026-04-16
[TBD][40059500] Medium CVE-2026-121102: Missing authorization in BackgroundFetch. Reported by Maurice Dauer on 2022-04-27
[TBD][492163889] Medium CVE-2026-121120: Improper input validation in Prerender. Reported by Tianyi Hu on 2026-03-12
[N/A][495903812] Medium CVE-2026-121161: Information leak in BackgroundFetch. Reported by Google on 2026-03-24
[N/A][496187630] Medium CVE-2026-121062: Incorrect authorization in API. Reported by Google on 2026-03-25
[N/A][497950736] Medium CVE-2026-121031: Missing authorization in PDF. Reported by Google on 2026-03-30
[N/A][499181801] Medium CVE-2026-121063: Incorrect authorization in CacheStorage. Reported by Google on 2026-04-03
[N/A][500171457] Medium CVE-2026-121108: Confused deputy in BackgroundFetch. Reported by Google on 2026-04-07
[N/A][502023614] Medium CVE-2026-121199: Missing authorization in Chromoting. Reported by Google on 2026-04-13
[N/A][502385220] Medium CVE-2026-121099: Information leak in PrivateTokens. Reported by Google on 2026-04-14
[N/A][505177525] Medium CVE-2026-121196: Privilege elevation in Mobile. Reported by Google on 2026-04-22
[N/A][507351304] Medium CVE-2026-121066: Incorrect authorization in Extensions. Reported by Google on 2026-04-28
[N/A][511768565] Medium CVE-2026-121256: Use of released resource in GPU. Reported by Google on 2026-05-10
[N/A][513426189] Medium CVE-2026-121115: Improper input validation in Shopping. Reported by Google on 2026-05-15
[N/A][513767200] Medium CVE-2026-121234: Privilege elevation in Contacts. Reported by Google on 2026-05-16
[N/A][514077956] Medium CVE-2026-121177: UI misrepresentation in PageInfo. Reported by Google on 2026-05-17
[N/A][514542988] Medium CVE-2026-121193: Incorrect authorization in Extensions. Reported by Google on 2026-05-19
[N/A][517435285] Medium CVE-2026-121248: Incorrect authorization in API. Reported by Google on 2026-05-28
[N/A][517448378] Medium CVE-2026-121106: Information leak in Omnibox. Reported by Google on 2026-05-28
[N/A][528485835] Medium CVE-2026-121200: Incorrect reference resolution in DevTools. Reported by Google on 2026-06-27
[N/A][533454968] Medium CVE-2026-121039: Incorrect authorization in Proxy Auth. Reported by Google on 2026-07-10
[N/A][536163128] Medium CVE-2026-121122: UI misrepresentation in Prompts. Reported by Google on 2026-07-18
[N/A][536516239] Medium CVE-2026-121219: Integer overflow in GPU. Reported by Google on 2026-07-19
[N/A][540020706] Medium CVE-2026-121255: Incorrect authorization in Autofill AI. Reported by Google on 2026-07-28
[N/A][548943621] Medium CVE-2026-121231: Incorrect authorization in DevTools. Reported by Google on 2026-08-19
[TBD][550245671] Medium CVE-2026-121183: Incorrect authorization in Extensions. Reported by a45hif on 2026-08-21
[N/A][553130328] Medium CVE-2026-121072: Uninitialized resource in Skia. Reported by Google on 2026-08-26
[N/A][553138801] Medium CVE-2026-121103: Incorrect authorization in Extensions. Reported by Google on 2026-08-26
[N/A][553145250] Medium CVE-2026-121136: Missing authorization in DevTools. Reported by Google on 2026-08-26
[N/A][553148542] Medium CVE-2026-121040: Incorrect authorization in Core. Reported by Google on 2026-08-26
[N/A][553152519] Medium CVE-2026-121030: Incorrect authorization in DevTools. Reported by Google on 2026-08-26
[N/A][553154932] Medium CVE-2026-121075: Missing authorization in DevTools. Reported by Google on 2026-08-26
[N/A][553158297] Medium CVE-2026-121220: Incorrect authorization in Core. Reported by Google on 2026-08-26
[TBD][553309390] Medium CVE-2026-121170: Improper resource control in WebCodecs. Reported by @@bean5oup on 2026-08-27
[TBD][553652456] Medium CVE-2026-121059: Information leak in Core. Reported by OGINOME Tomohito on 2026-08-27
[N/A][556221528] Medium CVE-2026-121163: Improper input validation in Browser. Reported by Google on 2026-09-02
[TBD][562158081] Medium CVE-2026-121088: Missing authorization in PerformanceAPIs. Reported by OGINOME Tomohito on 2026-09-15
[N/A][562221093] Medium CVE-2026-121033: Uninitialized resource in GPU. Reported by Google on 2026-09-16
[N/A][562225118] Medium CVE-2026-121254: Information leak in Select. Reported by Google on 2026-09-16
[N/A][562233597] Medium CVE-2026-121065: Incorrect authorization in DevTools. Reported by Google on 2026-09-16
[N/A][562238690] Medium CVE-2026-121171: Confused deputy in DevTools. Reported by Google on 2026-09-16
[N/A][562656015] Medium CVE-2026-121116: Missing authorization in WebView. Reported by Google on 2026-09-17
