Debian Chromium vulnerabilities

CVE-2019-13711 [MEDIUM] CVE-2019-13711: chromium - Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.390... Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Scope: local bookworm: resolved (fixed in 78.0.3904.87-1) bullseye: resolved (fixed in 78.0.3904.87-1) forky: resolved (fixed in 78.0.3904.87-1) sid: resolved (fixed in 78.0.3904.87-1) trixie: resolved (

CVE-2024-1672 [MEDIUM] CVE-2024-1672: chromium - Inappropriate implementation in Content Security Policy in Google Chrome prior t... Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 122.0.6261.57-1~deb12u1) bullseye: open forky: resolved (fixed in 122.0.6261.57-1) sid: resolved (fixed in

CVE-2023-4361 [MEDIUM] CVE-2023-4361: chromium - Inappropriate implementation in Autofill in Google Chrome on Android prior to 11... Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 116.0.5845.96-1~deb12u1) bullseye: resolved (fixed in 116.0.5845.96-1~deb11u1) forky: resolved (fixed in 116.0.58

CVE-2019-13680 [MEDIUM] CVE-2019-13680: chromium - Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allow... Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites via crafted TLS connections. Scope: local bookworm: resolved (fixed in 78.0.3904.87-1) bullseye: resolved (fixed in 78.0.3904.87-1) forky: resolved (fixed in 78.0.3904.87-1) sid: resolved (fixed in 78.0.3904.87-1) trixie: res

CVE-2025-5067 [MEDIUM] CVE-2025-5067: chromium - Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.5... Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 137.0.7151.55-3~deb12u1) bullseye: open forky: resolved (fixed in 137.0.7151.55-1) sid: resolved (fixed in 137.0.7151.55-1) trixie: res

CVE-2025-0996 [MEDIUM] CVE-2025-0996: chromium - Inappropriate implementation in Browser UI in Google Chrome on Android prior to ... Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 133.0.6943.98-1~deb12u1) bullseye: open forky: resolved (fixed in 133.0.6943.98-1) sid: resolved (

CVE-2025-5064 [MEDIUM] CVE-2025-5064: chromium - Inappropriate implementation in Background Fetch API in Google Chrome prior to 1... Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 137.0.7151.55-3~deb12u1) bullseye: open forky: resolved (fixed in 137.0.7151.55-1) sid: resolved (fixed in 137.0.7151.

CVE-2025-9867 [MEDIUM] CVE-2025-9867: chromium - Inappropriate implementation in Downloads in Google Chrome on Android prior to 1... Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 140.0.7339.80-1~deb12u1) bullseye: open forky: resolved (fixed in 140.0.7339.80-1) sid: resolved (fixed in 140.0.7339.80-

CVE-2025-3074 [MEDIUM] CVE-2025-3074: chromium - Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.5... Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 135.0.7049.52-1~deb12u1) bullseye: open forky: resolved (fixed in 135.0.7049.52-1) sid: resolved (fixed in 135.0.7049.52-1) trixie: res

CVE-2025-3073 [MEDIUM] CVE-2025-3073: chromium - Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52... Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 135.0.7049.52-1~deb12u1) bullseye: open forky: resolved (fixed in 135.0.7049.52-1

CVE-2025-3072 [MEDIUM] CVE-2025-3072: chromium - Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049... Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 135.0.7049.52-1~deb12u1) bullseye: open forky: resolved (fixed in 135.0.7049.5

CVE-2025-3071 [MEDIUM] CVE-2025-3071: chromium - Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049... Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 135.0.7049.52-1~deb12u1) bullseye: open forky: resolved (fixed in 135.0.

CVE-2025-9865 [MEDIUM] CVE-2025-9865: chromium - Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140... Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 140.0.7339.80-1~deb12u1) bullseye: open forky: resolved (fixed i

CVE-2025-12435 [MEDIUM] CVE-2025-12435: chromium - Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444... Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 142.0.7444.59-1~deb12u1) bullseye: open forky: resolved (fixed in 142.0.7444.59-1) sid: resolved (fixed in 142.0.7444.59-1) trix

CVE-2025-11210 [MEDIUM] CVE-2025-11210: chromium - Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 ... Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 141.0.7390.54-1~deb12u1) bullseye: open forky: resolved (fixed in 141.0.7390.

CVE-2025-13632 [MEDIUM] CVE-2025-13632: chromium - Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41... Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 143.0.7499.40-1~deb12u1) bullseye: open forky: resolved (fixe

CVE-2025-6556 [MEDIUM] CVE-2025-6556: chromium - Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.4... Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 138.0.7204.49-1~deb12u1) bullseye: open forky: resolved (fixed in 138.0.7204.49-1) sid: resolved (fixed in 138.0.7204.49-1)

CVE-2024-0333 [MEDIUM] CVE-2024-0333: chromium - Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.... Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 120.0.6099.216-1~deb12u1) bullseye: resolved (fixed in 120.0.6099.216-1~deb11u1) forky: resolve

CVE-2025-13097 [MEDIUM] CVE-2025-13097: chromium - Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59... Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) Scope: local bookworm: resolved (fixed in 136.0.7103.59-2~deb12u2) bullseye: open forky: resolved (fixed in 136.0.7103.59-2) sid: resolved (fixed in 136.0.7

CVE-2025-12440 [MEDIUM] CVE-2025-12440: chromium - Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59... Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) Scope: local bookworm: resolved (fixed in 142.0.7444.59-1~deb12u1) bullseye: ope