chromium (142.0.7444.175-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-13223: Type Confusion in V8.
      Reported by Clément Lecigne of Google's Threat Analysis Group.
    - CVE-2025-13224: Type Confusion in V8. Reported by Google Big Sleep.

 -- Andres Salomon <dilinger@debian.org>  Tue, 18 Nov 2025 13:11:29 -0500

chromium (142.0.7444.162-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-13042: Inappropriate implementation in V8.
      Reported by 303f06e3.

 -- Andres Salomon <dilinger@debian.org>  Wed, 12 Nov 2025 00:42:36 -0500

chromium (142.0.7444.134-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-12725: Out of bounds write in WebGPU. Reported by Anonymous.
    - CVE-2025-12726: Inappropriate implementation in Views.
      Reported by Alesandro Ortiz.
    - CVE-2025-12727: Inappropriate implementation in V8.
      Reported by 303f06e3.
    - CVE-2025-12728: Inappropriate implementation in Omnibox.
      Reported by Hafiizh.
    - CVE-2025-12729: Inappropriate implementation in Omnibox.
      Reported by Khalil Zhani.

 -- Andres Salomon <dilinger@debian.org>  Wed, 05 Nov 2025 21:47:42 -0500

chromium (142.0.7444.59-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2025-12428: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2025-12429: Inappropriate implementation in V8.
      Reported by Aorui Zhang.
    - CVE-2025-12430: Object lifecycle issue in Media.
      Reported by round.about.
    - CVE-2025-12431: Inappropriate implementation in Extensions.
      Reported by Alesandro Ortiz.
    - CVE-2025-12432: Race in V8. Reported by Google Big Sleep.
    - CVE-2025-12433: Inappropriate implementation in V8.
      Reported by Google Big Sleep.
    - CVE-2025-12036: Inappropriate implementation in V8.
      Reported by Google Big Sleep.
    - CVE-2025-12434: Race in Storage. Reported by Lijo A.T.
    - CVE-2025-12435: Incorrect security UI in Omnibox. Reported by Hafiizh.
    - CVE-2025-12436: Policy bypass in Extensions.
      Reported by Luan Herrera (@lbherrera_).
    - CVE-2025-12437: Use after free in PageInfo. Reported by Umar Farooq.
    - CVE-2025-12438: Use after free in Ozone.
      Reported by Wei Yuan of MoyunSec VLab.
    - CVE-2025-12439: Inappropriate implementation in App-Bound Encryption.
      Reported by Ari Novick.
    - CVE-2025-12440: Inappropriate implementation in Autofill.
      Reported by Khalil Zhani.
    - CVE-2025-12441: Out of bounds read in V8. Reported by Google Big Sleep.
    - CVE-2025-12443: Out of bounds read in WebXR. Reported by Aisle Research
    - CVE-2025-12444: Incorrect security UI in Fullscreen UI.
      Reported by syrf.
    - CVE-2025-12445: Policy bypass in Extensions. Reported by Thomas Greiner
    - CVE-2025-12446: Incorrect security UI in SplitView. Reported by Hafiizh
    - CVE-2025-12447: Incorrect security UI in Omnibox.
      Reported by Khalil Zhani.
  * d/patches:
    - disable/android.patch: drop part of patch related to md5sum tool.
    - disable/catapult.patch: refresh.
    - bookworm/clang19.patch: also drop uninit-const-pointer and
      unnecessary-virtual-specifier warnings.
    - ungoogled/disable-privacy-sandbox.patch: sync from upstream.
    - i386/support-i386.patch: refresh.
    - trixie/rust-sanitize.patch: add a workaround for older rustc.
    - fixes/chromium-142-iwyu-field-form-data.patch: pull in build fix
      from gentoo.
    - trixie/rust-no-alloc-shim.patch: add another missing symbol that's
      provided by newer versions of rust.
    - bookworm/gn-path-exists2.patch: add another workaround for lack of
      path_exists() in older gn.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to
      upstream fixes
    - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
      upstream sources
    - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
      changes

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-third-party-hwy-wrong-include.patch: Drop due to
      upstream fixes
    - ppc64le/third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from
      upstream sources
    - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
      changes

 -- Andres Salomon <dilinger@debian.org>  Wed, 29 Oct 2025 13:44:37 -0400

chromium (141.0.7390.122-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-12036: Inappropriate implementation in V8.
      Reported by Google Big Sleep.

 -- Andres Salomon <dilinger@debian.org>  Tue, 21 Oct 2025 22:21:26 -0400

chromium (141.0.7390.107-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-11756: Use after free in Safe Browsing. Reported by asnine.
  * Suggest --disable-gpu to bug reporters and in README.Debian.