[N/A][563355450] Medium CVE-2026-121239: Information leak in Core. Reported by Google on 2026-09-18
[N/A][563359033] Medium CVE-2026-121187: Observable discrepancy in Paint. Reported by Google on 2026-09-18
[TBD][564190098] Medium CVE-2026-121132: Information leak in V8. Reported by wang1r && lhfff on 2026-09-21
[N/A][565092623] Medium CVE-2026-121067: UI misrepresentation in PermissionElement. Reported by Google on 2026-09-23
[N/A][565490229] Medium CVE-2026-121096: Incomplete cleanup in V8. Reported by Google on 2026-09-24
[N/A][565681451] Medium CVE-2026-121184: Out of bounds read in Media. Reported by xinyang on 2026-09-24
[N/A][565902952] Medium CVE-2026-121215: UI misrepresentation in Bluetooth. Reported by Google on 2026-09-24
[TBD][566660676] Medium CVE-2026-121212: Incorrect authorization in Core. Reported by Arni Hardarson (Neonix Security) on 2026-09-27
[TBD][566683019] Medium CVE-2026-121194: Missing authorization in SiteIsolation. Reported by JonathanBouman on 2026-09-27
[TBD][566935544] Medium CVE-2026-121202: Use after free in Autofill. Reported by Siyang Wu (LeoWSY-hashblue) on 2026-09-28
[N/A][567169222] Medium CVE-2026-121048: Race condition in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-28
[N/A][567611695] Medium CVE-2026-121070: Use after free in WTF. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][567672825] Medium CVE-2026-121257: Use after free in TabStrip. Reported by Google on 2026-09-29
[N/A][568010379] Medium CVE-2026-121218: Type confusion in V8. Reported by Google on 2026-10-01
[N/A][568972388] Medium CVE-2026-121164: Incorrect authorization in Views. Reported by Google on 2026-10-03
[N/A][568972975] Medium CVE-2026-121223: Observable discrepancy in Media. Reported by Google on 2026-10-03
[N/A][568978733] Medium CVE-2026-121186: UI misrepresentation in Passwords. Reported by Google on 2026-10-03
[N/A][568986882] Medium CVE-2026-121176: Uninitialized resource in Media. Reported by Google on 2026-10-03
[N/A][568988525] Medium CVE-2026-121128: Use after free in Scheduling. Reported by Google on 2026-10-03
[N/A][568999538] Medium CVE-2026-121216: UI misrepresentation in UI. Reported by Google on 2026-10-03
[N/A][569005114] Medium CVE-2026-121158: Information leak in Paint. Reported by Google on 2026-10-03
[N/A][569006789] Medium CVE-2026-121110: UI misrepresentation in Shopping. Reported by Google on 2026-10-03
[N/A][569012366] Medium CVE-2026-121042: Incorrect authorization in Permissions. Reported by Google on 2026-10-03
[N/A][569659190] Medium CVE-2026-121238: Use after free in Source. Reported by Xinyang Ge on 2026-10-05
[N/A][570026368] Medium CVE-2026-121077: Use after free in Mobile. Reported by Google on 2026-10-05
[N/A][570029913] Medium CVE-2026-121245: Race condition in Autofill. Reported by Google on 2026-10-05
[N/A][570104009] Medium CVE-2026-121049: Out of bounds read in V8. Reported by Google on 2026-10-05
[TBD][571195939] Medium CVE-2026-121091: Incorrect authorization in Permissions. Reported by Edmilson Júnior (sierghart) on 2026-10-07
[TBD][571960472] Medium CVE-2026-121167: Incorrect authorization in Permissions. Reported by Keita Sode (SYZD Research) on 2026-10-09
[N/A][578671521] Medium CVE-2026-121135: Security issue in Platform. Reported by Google on 2026-10-28
[$1,000][40052279] Low CVE-2026-121209: UI misrepresentation in Input. Reported by Khalil Zhani on 2020-05-11
[N/A][498000798] Low CVE-2026-121134: Information loss in BackgroundFetch. Reported by Google on 2026-03-31
[N/A][500600456] Low CVE-2026-121217: Use after free in Streaming. Reported by Google on 2026-04-08
[N/A][504234693] Low CVE-2026-121109: Inadequate encryption strength in SSL. Reported by Google on 2026-04-19
[N/A][513451861] Low CVE-2026-121243: Information leak in Frames. Reported by Google on 2026-05-15
[N/A][514074839] Low CVE-2026-121053: UI misrepresentation in Transactions Platform. Reported by Google on 2026-05-17
[N/A][514078071] Low CVE-2026-121190: UI misrepresentation in Extensions. Reported by Google on 2026-05-17
[N/A][517434186] Low CVE-2026-121125: Information leak in ServiceWorker. Reported by Google on 2026-05-28
[N/A][520554677] Low CVE-2026-121046: Incorrect authorization in WebAppInstalls. Reported by Google on 2026-06-05
[N/A][523708065] Low CVE-2026-121222: Incorrect authorization in Forms. Reported by Google on 2026-06-13
[N/A][533070896] Low CVE-2026-121157: Incorrect authorization in Chromoting. Reported by Google on 2026-07-09
[N/A][540040995] Low CVE-2026-121235: Information leak in Paint. Reported by Google on 2026-07-28
