Debian Chromium vulnerabilities

CVE-2025-0443 [HIGH] CVE-2025-0443: chromium - Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.... Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 132.0.6834.83-1~deb12u1) bullseye: open forky: resolved (fixed in 132

CVE-2025-4050 [HIGH] CVE-2025-4050: chromium - Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 ... Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 136.0.7103.59-2~deb12u2) bullseye: open forky: resolved (fixed in

CVE-2024-11112 [HIGH] CVE-2024-11112: chromium - Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allow... Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 131.0.6778.85-1~deb12u1) bullseye: open forky: resolved (fixed in 131.0.6778.85-1) sid: resolved (fixed in 131.0.6778.85-1)

CVE-2024-8639 [HIGH] CVE-2024-8639: chromium - Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 a... Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 128.0.6613.137-1~deb12u1) bullseye: open forky: resolved (fixed in 128.0.6613.137-1) sid: resolved (fixed in 128.0.6613.137

CVE-2024-9959 [HIGH] CVE-2024-9959: chromium - Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a rem... Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 130.0.6723.58-1~deb12u1) bullseye: open forky: resolved (fixed in 130.0.6723.58-1) si

CVE-2025-1918 [HIGH] CVE-2025-1918: chromium - Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a r... Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 134.0.6998.35-1~deb12u1) bullseye: open forky: resolved (fixed in 134.0.6998.35-1) sid: resolved (fixed in 134.0.6998.35

CVE-2025-1914 [HIGH] CVE-2025-1914: chromium - Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remot... Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 134.0.6998.35-1~deb12u1) bullseye: open forky: resolved (fixed in 134.0.6998.35-1) sid: resolved (fixed in 134.0.6998.35-1) trixie: resol

CVE-2025-2137 [HIGH] CVE-2025-2137: chromium - Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remot... Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 134.0.6998.88-1~deb12u1) bullseye: open forky: resolved (fixed in 134.0.6998.88-1) sid: resolved (fixed in 134.0.6998.88-1) trixie: res

CVE-2024-3176 [HIGH] CVE-2024-3176: chromium - Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allow... Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 117.0.5938.62-1~deb12u1) bullseye: resolved (fixed in 117.0.5938.62-1~deb11u1) forky: resolved (fixed in 117.0.5938.62-1) sid

CVE-2025-0762 [HIGH] CVE-2025-0762: chromium - Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a re... Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 132.0.6834.159-1~deb12u1) bullseye: open forky: resolved (fixed in 132.0.6834.159-1) sid: resolved (fixed in 132.0.6834.159-1

CVE-2024-3168 [HIGH] CVE-2024-3168: chromium - Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a rem... Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 122.0.6261.57-1~deb12u1) bullseye: open forky: resolved (fixed in 122.0.6261.57-1) sid: resolved (fixed in 122.0.6261.57-1) trixie: r

CVE-2025-8879 [HIGH] CVE-2025-8879: chromium - Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed ... Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 139.0.7258.127-1~deb12u1) bullseye: open forky: resolved (fixed in 139.0.7258.127-1) sid: resolved (fixed in 139.0.7258.127-

CVE-2025-12725 [HIGH] CVE-2025-12725: chromium - Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137... Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 142.0.7444.134-1~deb12u1) bullseye: open forky: resolved (fixed in 142.0.7444.134-1) sid: resolved (fixed in 142.0.74

CVE-2025-8882 [HIGH] CVE-2025-8882: chromium - Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote... Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 139.0.7258.127-1~deb12u1) bullseye: open forky: resolved (fixed in 139.0.7258.127

CVE-2024-3173 [HIGH] CVE-2024-3173: chromium - Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 ... Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 120.0.6099.71-1~deb12u1) bullseye: resolved (fixed in 120.0.6099.71-1~deb11u1) forky: resolved (fixed in 120.0.6099.71-1) s

CVE-2023-4070 [HIGH] CVE-2023-4070: chromium - Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote a... Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 115.0.5790.170-1~deb12u1) bullseye: resolved (fixed in 115.0.5790.170-1~deb11u1) forky: resolved (fixed in 115.0.5790.170-1) sid: resolved (fixed i

CVE-2024-2886 [HIGH] CVE-2024-2886: chromium - Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a re... Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 123.0.6312.86-1~deb12u1) bullseye: open forky: resolved (fixed in 123.0.6312.86-1) sid: resolved (fixed in 123.0.6312.86-1) trixie: resolved

CVE-2021-30609 [HIGH] CVE-2021-30609: chromium - Chromium: CVE-2021-30609 Use after free in Sign-In Chromium: CVE-2021-30609 Use after free in Sign-In Scope: local bookworm: resolved (fixed in 93.0.4577.82-1) bullseye: resolved (fixed in 93.0.4577.82-1) forky: resolved (fixed in 93.0.4577.82-1) sid: resolved (fixed in 93.0.4577.82-1) trixie: resolved (fixed in 93.0.4577.82-1)

CVE-2021-30624 [HIGH] CVE-2021-30624: chromium - Chromium: CVE-2021-30624 Use after free in Autofill Chromium: CVE-2021-30624 Use after free in Autofill Scope: local bookworm: resolved (fixed in 93.0.4577.82-1) bullseye: resolved (fixed in 93.0.4577.82-1) forky: resolved (fixed in 93.0.4577.82-1) sid: resolved (fixed in 93.0.4577.82-1) trixie: resolved (fixed in 93.0.4577.82-1)

CVE-2021-30622 [HIGH] CVE-2021-30622: chromium - Chromium: CVE-2021-30622 Use after free in WebApp Installs Chromium: CVE-2021-30622 Use after free in WebApp Installs Scope: local bookworm: resolved (fixed in 93.0.4577.82-1) bullseye: resolved (fixed in 93.0.4577.82-1) forky: resolved (fixed in 93.0.4577.82-1) sid: resolved (fixed in 93.0.4577.82-1) trixie: resolved (fixed in 93.0.4577.82-1)