Debian Chromium vulnerabilities

CVE-2020-6412 [MEDIUM] CVE-2020-6412: chromium - Insufficient validation of untrusted input in Omnibox in Google Chrome prior to ... Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Scope: local bookworm: resolved (fixed in 80.0.3987.106-1) bullseye: resolved (fixed in 80.0.3987.106-1) forky: resolved (fixed in 80.0.3987.106-1) sid: resolved (fixed in 80.

CVE-2020-6411 [MEDIUM] CVE-2020-6411: chromium - Insufficient validation of untrusted input in Omnibox in Google Chrome prior to ... Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Scope: local bookworm: resolved (fixed in 80.0.3987.106-1) bullseye: resolved (fixed in 80.0.3987.106-1) forky: resolved (fixed in 80.0.3987.106-1) sid: resolved (fixed in 80.

CVE-2021-30539 [MEDIUM] CVE-2021-30539: chromium - Insufficient policy enforcement in content security policy in Google Chrome prio... Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Scope: local bookworm: resolved (fixed in 93.0.4577.82-1) bullseye: resolved (fixed in 93.0.4577.82-1) forky: resolved (fixed in 93.0.4577.82-1) sid: resolved (fixed in 93.0.4577.82-

CVE-2022-3201 [MEDIUM] CVE-2022-3201: chromium - Insufficient validation of untrusted input in DevTools in Google Chrome on Chrom... Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 106.0.5249.61-1) bullseye: resolved (fixed in 10

CVE-2023-4359 [MEDIUM] CVE-2023-4359: chromium - Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 11... Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 116.0.5845.96-1~deb12u1) bullseye: resolved (fixed in 116.0.5845.96-1~deb11u1) forky: resolved (

CVE-2026-2322 [MEDIUM] CVE-2026-2322: chromium - Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.... Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 145.0.7632.75-1~deb12u1) bullseye: open forky: resolved (fixed in 145.0.7632.45

CVE-2026-0901 [MEDIUM] CVE-2026-0901: chromium - Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0... Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 144.0.7559.59-1~deb12u1) bullseye: open forky: resolved (fixed in 144.0.7559.59-1) sid: resolved (fixed in 144.0.7559.59-1) tri

CVE-2025-6555 [MEDIUM] CVE-2025-6555: chromium - Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a re... Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 138.0.7204.49-1~deb12u1) bullseye: open forky: resolved (fixed in 138.0.7204.49-1) sid: resolved (fixed in 138.0.7204.49-1) trixie

CVE-2026-3063 [MEDIUM] CVE-2026-3063: chromium - Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.11... Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via DevTools. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 145.0.7632.116-1~deb12u1) bullseye: open forky: resolved (fixed in 145.

CVE-2026-0904 [MEDIUM] CVE-2026-0904: chromium - Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.755... Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 144.0.7559.59-1~deb12u1) bullseye: open forky: resolved (fixed in 144.0.7559.59-1) sid: resolved (fixed in 144.0.7559.59-1) t

CVE-2026-5895 [MEDIUM] CVE-2026-5895: chromium - Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 ... Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. (Chromium security severity: Low) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2024-9966 [MEDIUM] CVE-2024-9966: chromium - Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723... Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 130.0.6723.58-1~deb12u1) bullseye: open forky: resolved (fixed in 130.0.6723.58-1) sid: resolved (fixed in 130.0.6723.58-1

CVE-2026-5886 [MEDIUM] CVE-2026-5886: chromium - Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 al... Out of bounds read in WebAudio in Google Chrome on Mac prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: open bullseye: open forky: open sid: resolved (fixed in 147.0.7727.55-1) trixie: open

CVE-2025-12909 [MEDIUM] CVE-2025-12909: chromium - Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339... Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 140.0.7339.80-1~deb12u1) bullseye: open forky: resolved (fixed in 140.0.7339.80-1) sid: resolved (fixed in 140.0.7339.80-1) trixie: resolve

CVE-2021-21140 [MEDIUM] CVE-2021-21140: chromium - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local ... Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB device. Scope: local bookworm: resolved (fixed in 88.0.4324.96-0.1) bullseye: resolved (fixed in 88.0.4324.96-0.1) forky: resolved (fixed in 88.0.4324.96-0.1) sid: resolved (fixed in 88.0.4324.96-0.1) trixie: re

CVE-2022-3048 [MEDIUM] CVE-2022-3048: chromium - Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome ... Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device. Scope: local bookworm: resolved (fixed in 105.0.5195.52-1) bullseye: resolved (fixed in 105.0.5195.52-1~deb11u1) forky: resolved (fixed in 105.0.5195.52-1)

CVE-2021-37999 [MEDIUM] CVE-2021-37999: chromium - Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638... Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML in a new browser tab via a crafted HTML page. Scope: local bookworm: resolved (fixed in 97.0.4692.71-0.1) bullseye: resolved (fixed in 97.0.4692.71-0.1~deb11u1) forky: resolved (fixed in 97.0.4692.71-0.1) sid: resolved

CVE-2022-1492 [MEDIUM] CVE-2022-1492: chromium - Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.49... Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. Scope: local bookworm: resolved (fixed in 101.0.4951.41-1) bullseye: resolved (fixed in 101.0.4951.41-1~deb11u1) forky: resolved (fixed in 101.0.4951.41-1) sid: resolved (fixed in 101.0.4951.41-

CVE-2024-8907 [MEDIUM] CVE-2024-8907: chromium - Insufficient data validation in Omnibox in Google Chrome on Android prior to 129... Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 129.0.6668.58-1~deb12u1) bullseye: open

CVE-2020-6425 [MEDIUM] CVE-2020-6425: chromium - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.398... Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. Scope: local bookworm: resolved (fixed in 80.0.3987.149-1) bullseye: resolved (fixed in 80.0.3987.149-1) forky: resolved (fixed in 80.0.3987.149-1) si