[TBD][550356947] Low CVE-2026-121252: Incorrect authorization in Core. Reported by Zabith Mohammed (@@nmzabith) on 2026-08-21
[N/A][553161888] Low CVE-2026-121168: Improper resource exposure in DevTools. Reported by Google on 2026-08-26
[N/A][553171097] Low CVE-2026-121043: UI misrepresentation in Payments. Reported by Google on 2026-08-27
[N/A][553249498] Low CVE-2026-121111: Incorrect authorization in HID. Reported by Google on 2026-08-27
[N/A][553249728] Low CVE-2026-121138: Observable discrepancy in CORS. Reported by Google on 2026-08-27
[N/A][553251045] Low CVE-2026-121055: Incomplete cleanup in DevTools. Reported by Google on 2026-08-27
[N/A][553259600] Low CVE-2026-121101: Missing authorization in DevTools. Reported by Google on 2026-08-27
[N/A][553260839] Low CVE-2026-121236: Improper input validation in Network. Reported by Google on 2026-08-27
[N/A][553262220] Low CVE-2026-121165: UI misrepresentation in Mobile. Reported by Google on 2026-08-27
[N/A][553265115] Low CVE-2026-121253: Missing authorization in DevTools. Reported by Google on 2026-08-27
[N/A][553270515] Low CVE-2026-121172: Incorrect authorization in Isolated. Reported by Google on 2026-08-27
[N/A][553289241] Low CVE-2026-121206: UI misrepresentation in Isolated. Reported by Google on 2026-08-27
[TBD][555547989] Low CVE-2026-121189: Use after free in Browser. Reported by TIENPA on 2026-09-01
[N/A][556215096] Low CVE-2026-121121: UI misrepresentation in PageInfo. Reported by Google on 2026-09-02
[N/A][556233596] Low CVE-2026-121130: Observable discrepancy in Forms. Reported by Google on 2026-09-02
[TBD][561672123] Low CVE-2026-121251: Missing authorization in V8. Reported by wang1r&&lhfff on 2026-09-15
[N/A][562108905] Low CVE-2026-121085: Incorrect authorization in WebUI. Reported by Google on 2026-09-16
[N/A][562957377] Low CVE-2026-121159: Incorrect authorization in History. Reported by Google on 2026-09-17
[N/A][562957821] Low CVE-2026-121204: Incomplete cleanup in DevTools. Reported by Google on 2026-09-17
[N/A][562957845] Low CVE-2026-121205: Incorrect authorization in CORS. Reported by Google on 2026-09-17
[N/A][562964684] Low CVE-2026-121050: Race condition in Mobile. Reported by Google on 2026-09-17
[N/A][562975181] Low CVE-2026-121081: UI misrepresentation in Passwords. Reported by Google on 2026-09-17
[N/A][563181376] Low CVE-2026-121240: Improper input validation in Variations. Reported by Google on 2026-09-18
[N/A][563340726] Low CVE-2026-121198: Confused deputy in WebUI. Reported by Google on 2026-09-18
[N/A][563349192] Low CVE-2026-121225: Incorrect authorization in Permissions. Reported by Google on 2026-09-18
[N/A][563362904] Low CVE-2026-121162: UI misrepresentation in Notifications. Reported by Google on 2026-09-18
[TBD][563689651] Low CVE-2026-121045: UI misrepresentation in Browser. Reported by ilman.dani11 on 2026-09-19
[TBD][563877891] Low CVE-2026-121029: Incorrect authorization in ORB. Reported by uky on 2026-09-20
[TBD][565252325] Low CVE-2026-121054: Improper state validation in XML. Reported by Arni Hardarson (Neonix Security) on 2026-09-23
[TBD][565505280] Low CVE-2026-121175: Improper resource exposure in ORB. Reported by Souma Ohsawa on 2026-09-24
[N/A][565674533] Low CVE-2026-121092: Uncontrolled recursion in SVG. Reported by OpenAI Codex Security (amyb) on 2026-09-24
[N/A][565797214] Low CVE-2026-121073: Use after free in Network. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-24
[TBD][566683383] Low CVE-2026-121230: Race condition in ANGLE. Reported by Hafiizh on 2026-09-27
[TBD][567429681] Low CVE-2026-121093: Out of bounds read in Animation. Reported by C0rk1 on 2026-09-29
[TBD][567726222] Low CVE-2026-121041: Missing authorization in Input. Reported by Siyang Wu (LeoWSY-hashblue) on 2026-09-30
[TBD][567846676] Low CVE-2026-121232: Incorrect authorization in Core. Reported by Anton Helin on 2026-09-30
[TBD][567956457] Low CVE-2026-121142: Incorrect authorization in Network. Reported by Yalguun Tumenkhuu ( fg0x0 ) on 2026-09-30
[TBD][568371493] Low CVE-2026-121069: Use after free in Track. Reported by Hijun Kim on 2026-10-01
[TBD][569965757] Low CVE-2026-121169: Missing authorization in DevTools. Reported by Siyang Wu (LeoWSY-hashblue) on 2026-10-05
[N/A][570558711] Low CVE-2026-121064: Improper input validation in Performance. Reported by Google on 2026-10-06
[N/A][571784617] Low CVE-2026-121195: Incorrect authorization in TrustedTypes. Reported by Google on 2026-10-09
[N/A][578083806] Low CVE-2026-121141: Improper input validation in Editing. Reported by Google on 2026-10-26
@
text
@$NetBSD$