 -- Andres Salomon <dilinger@debian.org>  Tue, 14 Oct 2025 19:25:54 -0400

chromium (141.0.7390.65-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-11458: Heap buffer overflow in Sync.
      Reported by raven at KunLun lab.
    - CVE-2025-11460: Use after free in Storage. Reported by Sombra.
    - CVE-2025-11211: Out of bounds read in WebCodecs.
      Reported by Jakob Košir.

 -- Andres Salomon <dilinger@debian.org>  Tue, 07 Oct 2025 20:11:58 -0400

chromium (141.0.7390.54-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2025-11205: Heap buffer overflow in WebGPU.
      Reported by Atte Kettunen of OUSPG.
    - CVE-2025-11206: Heap buffer overflow in Video. Reported by Elias Hohl.
    - CVE-2025-11207: Side-channel information leakage in Storage.
      Reported by Alesandro Ortiz.
    - CVE-2025-11208: Inappropriate implementation in Media.
      Reported by Kevin Joensen.
    - CVE-2025-11209: Inappropriate implementation in Omnibox.
      Reported by Hafiizh.
    - CVE-2025-11210: Side-channel information leakage in Tab.
      Reported by Umar Farooq.
    - CVE-2025-11211: Out of bounds read in Media. Reported by Kosir Jakob.
    - CVE-2025-11212: Inappropriate implementation in Media.
      Reported by Ameen Basha M K.
    - CVE-2025-11213: Inappropriate implementation in Omnibox.
      Reported by Hafiizh.
    - CVE-2025-11215: Off by one error in V8. Reported by Google Big Sleep.
    - CVE-2025-11216: Inappropriate implementation in Storage.
      Reported by Farras Givari.
    - CVE-2025-11219: Use after free in V8. Reported by Google Big Sleep.
  * d/patches:
    - fixes/rust-clanglib.patch: refresh.
    - trixie/rust-no-alloc-shim.patch: refresh.
    - ungoogled/disable-privacy-sandbox.patch: update from ungoogled.
    - fixes/gentoo-stylesheet.patch: add patch from gentoo to fix build.
    - fixes/libcpp-headers.patch: add build fix for unbundling clang.
  * d/rules: set rtc_video_psnr=false for bookworm's older openh264.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - sandbox/0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch: Refresh for
      upstream changes
    - fixes/fix-rustc.patch: Refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Wed, 01 Oct 2025 02:24:37 -0400

chromium (140.0.7339.207-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-10890: Side-channel information leakage in V8.
      Reported by Mate Marjanović (SharpEdged).
    - CVE-2025-10891: Integer overflow in V8. Reported by Google Big Sleep.
    - CVE-2025-10892: Integer overflow in V8. Reported by Google Big Sleep.

 -- Andres Salomon <dilinger@debian.org>  Tue, 23 Sep 2025 16:50:58 -0400

chromium (140.0.7339.185-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-10585: Type Confusion in V8.
      Reported by Google Threat Analysis Group.
    - CVE-2025-10500: Use after free in Dawn.
      Reported by Giunash (Gyujeong Jin).
    - CVE-2025-10501: Use after free in WebRTC. Reported by sherkito.
    - CVE-2025-10502: Heap buffer overflow in ANGLE.
      Reported by Google Big Sleep.

 -- Andres Salomon <dilinger@debian.org>  Wed, 17 Sep 2025 22:25:31 -0400

chromium (140.0.7339.127-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2025-10200: Use after free in Serviceworker.
      Reported by Looben Yang.
    - CVE-2025-10201: Inappropriate implementation in Mojo.
      Reported by Sahan Fernando & Anon.

  [ Jianfeng Liu ]
  * drop not working fixes/libsync-rk3588-panthor.patch.
  * drop fixes/strlcpy.patch, which isn't needed w/ clang-19.

 -- Andres Salomon <dilinger@debian.org>  Tue, 09 Sep 2025 17:50:07 -0400

chromium (140.0.7339.80-1~deb12u1) bookworm-security; urgency=medium

  * New upstream stable release.
    - CVE-2025-9864: Use after free in V8.
      Reported by Pavel Kuzmin of Yandex Security Team.
    - CVE-2025-9865: Inappropriate implementation in Toolbar.
      Reported by Khalil Zhani.
    - CVE-2025-9866: Inappropriate implementation in Extensions.
      Reported by NDevTK.
    - CVE-2025-9867: Inappropriate implementation in Downloads.
      Reported by Farras Givari.
  * d/patches:
    - fixes/armhf-icf.patch: refresh.
    - disable/tests.patch: refresh.
    - disable/catapult.patch: refresh.
    - disable/widevine-cdm-cu.patch: refresh (and make it shorter).
    - bookworm/clang19.patch: refresh.
    - disable/android.patch: delete a new reference to chrome/android/.
    - disable/buildtools-libc.patch: drop due to upstream cleanups.
    - trixie/rust-no-alloc-shim.patch: add a build fix for older rustc.
    - bookworm/rust-visibility.patch: drop, not needed w/ new rust 1.85.
    - bookworm/crabbyav1f.patch: drop, not needed w/ new rust 1.85.
    - bookworm/toktrie-utf8chunks.patch: drop, not needed w/ new rust.
    - bookworm/derivre-create.patch: drop, not needed w/ new rust.
    - bookworm/rust-split-at-checked.patch: drop, not needed w/ new rust.
    - bookworm/crabbyav1f-macro-scope.patch: drop, not needed w/ new rust.
    - bookworm/rust-box-to-vec.patch: drop, not needed w/ new rust.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0002-regenerate-xnn-buildgn.patch: Refresh for upstream
      changes
    - fixes/fix-study-crash.patch: Refresh for upstream changes
    - core/add-ppc64-architecture-to-extensions.diff: Refresh for upstream
      changes
    - fixes/fix-unknown-warning-option-messages.diff: Refresh for upstream
      changes
    - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch:
      Regenerate from new upstream version
    - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
      Regenerate from new upstream version

 -- Andres Salomon <dilinger@debian.org>  Thu, 04 Sep 2025 16:47:14 -0400

chromium (139.0.7258.154-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-9478: Use after free in ANGLE.
      Reported by Google Big Sleep.
  * d/patches/bookworm/stdarch-arm.patch: drop to fix FTBFS on arm64
    with newer rustc-web.

 -- Andres Salomon <dilinger@debian.org>  Tue, 26 Aug 2025 17:38:45 -0400

chromium (139.0.7258.138-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-9132: Out of bounds write in V8.
      Reported by Google Big Sleep.

 -- Andres Salomon <dilinger@debian.org>  Tue, 19 Aug 2025 18:51:36 -0400

chromium (139.0.7258.127-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-8879: Heap buffer overflow in libaom. Reported by Anonymous
    - CVE-2025-8880: Race in V8. Reported by Seunghyun Lee (@0x10n).
    - CVE-2025-8901: Out of bounds write in ANGLE.
      Reported by Google Big Sleep.
    - CVE-2025-8881: Inappropriate implementation in File Picker.
      Reported by Alesandro Ortiz.
    - CVE-2025-8882: Use after free in Aura. Reported by Umar Farooq.

 -- Andres Salomon <dilinger@debian.org>  Tue, 12 Aug 2025 17:12:12 -0400

chromium (139.0.7258.66-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2025-8576: Use after free in Extensions. Reported by asnine.
    - CVE-2025-8577: Inappropriate implementation in Picture In Picture.
      Reported by Umar Farooq.
    - CVE-2025-8578: Use after free in Cast. Reported by Fayez.
    - CVE-2025-8579: Inappropriate implementation in Gemini Live in
      Chrome. Reported by Alesandro Ortiz.
    - CVE-2025-8580: Inappropriate implementation in Filesystems.
      Reported by Huuuuu.
    - CVE-2025-8581: Inappropriate implementation in Extensions.
      Reported by Vincent Dragnea.
    - CVE-2025-8582: Insufficient validation of untrusted input in DOM.
      Reported by Anonymous.
    - CVE-2025-8583: Inappropriate implementation in Permissions.
      Reported by Shaheen Fazim.
  * d/copyright: delete third_party/enterprise_companion, as it includes
    a binary.
  * d/control:
    - Replace elfutils build-dep with llvm-19 for switch to llvm-strip.
    - Update rustc-web build-dep to >= 1.84.
  * d/rules:
    - drop enable_nacl=false; upstream removed NaCL.
    - set enable_enterprise_companion=false.
    - disable Gemini AI (enable_glic=false).
  * d/patches:
    - disable/catapult.patch: refresh.
    - disable/buildtools-libc.patch: refresh.
    - system/eu-strip.patch: drop, upstream switched to llvm-strip.
    - bookworm/gn-revert-path-exists.patch: refresh & drop unused part.
    - ungoogled/disable-privacy-sandbox.patch: refresh.
    - fixes/bindgen.patch: rename to bookworm/bindgen.patch, since trixie
      now has a newer bindgen.
    - bookworm/gn-absl.patch: refresh.
    - bookworm/rust-is-none-or.patch: drop, thanks to newer rustc-web.
    - bookworm/rust-unstable-features.patch: drop - newer rustc-web.
    - bookworm/bubble-contents.patch: drop, no longer needed.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - sandbox/0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
      Refresh for upstream changes
    - sandbox/0009-sandbox-updates-138.patch: Properly handle IPC and send
      syscalls
    - third_party/0001-add-xnn-ppc64el-support.patch: Refresh for upstream
      changes
    - third_party/0002-regenerate-xnn-buildgn.patch: Regenerate from upstream
      sources
    - third_party/skia-vsx-instructions.patch: Refresh for upstream changes
    - fixes/fix-partition-alloc-compile.patch: Refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 05 Aug 2025 17:48:13 -0400

chromium (138.0.7204.183-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-8292: Use after free in Media Stream.

