Debian Chromium vulnerabilities

CVE-2021-30513 [HIGH] CVE-2021-30513: chromium - Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote at... Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Scope: local bookworm: resolved (fixed in 90.0.4430.212-1) bullseye: resolved (fixed in 90.0.4430.212-1) forky: resolved (fixed in 90.0.4430.212-1) sid: resolved (fixed in 90.0.4430.212-1) trixie: resolved (fixed in

CVE-2021-30588 [HIGH] CVE-2021-30588: chromium - Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote at... Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Scope: local bookworm: resolved (fixed in 93.0.4577.82-1) bullseye: resolved (fixed in 93.0.4577.82-1) forky: resolved (fixed in 93.0.4577.82-1) sid: resolved (fixed in 93.0.4577.82-1) trixie: resolved (fixed in 93.0

CVE-2019-13725 [HIGH] CVE-2019-13725: chromium - Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a rem... Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Scope: local bookworm: resolved (fixed in 79.0.3945.79-1) bullseye: resolved (fixed in 79.0.3945.79-1) forky: resolved (fixed in 79.0.3945.79-1) sid: resolved (fixed in 79.0.3945.79-1) trixie: resolved (fixed in 79.0.3945.7

CVE-2022-1134 [HIGH] CVE-2022-1134: chromium - Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote at... Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Scope: local bookworm: resolved (fixed in 100.0.4896.60-1) bullseye: resolved (fixed in 100.0.4896.60-1~deb11u1) forky: resolved (fixed in 100.0.4896.60-1) sid: resolved (fixed in 100.0.4896.60-1) trixie: resolved (fix

CVE-2019-13735 [HIGH] CVE-2019-13735: chromium - Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed... Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Scope: local bookworm: resolved (fixed in 79.0.3945.79-1) bullseye: resolved (fixed in 79.0.3945.79-1) forky: resolved (fixed in 79.0.3945.79-1) sid: resolved (fixed in 79.0.3945.79-1) trixie: resolve

CVE-2023-5857 [HIGH] CVE-2023-5857: chromium - Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.1... Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicious file. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 119.0.6045.105-1~deb12u1) bullseye: resolved (fixed in 119.0.6045.105-1~deb11u1) forky: resolved (fixed in 119.0.6045.105

CVE-2023-5472 [HIGH] CVE-2023-5472: chromium - Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a re... Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 118.0.5993.117-1~deb12u1) bullseye: resolved (fixed in 118.0.5993.117-1~deb11u1) forky: resolved (fixed in 118.0.5993.117-1) sid: reso

CVE-2023-6350 [HIGH] CVE-2023-6350: chromium - Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a rem... Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 119.0.6045.199-1~deb12u1) bullseye: resolved (fixed in 119.0.6045.199-1~deb11u1) forky: resolved (fixed in 119.0.6045.199-1) sid: resol

CVE-2024-2176 [HIGH] CVE-2024-2176: chromium - Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remot... Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 122.0.6261.111-1~deb12u1) bullseye: open forky: resolved (fixed in 122.0.6261.111-1) sid: resolved (fixed in 122.0.6261.111-1) trixie: re

CVE-2024-4331 [HIGH] CVE-2024-4331: chromium - Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 al... Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 124.0.6367.118-1~deb12u1) bullseye: open forky: resolved (fixed in 124.0.6367.118-1) sid: resolved (fixed in 124.0.6367.118-

CVE-2024-3834 [HIGH] CVE-2024-3834: chromium - Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a re... Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 124.0.6367.60-1~deb12u1) bullseye: open forky: resolved (fixed in 124.0.6367.60-1) sid: resolved (fixed in 124.0.6367.60-1) trixie: re

CVE-2025-7657 [HIGH] CVE-2025-7657: chromium - Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remo... Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 138.0.7204.157-1~deb12u1) bullseye: open forky: resolved (fixed in 138.0.7204.157-1) sid: resolved (fixed in 138.0.7204.157-1) trixie: r

CVE-2024-9965 [HIGH] CVE-2024-9965: chromium - Insufficient data validation in DevTools in Google Chrome on Windows prior to 13... Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 130.0.6723.58-1~deb12u1) bullseye: open forky: resolved (fixed in 130

CVE-2024-12693 [HIGH] CVE-2024-12693: chromium - Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allow... Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 131.0.6778.204-1~deb12u1) bullseye: open forky: resolved (fixed in 131.0.6778.204-1) sid: resolved (fixed in 131.0.6778.2

CVE-2025-13630 [HIGH] CVE-2025-13630: chromium - Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote at... Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 143.0.7499.40-1~deb12u1) bullseye: open forky: resolved (fixed in 143.0.7499.40-1) sid: resolved (fixed in 143.0.7499.40-1) trixie: resolve

CVE-2025-11756 [HIGH] CVE-2025-11756: chromium - Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed... Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 141.0.7390.107-1~deb12u1) bullseye: open forky: resolved (fixed in 141.0.7

CVE-2026-3537 [HIGH] CVE-2026-3537: chromium - Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.763... Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Scope: local bookworm: resolved (fixed in 145.0.7632.159-1~deb12u1) bullseye: open forky: resolved (fixed in 145.0.7632.159-1) sid: resolved (fixed in 145

CVE-2026-5859 [HIGH] CVE-2026-5859: chromium - Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remo... Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2026-0908 [HIGH] CVE-2026-0908: chromium - Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote... Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 144.0.7559.59-1~deb12u1) bullseye: open forky: resolved (fixed in 144.0.7559.59-1) sid: resolved (fixed in 144.0.7559.59-1) trixie: resolve

CVE-2025-11205 [HIGH] CVE-2025-11205: chromium - Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a... Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 141.0.7390.54-1~deb12u1) bullseye: open forky: resolved (fixed in 141.0.7390.54-1) sid: