From: ftpmaster@ftp-master.debian.org 
  
 -----BEGIN PGP SIGNED MESSAGE----- 
 Hash: SHA256 
  
 Format: 1.8 
 Date: Wed, 29 Oct 2025 13:44:37 -0400 
 Source: chromium 
 Architecture: source 
 Version: 142.0.7444.59-1~deb13u1 
 Distribution: trixie-security 
 Urgency: high 
 Maintainer: Debian Chromium Team  
 Changed-By: Andres Salomon  
 Changes: 
  chromium (142.0.7444.59-1~deb13u1) trixie-security; urgency=high 
  . 
    * New upstream stable release. 
      - CVE-2025-12428: Type Confusion in V8. 
        Reported by Man Yue Mo of GitHub Security Lab. 
      - CVE-2025-12429: Inappropriate implementation in V8. 
        Reported by Aorui Zhang. 
      - CVE-2025-12430: Object lifecycle issue in Media. 
        Reported by round.about. 
      - CVE-2025-12431: Inappropriate implementation in Extensions. 
        Reported by Alesandro Ortiz. 
      - CVE-2025-12432: Race in V8. Reported by Google Big Sleep. 
      - CVE-2025-12433: Inappropriate implementation in V8. 
        Reported by Google Big Sleep. 
      - CVE-2025-12036: Inappropriate implementation in V8. 
        Reported by Google Big Sleep. 
      - CVE-2025-12434: Race in Storage. Reported by Lijo A.T. 
      - CVE-2025-12435: Incorrect security UI in Omnibox. Reported by 
 Hafiizh. 
      - CVE-2025-12436: Policy bypass in Extensions. 
        Reported by Luan Herrera (@lbherrera_). 
      - CVE-2025-12437: Use after free in PageInfo. Reported by Umar Farooq. 
      - CVE-2025-12438: Use after free in Ozone. 
        Reported by Wei Yuan of MoyunSec VLab. 
      - CVE-2025-12439: Inappropriate implementation in App-Bound Encryption. 
        Reported by Ari Novick. 
      - CVE-2025-12440: Inappropriate implementation in Autofill. 
        Reported by Khalil Zhani. 
      - CVE-2025-12441: Out of bounds read in V8. Reported by Google Big 
 Sleep. 
      - CVE-2025-12443: Out of bounds read in WebXR. Reported by Aisle 
 Research 
      - CVE-2025-12444: Incorrect security UI in Fullscreen UI. 
        Reported by syrf. 
      - CVE-2025-12445: Policy bypass in Extensions. Reported by Thomas 
 Greiner 
      - CVE-2025-12446: Incorrect security UI in SplitView. Reported by 
 Hafiizh 
      - CVE-2025-12447: Incorrect security UI in Omnibox. 
        Reported by Khalil Zhani. 
    * d/patches: 
      - disable/android.patch: drop part of patch related to md5sum tool. 
      - disable/catapult.patch: refresh. 
      - bookworm/clang19.patch: also drop uninit-const-pointer and 
        unnecessary-virtual-specifier warnings. 
      - ungoogled/disable-privacy-sandbox.patch: sync from upstream. 
      - i386/support-i386.patch: refresh. 
      - trixie/rust-sanitize.patch: add a workaround for older rustc. 
      - fixes/chromium-142-iwyu-field-form-data.patch: pull in build fix 
        from gentoo. 
      - trixie/rust-no-alloc-shim.patch: add another missing symbol that's 
        provided by newer versions of rust. 
  . 
    [ Timothy Pearson ] 
    * d/patches/ppc64le: 
      - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to 
        upstream fixes 
      - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate 
 from 
        upstream sources 
      - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream 
        changes 
 Checksums-Sha1: 
  ec83590b7c5c69438624a76728259c2385013ddf 4023 chromium_142.0.74 
 4.59-1~deb13u1.dsc 
  284c56effdbdea38b4f895d2a8b17cc9078ecf68 1007003032 chromium_14 
 .0.7444.59.orig.tar.xz 
  6703b81b535fa1f421fa01c3a5c140f01b70a6fc 418840 chromium_142.0. 
 444.59-1~deb13u1.debian.tar.xz 
  34ecb412973c3fad3651b43d8484e8ac969419a8 26537 chromium_142.0.7 
 44.59-1~deb13u1_source.buildinfo 
 Checksums-Sha256: 
  3d032ae3021cced360abfe12a163d405ed5ee75bf307544f20dcb4a0dc317768 4023 
 chromium_142.0.7444.59-1~deb13u1.dsc 
  7fedcc6cf4acafeb36ca8773264b3ee06fea6f072884d320a35009fa07ef056b 1007003032 
 chromium_142.0.7444.59.orig.tar.xz 
  188046dfbd67db9acd7de15f6b62180b5ee3738e3f1480f2a565008e1f244edb 418840 
 chromium_142.0.7444.59-1~deb13u1.debian.tar.xz 
  2b5e902acd7bd6c2ec4841da96b8aee73c07e1e1ff082d1af5ecda367eb3b596 26537 
 chromium_142.0.7444.59-1~deb13u1_source.buildinfo 
 Files: 
  fc146654107ef2937bf62554a0caeaa0 4023 web optional chromium_142 
 0.7444.59-1~deb13u1.dsc 
  4af26316f53be13d6f9f47595c145a5f 1007003032 web optional chromi 
 m_142.0.7444.59.orig.tar.xz 
  e3c07e117cb6889af54b36b952a71a1a 418840 web optional chromium_1 
 2.0.7444.59-1~deb13u1.debian.tar.xz 
  f2a2c9236ea8226d147f905a4192de48 26537 web optional chromium_14 
 .0.7444.59-1~deb13u1_source.buildinfo 
  