* Part of patchset to build chromium on NetBSD
* Based on OpenBSD's chromium patches, and
  pkgsrc's qt5-qtwebengine patches

--- v8/gni/v8.gni.orig	2026-11-02 23:22:33.000000000 +0000
+++ v8/gni/v8.gni
@@@@ -357,7 +357,7 @@@@ is_drumbrake_supported =
     (v8_current_cpu == "x64" || v8_current_cpu == "arm64" ||
      v8_current_cpu == "riscv64") &&
     (target_os == "win" || target_os == "linux" || target_os == "mac" ||
-     target_os == "ios")
+     target_os == "ios" || target_os == "openbsd" || target_os == "freebsd" || target_os == "netbsd")
 
 # Turbofan is enabled by default, except in lite mode.
 if (v8_enable_turbofan == "") {
@


1.10
log
@
chromium: update to 156.0.8078.47

* 156.0.8078.47
This update includes 353 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-10-19 20:07:21.000000000 +0000
d9 1
a9 1
@@@@ -358,7 +358,7 @@@@ is_drumbrake_supported =
@


1.9
log
@chromium: update to 155.0.8059.79

* 155.0.8059.84
This update includes 10 security fixes. Please see the Chrome Security Page for more information.

[N/A][568719351] Critical CVE-2026-110922: Use after free in Prerender. Reported by Xinyang Ge on 2026-10-02
[N/A][567638392] High CVE-2026-110913: Memory corruption in DOM. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][568831769] High CVE-2026-110919: Use after free in V8. Reported by Xinyang Ge on 2026-10-02
[N/A][568937999] High CVE-2026-110918: Memory corruption in Core. Reported by Google on 2026-10-03
[TBD][569038297] High CVE-2026-110917: Memory corruption in SVG. Reported by C0rk1 on 2026-10-03
[N/A][569286602] High CVE-2026-110921: Use after free in V8. Reported by Xinyang Ge on 2026-10-05
[N/A][569659194] High CVE-2026-110920: Memory corruption in V8. Reported by Xinyang Ge on 2026-10-05
[N/A][501886301] Medium CVE-2026-110916: Improper input validation in Desktop. Reported by Google on 2026-04-12
[N/A][556272421] Medium CVE-2026-110915: Use after free in Compositing. Reported by Google on 2026-09-02
[N/A][563194341] Medium CVE-2026-110914: Memory corruption in Workers. Reported by Google on 2026-09-18


* 155.0.8059.79
This update includes 37 security fixes. Please see the Chrome Security Page for more information.

[TBD][567736859] Critical CVE-2026-110152: Buffer overflow in ANGLE. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-09-30
[N/A][568437149] Critical CVE-2026-110149: Use after free in Browser. Reported by Google on 2026-10-01
[N/A][568719364] Critical CVE-2026-110136: Use after free in PDF. Reported by Xinyang Ge on 2026-10-02
[N/A][568826881] Critical CVE-2026-110161: Use after free in Network. Reported by Google on 2026-10-02
[N/A][568827293] Critical CVE-2026-110165: Use after free in Core. Reported by Google on 2026-10-02
[N/A][570050934] Critical CVE-2026-110148: Use after free in SVG. Reported by Xinyang Ge on 2026-10-05
[N/A][570638834] Critical CVE-2026-110151: Use after free in Media. Reported by Xinyang Ge on 2026-10-06
[$1,000][540499008] High CVE-2026-110162: Use after free in Desktop. Reported by Findingz on 2026-07-29
[N/A][496308073] High CVE-2026-110170: Use after free in Bindings. Reported by Google on 2026-03-25
[N/A][552510359] High CVE-2026-110160: Missing authorization in ReadingMode. Reported by Google on 2026-08-25
[N/A][554531101] High CVE-2026-110143: Use of uninitialized variable in ThirdParty lmza_sdk. Reported by Google on 2026-08-29
[TBD][561039723] High CVE-2026-110146: Information leak in Passwords. Reported by Hoyong Jin on 2026-09-14
[TBD][561334760] High CVE-2026-110150: Privilege elevation in Installer. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-09-14
[N/A][561892119] High CVE-2026-110156: Incorrect reference resolution in Extensions. Reported by Google on 2026-09-15
[N/A][561997899] High CVE-2026-110137: Use after free in WebRTC. Reported by Google on 2026-09-15
[N/A][562038980] High CVE-2026-110140: Type confusion in V8. Reported by Google on 2026-09-15
[N/A][562242421] High CVE-2026-110158: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-16
[N/A][562243925] High CVE-2026-110145: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-16
[TBD][564573066] High CVE-2026-110159: Incorrect authorization in Updater. Reported by Aria Akhavan - Haikhavan Security on 2026-09-21
[TBD][565252396] High CVE-2026-110144: Incorrect authorization in Mojo. Reported by Souma Ohsawa on 2026-09-23
[N/A][565742182] High CVE-2026-110153: Use after free in Media. Reported by xinyang on 2026-09-24
[TBD][566496747] High CVE-2026-110166: Buffer overflow in Animation. Reported by Syn4pse (@@ret2happy) on 2026-09-26
[N/A][567088929] High CVE-2026-110169: Use after free in V8. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-28
[N/A][568010382] High CVE-2026-110168: Use after free in V8. Reported by Google on 2026-10-01
[TBD][568037533] High CVE-2026-110139: Use after free in Media. Reported by weihengqiuu on 2026-09-30
[N/A][568719352] High CVE-2026-110172: Use after free in Media. Reported by Xinyang Ge on 2026-10-02
[N/A][568730794] High CVE-2026-110164: Use after free in DOM. Reported by Xinyang Ge on 2026-10-02
[N/A][568831102] High CVE-2026-110163: Use after free in DOM. Reported by Xinyang Ge on 2026-10-02
[N/A][568895734] High CVE-2026-110141: Observable discrepancy in Media. Reported by Google on 2026-10-02
[N/A][568899705] High CVE-2026-110138: Use after free in ShapeDetection. Reported by Google on 2026-10-02
[N/A][570047270] High CVE-2026-110157: Use after free in SVG. Reported by Xinyang Ge on 2026-10-05
[N/A][570050928] High CVE-2026-110147: Use after free in PDF. Reported by Xinyang Ge on 2026-10-05
[N/A][570167920] High CVE-2026-110154: Use after free in Canvas. Reported by Xinyang Ge on 2026-10-05
[N/A][570167922] High CVE-2026-110155: Buffer overflow in PDFium. Reported by Xinyang Ge on 2026-10-05
[N/A][570461696] High CVE-2026-110167: Use after free in Media. Reported by Xinyang Ge on 2026-10-06
[N/A][570675082] High CVE-2026-110171: Use after free in Media. Reported by Xinyang Ge on 2026-10-06
[TBD][553525515] Medium CVE-2026-110142: Use after free in FileSystem. Reported by Andrew Boni on 2026-08-27
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-10-14 21:09:54.000000000 +0000
d9 1
a9 1
@@@@ -354,7 +354,7 @@@@ is_drumbrake_supported =
@


1.8
log
@
chromium: update to 155.0.8059.39

* 155.0.8059.39
This update includes 247 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-10-06 00:06:58.000000000 +0000
@


1.7
log
@chromium: update to 154.0.8037.97

* 154.0.8037.92
This update includes 32 security fixes. Please see the Chrome Security Page for more information.

[TBD][551673541] Critical CVE-2026-102331: Buffer overflow in ANGLE. Reported by @@mfx on 2026-08-24
[N/A][517312707] High CVE-2026-102317: Improper privilege management in Mojo. Reported by Google on 2026-05-28
[TBD][551668264] High CVE-2026-102312: UI misrepresentation in Omnibox. Reported by jodyritonga on 2026-08-24
[N/A][556789073] High CVE-2026-102313: Uninitialized resource in ANGLE. Reported by Google on 2026-09-03
[TBD][556908674] High CVE-2026-102299: Type confusion in V8. Reported by Andrew Boni on 2026-09-04
[N/A][556926296] High CVE-2026-102306: Use after free in Bluetooth. Reported by Google on 2026-09-04
[N/A][556959073] High CVE-2026-102307: Uninitialized resource in Dawn. Reported by Google on 2026-09-04
[TBD][559266114] High CVE-2026-102323: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-10
[N/A][559727039] High CVE-2026-102303: Uninitialized resource in GPU. Reported by Google on 2026-09-10
[N/A][559737160] High CVE-2026-102311: Uninitialized resource in GPU. Reported by Google on 2026-09-10
[TBD][560062638] High CVE-2026-102300: Uninitialized resource in WebGPU. Reported by Arni Hardarson (Neonix Security) on 2026-09-11
[TBD][560233248] High CVE-2026-102326: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-11
[TBD][560238698] High CVE-2026-102316: Use after free in Views. Reported by Xinyang Ge on 2026-09-11
[TBD][560251736] High CVE-2026-102304: Use after free in Passwords. Reported by Xinyang Ge on 2026-09-11
[TBD][560536732] High CVE-2026-102328: Type confusion in V8. Reported by OpenAI Codex Security (amyb) on 2026-09-12
[TBD][560867085] High CVE-2026-102309: Use after free in FullScreen. Reported by sean geofrey on 2026-09-13
[N/A][561994362] High CVE-2026-102325: Uninitialized resource in Skia. Reported by Google on 2026-09-15
[N/A][561997480] High CVE-2026-102308: Use after free in Views. Reported by Google on 2026-09-15
[N/A][562004351] High CVE-2026-102301: Out of bounds write in GPU. Reported by Google on 2026-09-15
[N/A][562042411] High CVE-2026-102319: Uninitialized resource in GPU. Reported by Google on 2026-09-15
[TBD][562174487] High CVE-2026-102324: Use after free in PictureInPicture. Reported by Blockian Creator of Kritt and Open-Kritt on 2026-09-15
[N/A][562279351] High CVE-2026-102318: Out of bounds read in WebGL. Reported by Google on 2026-09-16
[TBD][563297615] High CVE-2026-102329: Cross-site scripting in WebUI. Reported by chipsec on 2026-09-18
[N/A][563351482] High CVE-2026-102315: Uninitialized resource in Media. Reported by Google on 2026-09-18
[N/A][563716534] High CVE-2026-102302: Buffer overflow in V8. Reported by Google on 2026-09-19
[TBD][565328105] High CVE-2026-102321: Type confusion in V8. Reported by Taisic Yun (@@taisic_) of Theori, with Xint on 2026-09-23
[TBD][554038924] Medium CVE-2026-102320: Missing authorization in CORS. Reported by Anonymous on 2026-08-28
[$1,000][477726837] Low CVE-2026-102310: Missing authorization in Payments. Reported by Autodidact on 2026-01-22
[N/A][496212975] Low CVE-2026-102327: Incorrect authorization in WebView. Reported by Google on 2026-03-25
[N/A][498793976] Low CVE-2026-102330: Incorrect authorization in SiteIsolation. Reported by Google on 2026-04-02
[N/A][514059780] Low CVE-2026-102314: UI misrepresentation in TabStrip. Reported by Google on 2026-05-17
[N/A][533021953] Low CVE-2026-102305: UI misrepresentation in SignIn. Reported by Google on 2026-07-09

* 154.0.8037.97

See: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-09-22 00:09:16.000000000 +0000
@


1.6
log
@
chromium: update to 154.0.8037.57

* 154.0.8037.57
This update includes 108 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html
@
text
@@


1.5
log
@
chromium: update to 153.0.8010.52

* 153.0.8010.36
This update includes 230 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

Google is aware that an exploit for CVE-2026-87491 exists in the wild:
[$2,500][543557673] Medium CVE-2026-87491: Out of bounds write in V8.
Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-06

* 153.0.8010.47
This update includes 42 security fixes. Please see the Chrome Security Page for more information.

