Debian Chromium vulnerabilities

CVE-2024-7019 [MEDIUM] CVE-2024-7019: chromium - Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allow... Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 124.0.6367.60-1~deb12u1) bullseye: open forky: resolved (fixed in 124.0.6367.60-1) s

CVE-2025-14373 [MEDIUM] CVE-2025-14373: chromium - Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143... Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 143.0.7499.109-1~deb12u1) bullseye: open forky: resolved (fixed in 143.0.7499.109-1) sid: resolved (fixed in 143.0.7

CVE-2025-0446 [MEDIUM] CVE-2025-0446: chromium - Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.... Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 132.0.6834.83-1~deb12u1) bullseye: open forky: resolved (fixed in 132.0.

CVE-2025-8582 [MEDIUM] CVE-2025-8582: chromium - Insufficient validation of untrusted input in Core in Google Chrome prior to 139... Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 139.0.7258.66-1~deb12u1) bullseye: open forky: resolved (fixed in 139.0.7258.66-1) sid: resolved (fixe

CVE-2026-2323 [MEDIUM] CVE-2026-2323: chromium - Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.4... Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 145.0.7632.75-1~deb12u1) bullseye: open forky: resolved (fixed in 145.0.7632.45-1) sid: resolved (fixed in 145.0.7632.45-1) trixie: res

CVE-2023-7282 [MEDIUM] CVE-2023-7282: chromium - Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.... Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 113.0.5672.63-1) bullseye: resolved (fixed in 113.0.5672.63-1~deb11u1) fork

CVE-2025-13636 [MEDIUM] CVE-2025-13636: chromium - Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.... Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 143.0.7499.40-1~deb12u1) bullseye: open forky: resolved (fixed in 143.0.749

CVE-2025-1923 [MEDIUM] CVE-2025-1923: chromium - Inappropriate implementation in Permission Prompts in Google Chrome prior to 134... Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 134.0.6998.35-1~deb12u1) bullseye: open forky: resolved (fixed in 134.0

CVE-2026-5891 [MEDIUM] CVE-2026-5891: chromium - Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.77... Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-5878 [MEDIUM] CVE-2026-5878: chromium - Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a... Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-5882 [MEDIUM] CVE-2026-5882: chromium - Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allo... Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-5875 [MEDIUM] CVE-2026-5875: chromium - Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote ... Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-3942 [MEDIUM] CVE-2026-3942: chromium - Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.7... Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 146.0.7680.71-1~deb12u1) bullseye: open forky: resolved (fixed in 146.0.7680.71-1) sid: resolved (fixed in 146.0.7680.71-1) trixie: res

CVE-2026-3927 [MEDIUM] CVE-2026-3927: chromium - Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.7... Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 146.0.7680.71-1~deb12u1) bullseye: open forky: resolved (fixed in 146.0.7680.71-1) sid: resolved (fixed in 146.0.7680.71-1) trixie:

CVE-2026-5918 [MEDIUM] CVE-2026-5918: chromium - Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.... Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-3925 [MEDIUM] CVE-2026-3925: chromium - Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 14... Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 146.0.7680.71-1~deb12u1) bullseye: open forky: resolved (fixed in 146.0.7680.71-1) sid: resolved (fixed in 146.0.7680.71-1

CVE-2026-3928 [MEDIUM] CVE-2026-3928: chromium - Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.76... Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 146.0.7680.71-1~deb12u1) bullseye: open forky: resolved (fixed in 146.0.7

CVE-2026-5889 [MEDIUM] CVE-2026-5889: chromium - Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an ... Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack. (Chromium security severity: Medium) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-5864 [MEDIUM] CVE-2026-5864: chromium - Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed... Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2019-5868 [MEDIUM] CVE-2019-5868: chromium - Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remot... Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. Scope: local bookworm: resolved (fixed in 76.0.3809.100-1) bullseye: resolved (fixed in 76.0.3809.100-1) forky: resolved (fixed in 76.0.3809.100-1) sid: resolved (fixed in 76.0.3809.100-1) trixie: resolved (fixed