 -----BEGIN PGP SIGNATURE----- 
  
 iQJIBAEBCAAyFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmkCtugUHGRpbGluZ2Vy 
 QGRlYmlhbi5vcmcACgkQZF0CR8Nudjcxaw/+L0f99YAjwALfeIpzsj+WDUCkiu6J 
 goKMghPqAlsOMCoxkIRWGQ2blWtc2NkWKAQE/dECaqfYjmGAT1v+pXNYt8Jabjz8 
 FfeuTMc8ncdvNDqF9/rBJOyQT7E0Obaqc8PFaz5NztNOToT9nzBITVnapinIETSJ 
 LOtqnCL672yVYBByFHW6sa9ZkcYEVvfB4aSqwlb/R1qqT49Z1yg0DPd2fdERETjc 
 Y3bU+g8yRZBuZSYmWgCNK0oZjF3jCBSikep9FDt+vklsrWKPYUy25THVytYYw3yq 
 WtSgq1YSaetC2JC62kq9oLU4l6lCAGdhCraOJUqqxBdeU+0Ci9+XJtpjP2TpZrk4 
 Oub+SqVChUWPU0betIPg+SgnP4IE1qRhc/8sBGZ6EO2A6Oq1Bj2Yg/lWoKCxDhk7 
 DZgWtiDIOlunOkV6JnNQcTN19AHWE7mF8Q+3gFqc6D8NR1ClPPop/1zWpRuv/Eoz 
 vyfE895aO2uwyxxl7eD2SgsYx33/9jmHKgNt9PeQawKV/TAedj1vRuNUMKNo2D0M 
 AJYA7mO3qOeHQY2gp+HH3y/yk0133j+Zd1YorRqTfpOy58iKzQ74q5Pepr6G8PxI 
 g08SlGRxBPajC07uACh2YM75D5V1SsQ4NukWuTmN0TtPtwZFm6MoLi/1HY5PP9cy 
 +eduqHflgpVYo0Y= 
 =u4Mm 
 -----END PGP SIGNATURE----- 
  
  
 --============== 93397054015517568=Content-Type: application/pgp-signature 
  
 -----BEGIN PGP SIGNATURE----- 
  
 iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaQYIVAAKCRCb9qggYcy5 
 IfDZAQCiNyTXDNcAWGoM8S2wrpge4SHUGHnnpJX9PshxJTGp5QEAir8fieF8MjvL 
 9gKu3Uu+UsEm1xXHeAkLcwaSkvfBPwE€u/ 
 -----END PGP SIGNATURE----- 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)