[N/A][556870863] Critical CVE-2026-91726: Out of bounds read in WebGL. Reported by Google on 2026-09-03
[TBD][557320614] Critical CVE-2026-91721: Use after free in Internals. Reported by xinyang on 2026-09-04
[TBD][558456602] Critical CVE-2026-91749: Use after free in Workers. Reported by WinD39 - Huynh Dinh Vu on 2026-09-08
[$1,500][552283275] High CVE-2026-91724: Use after free in Input. Reported by Hafiizh on 2026-08-25
[$1,000][556715288] High CVE-2026-91728: Integer overflow in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-03
[N/A][516780835] High CVE-2026-91734: Incorrect authorization in Core. Reported by Google on 2026-05-26
[N/A][516893912] High CVE-2026-91727: Incorrect reference resolution in Extensions. Reported by Google on 2026-05-26
[N/A][516947138] High CVE-2026-91743: Race condition in Core. Reported by Google on 2026-05-27
[N/A][520019273] High CVE-2026-91744: Race condition in PlatformIntegration. Reported by Google on 2026-06-04
[N/A][521486621] High CVE-2026-91712: Race condition in Extensions. Reported by Google on 2026-06-08
[N/A][521559611] High CVE-2026-91748: Race condition in Extensions. Reported by Google on 2026-06-09
[N/A][523470135] High CVE-2026-91720: Uninitialized resource in ANGLE. Reported by Google on 2026-06-13
[N/A][523554372] High CVE-2026-91731: Type confusion in Compositing. Reported by Google on 2026-06-13
[N/A][540016074] High CVE-2026-91747: Use after free in Skia. Reported by Google on 2026-07-28
[N/A][540021213] High CVE-2026-91733: Improper state validation in Skia. Reported by Google on 2026-07-28
[TBD][546413288] High CVE-2026-91741: Type confusion in CacheStorage. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-08-14
[TBD][547815507] High CVE-2026-91709: Type confusion in ServiceWorker. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17
[TBD][549225472] High CVE-2026-91717: Missing authorization in Android. Reported by jodyritonga on 2026-08-20
[N/A][552416113] High CVE-2026-91735: Incorrect authorization in WebUI. Reported by Google on 2026-08-25
[N/A][553115724] High CVE-2026-91708: Race condition in Network. Reported by Google on 2026-08-26
[N/A][553121008] High CVE-2026-91736: Use after free in DOM. Reported by Google on 2026-08-26
[N/A][553122373] High CVE-2026-91740: Uninitialized resource in Skia. Reported by Google on 2026-08-26
[N/A][553132148] High CVE-2026-91710: Use after free in WebAppInstalls. Reported by Google on 2026-08-26
[N/A][553133215] High CVE-2026-91718: Use after free in Core. Reported by Google on 2026-08-26
[N/A][554558368] High CVE-2026-91716: Use after free in Auth. Reported by Google on 2026-08-29
[N/A][556260782] High CVE-2026-91746: Integer overflow in Compositing. Reported by Google on 2026-09-02
[TBD][557206809] High CVE-2026-91729: Use after free in DigitalCredentials. Reported by sean geofrey on 2026-09-04
[TBD][558036280] High CVE-2026-91737: Use after free in PDF. Reported by SeungMyung Lee (@@sm1ee), Siung kim (@@ksw9722) on 2026-09-06
[TBD][558342353] High CVE-2026-91711: Out of bounds write in ServiceWorker. Reported by Cristian Di Nicola (@@crih.exe) on 2026-09-07
[TBD][558367547] High CVE-2026-91715: Type confusion in ServiceWorker. Reported by Cristian Di Nicola (@@crih.exe) on 2026-09-07
[N/A][558734727] High CVE-2026-91745: Use after free in V8. Reported by Google on 2026-09-08
[TBD][474131239] Medium CVE-2026-91723: Race condition in WebAppInstalls. Reported by Luan Herrera (@@lbherrera_) on 2026-01-07
[TBD][511062248] Medium CVE-2026-91732: Missing authorization in AppManifest. Reported by pakhunov.anton.n on 2026-05-08
[N/A][513858387] Medium CVE-2026-91742: Confused deputy in PriceTracking. Reported by Google on 2026-05-16
[N/A][517710554] Medium CVE-2026-91714: Observable discrepancy in Fonts. Reported by Google on 2026-05-29
[N/A][518032534] Medium CVE-2026-91725: Observable discrepancy in CSS. Reported by Google on 2026-05-29
[N/A][521951328] Medium CVE-2026-91739: Missing authorization in Transactions Platform. Reported by Google on 2026-06-09
[N/A][523715133] Medium CVE-2026-91713: Missing authorization in Browser. Reported by Google on 2026-06-14
[N/A][536450979] Medium CVE-2026-91738: Improper input validation in ANGLE. Reported by Google on 2026-07-19
[TBD][543640868] Medium CVE-2026-91730: Incomplete cleanup in GetUserMedia. Reported by Keita Sode and Daisuke Hatakeyama (SYZD Research) on 2026-08-07
[TBD][554953456] Medium CVE-2026-91722: Use after free in Input. Reported by TIENPA on 2026-08-31
[TBD][542115030] Low CVE-2026-91719: Code injection in XML. Reported by Zabith Mohammed (@@nmzabith) on 2026-08-03

* 153.0.8010.52
This update includes 16 security fixes. Please see the Chrome Security Page for more information.

[TBD][500417361] Critical CVE-2026-93374: Use after free in Dawn. Reported by Florian Schweitzer on 2026-04-08
[N/A][548085797] Critical CVE-2026-93372: Buffer overflow in WebGL. Reported by Google on 2026-08-17
[$3,000][550839154] High CVE-2026-93375: Incorrect reference resolution in Tracing. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-08-22
[TBD][541707261] High CVE-2026-93382: Use after free in PDFium. Reported by WinD39 - Huynh Dinh Vu on 2026-08-02
[N/A][553130676] High CVE-2026-93387: Improper state validation in Skia. Reported by Google on 2026-08-26
[N/A][553132214] High CVE-2026-93373: Use after free in Extensions. Reported by Google on 2026-08-26
[TBD][556853443] High CVE-2026-93381: Buffer overflow in PDFium. Reported by SeungMyung Lee (@@sm1ee), Siung kim (@@ksw9722) on 2026-09-03
[TBD][560039872] High CVE-2026-93379: Incorrect authorization in ORB. Reported by OGINOME Tomohito on 2026-09-11
[N/A][560121552] High CVE-2026-93377: Type confusion in V8. Reported by Google on 2026-09-11
[N/A][498411599] Medium CVE-2026-93380: Race condition in FileSystem. Reported by Google on 2026-04-01
[N/A][511832293] Medium CVE-2026-93384: Server-side request forgery in Omnibox. Reported by Google on 2026-05-10
[N/A][515493668] Medium CVE-2026-93383: Information leak in Permissions. Reported by Google on 2026-05-22
[N/A][520521197] Medium CVE-2026-93376: Out of bounds read in DataTransfer. Reported by Google on 2026-06-05
[N/A][540051167] Medium CVE-2026-93378: Missing authorization in Storage. Reported by Google on 2026-07-28
[N/A][553136980] Medium CVE-2026-93385: Information leak in Paint. Reported by Google on 2026-08-26
[N/A][513996595] Low CVE-2026-93386: UI misrepresentation in WebAppInstalls. Reported by Google on 2026-05-17
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-09-14 22:17:16.000000000 +0000
d9 1
a9 1
@@@@ -353,7 +353,7 @@@@ is_drumbrake_supported =
@


1.4
log
@
chromium: update to 152.0.7977.75

* 152.0.7977.75
This update includes 26 security fixes. Please see the Chrome Security Page for more information.

[N/A][522307103] Critical CVE-2026-84353: Use after free in Shared Tab Groups. Reported by Google on 2026-06-10
[N/A][546260492] Critical CVE-2026-84352: Use after free in WebGL. Reported by Google on 2026-08-14
[N/A][498839176] High CVE-2026-84354: Incorrect authorization in FileSystem. Reported by Google on 2026-04-02
[N/A][514078656] High CVE-2026-84359: Information leak in Skia. Reported by Google on 2026-05-17
[N/A][523208474] High CVE-2026-84357: Improper input validation in Omnibox. Reported by Google on 2026-06-12
[N/A][533534913] High CVE-2026-84324: Use after free in Proxy. Reported by Google on 2026-07-10
[N/A][537105664] High CVE-2026-84349: Use after free in Browser. Reported by Google on 2026-07-21
[TBD][547936520] High CVE-2026-84326: Uninitialized resource in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-17
[N/A][549311485] High CVE-2026-84333: Use after free in Dawn. Reported by Google on 2026-08-19
[TBD][551593376] High CVE-2026-84351: Buffer overflow in GPU. Reported by Cassio Lima on 2026-08-24
[N/A][553117928] High CVE-2026-84325: Improper input validation in DataTransfer. Reported by Google on 2026-08-26
[N/A][498710886] Medium CVE-2026-84328: Missing authorization in FileSystem. Reported by Google on 2026-04-01
[N/A][501679156] Medium CVE-2026-84347: Use after free in WebRTC. Reported by Google on 2026-04-11
[N/A][502411391] Medium CVE-2026-84323: Missing authorization in FileSystem. Reported by Google on 2026-04-14
[N/A][511774376] Medium CVE-2026-84355: Incorrect authorization in Navigation. Reported by Google on 2026-05-10
[N/A][514006886] Medium CVE-2026-84358: Improper privilege management in Downloads. Reported by Google on 2026-05-17
[N/A][514489238] Medium CVE-2026-84332: Incorrect authorization in SiteSettings. Reported by Google on 2026-05-19
[N/A][517091927] Medium CVE-2026-84330: UI misrepresentation in FullScreen. Reported by Google on 2026-05-27
[N/A][517798926] Medium CVE-2026-84334: Incorrect authorization in Chromoting. Reported by Google on 2026-05-29
[N/A][518100026] Medium CVE-2026-84348: Information leak in MediaCapture. Reported by Google on 2026-05-30
[N/A][522302504] Medium CVE-2026-84335: Incorrect authorization in TabStrip. Reported by Google on 2026-06-10
[N/A][498725213] Low CVE-2026-84327: Incorrect authorization in Autofill. Reported by Google on 2026-04-01
[N/A][498850269] Low CVE-2026-84329: Confused deputy in CredentialProvider. Reported by Google on 2026-04-02
[TBD][503787232] Low CVE-2026-84356: UI misrepresentation in FullScreen. Reported by Francesco Topol (k4tedu) on 2026-04-18
[N/A][513713427] Low CVE-2026-84350: Use after free in TabStrip. Reported by Google on 2026-05-16
[N/A][521753402] Low CVE-2026-84331: Incorrect authorization in Actor. Reported by Google on 2026-06-09

* 152.0.7977.64
This update includes 327 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-08-31 22:47:51.000000000 +0000
d9 1
a9 1
@@@@ -357,7 +357,7 @@@@ is_drumbrake_supported =
@


1.3
log
@
chromium: update to 151.0.7922.108

* 151.0.7922.108
This update includes 41 security fixes. Please see the Chrome Security Page for more information.

[TBD][499602793] Critical CVE-2026-19137: Use after free in WebGL. Reported by anonymous on 2026-04-05
[N/A][524824288] Critical CVE-2026-19149: Use after free in Aura. Reported by Google on 2026-06-17
[N/A][532941869] Critical CVE-2026-19154: Use after free in Skia. Reported by Google on 2026-07-09
[N/A][534903095] Critical CVE-2026-19157: Out of bounds write in ANGLE. Reported by Google on 2026-07-14
[TBD][537729021] Critical CVE-2026-19170: Use after free in WebGL. Reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. on 2026-07-22
[N/A][537838324] Critical CVE-2026-19172: Use after free in Views. Reported by Google on 2026-07-22
[$5000][537390933] High CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks. Reported by Sven Dysthe (@@svn-dys) on 2026-07-21
[$500][536945254] High CVE-2026-19168: Inappropriate implementation in V8. Reported by XBOW and triaged by Andrés Luksenberg on 2026-07-20
[N/A][500097298] High CVE-2026-19138: Heap buffer overflow in CrashReporting. Reported by Google on 2026-04-06
[N/A][511731805] High CVE-2026-19139: Race in CredentialProvider. Reported by Google on 2026-05-10
[N/A][513044017] High CVE-2026-19140: Use after free in GPU. Reported by Google on 2026-05-14
[N/A][513602949] High CVE-2026-19141: Use after free in Resources. Reported by Google on 2026-05-15
[N/A][515428251] High CVE-2026-19142: Use after free in Views. Reported by Google on 2026-05-21
[N/A][517772612] High CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs. Reported by Google on 2026-05-29
[N/A][520167277] High CVE-2026-19144: Use after free in HTML. Reported by Google on 2026-06-05
[N/A][521878431] High CVE-2026-19145: Use after free in Translate. Reported by Google on 2026-06-09
[N/A][523713150] High CVE-2026-19146: Uninitialized Use in GPU. Reported by Google on 2026-06-14
[N/A][524439798] High CVE-2026-19147: Use after free in Aura. Reported by Google on 2026-06-16
[N/A][524460000] High CVE-2026-19148: Out of bounds write in GPU. Reported by Google on 2026-06-16
[N/A][526380803] High CVE-2026-19150: Inappropriate implementation in V8. Reported by Google on 2026-06-22
[N/A][530663440] High CVE-2026-19151: Use after free in V8. Reported by Google on 2026-07-02
[N/A][531165110] High CVE-2026-19152: Inappropriate implementation in Navigation. Reported by Google on 2026-07-04
[N/A][532939327] High CVE-2026-19153: Insufficient validation of untrusted input in Workers. Reported by Google on 2026-07-09
[N/A][533053621] High CVE-2026-19155: Use after free in Payments. Reported by Google on 2026-07-09
[TBD][533331920] High CVE-2026-19156: Heap buffer overflow in Base. Reported by Viktoria Zlatinova on 2026-07-10
[N/A][535749174] High CVE-2026-19158: Use after free in Views. Reported by Google on 2026-07-17
[N/A][536067175] High CVE-2026-19159: Use after free in Views. Reported by Google on 2026-07-17
[N/A][536068737] High CVE-2026-19160: Uninitialized Use in Skia. Reported by Google on 2026-07-17
[N/A][536165038] High CVE-2026-19161: Uninitialized Use in Skia. Reported by Google on 2026-07-18
[TBD][536271629] High CVE-2026-19162: Out of bounds write in V8. Reported by OpenAI Codex Security (amyb) on 2026-07-19
[N/A][536449742] High CVE-2026-19163: Use after free in Media. Reported by Google on 2026-07-19
[N/A][536470854] High CVE-2026-19164: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-07-19
[TBD][536512612] High CVE-2026-19165: Use after free in Extensions. Reported by @@bean5oup on 2026-07-19
[TBD][536584251] High CVE-2026-19166: Use after free in Web Authentication. Reported by heesun on 2026-07-20
[N/A][536666274] High CVE-2026-19167: Integer overflow in GPU. Reported by Google on 2026-07-20
[N/A][537832446] High CVE-2026-19171: Use after free in Media. Reported by Google on 2026-07-22
[TBD][538332338] High CVE-2026-19173: Out of bounds write in Skia. Reported by Vu Van Tien (@@n0_Be3r) on 2026-07-24
[TBD][538378084] High CVE-2026-19174: Integer overflow in V8. Reported by Seunghyun Lee (@@0x10n) of QED Audit (qedaudit.io) on 2026-07-24
[N/A][540138836] High CVE-2026-19175: Use after free in Payments. Reported by Google on 2026-07-29
[TBD][540157141] High CVE-2026-19176: Use after free in Skia. Reported by WinD39 - Huynh Dinh Vu on 2026-07-29
[TBD][540289900] High CVE-2026-19177: Insufficient validation of untrusted input in UI. Reported by Fabian Wahle (Hap Security) on 2026-07-29

* 151.0.7922.71
This update includes 370 security fixes. Please see the Chrome Security Page for more information.

See: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-08-05 20:17:42.000000000 +0000
d9 1
a9 1
@@@@ -361,7 +361,7 @@@@ is_drumbrake_supported =
@


1.2
log
@
chromium: update to 150.0.7871.100

This update doesn't include security fixes.
A full list of changes in this build is available in
https://chromium.googlesource.com/chromium/src/+log/150.0.7871.47..150.0.7871.101?pretty=fuller&n=10000
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-07-06 22:58:46.000000000 +0000
d9 1
a9 1
@@@@ -351,7 +351,7 @@@@ is_drumbrake_supported =
@


1.1
log
@
chromium: update to 150.0.7871.46

This update includes 433 security fixes. Please see the Chrome Security Page for more information.
@
text
@d7 1
a7 1
--- v8/gni/v8.gni.orig	2026-06-23 23:37:18.000000000 +0000
@