 -- Andres Salomon <dilinger@debian.org>  Tue, 29 Jul 2025 18:59:44 -0400

chromium (138.0.7204.168-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-8010: Type Confusion in V8. Reported by Shaheen Fazim.
    - CVE-2025-8011: Type Confusion in V8. Reported by Shaheen Fazim.
  * d/patches/ppc64le/sandbox:
    - 0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
      refresh.

 -- Andres Salomon <dilinger@debian.org>  Thu, 24 Jul 2025 13:43:34 -0400

chromium (138.0.7204.157-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2025-7656: Integer overflow in V8. Reported by Shaheen Fazim.
    - CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and
      GPU. Reported by Clément Lecigne and Vlad Stolyarov of Google's
      Threat Analysis Group.
    - CVE-2025-7657: Use after free in WebRTC. Reported by jakebiles.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - fixes/fix-page-allocator-overflow.patch: add to fix sporadic
      partition allocator failures on ppc64el systems.
    - third_party/use-sysconf-page-size-on-ppc64.patch: drop, no longer
      needed.

 -- Andres Salomon <dilinger@debian.org>  Tue, 15 Jul 2025 15:35:02 -0400

chromium (138.0.7204.92-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-6554: Type Confusion in V8. Reported by
      Clément Lecigne of Google's Threat Analysis Group.
  * Add lintian override for embedded libjsoncpp in
    libtest_trace_processor.so.
  * Drop the text about extensions from d/presubj, and instead ask bug
    reporters to include output from chrome://gpu which is super useful.

 -- Andres Salomon <dilinger@debian.org>  Tue, 01 Jul 2025 13:17:05 -0400

chromium (138.0.7204.49-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-6555: Use after free in Animation.
      Reported by Lyra Rebane (rebane2001).
    - CVE-2025-6556: Insufficient policy enforcement in Loader.
      Reported by Shaheen Fazim.
    - CVE-2025-6557: Insufficient data validation in DevTools.
      Reported by Ameen Basha M K.
  * d/rules:
    - drop enable_reading_list=false, as Reading List is now
      supported for all architectures.
    - disable ThinLTO due to build failure with older rust.
  * d/patches:
    - upstream/arm32-crel.patch: drop, merged upstream.
    - upstream/cross-build-target.patch: drop, merged upstream.
    - upstream/span-fwd.patch: drop, merged upstream.
    - upstream/mojo-optional.patch: drop, merged upstream.
    - upstream/opener-heur.patch: drop, merged upstream.
    - upstream/allowed-state.patch: drop, merged upstream.
    - upstream/pdfium-libpng.patch: drop, merged upstream.
    - upstream/safety-hub-set.patch: drop, merged upstream.
    - fixes/media-cstdint.patch: drop, merged upstream.
    - debianization/clang-version.patch: refresh.
    - fixes/bindgen.patch: refresh.
    - fixes/armhf-icf.patch: refresh.
    - disable/catapult.patch: refresh.
    - disable/google-api-warning.patch: refresh.
    - disable/buildtools-libc.patch: refresh.
    - bookworm/clang19.patch: drop part of patch.
    - fixes/memory-allocator-dcheck-assert-fix.patch: update for renamed
      config variable kMaxBucketed.
    - disable/node-version-ck.patch: disable nodejs version check in
      protobuf.
    - bookworm/stdarch-arm.patch: drop redundant portion of patch.
    - bookworm/rust-is-none-or.patch: drop portion of patch due to
      upstream changes.
    - bookworm/gn-hpp11.patch: add another workaround for older gn.
    - bookworm/rust-split-at-checked.patch: enable unstable rust feature
      split_at_checked.
    - bookworm/crabbyav1f-macro-scope.patch: fix (macro-created) variable
      going out of scope.
    - rust-unstable-features.patch: enable a bunch more unstable rust
      features.
    - bookworm/rust-box-to-vec.patch: work around older rustc not being
      able to implicitly handle converted a boxed slice into a vector.

  [ Daniel Richard G. ]
  * d/rules: Rearrange DEB_BUILD_MAINT_OPTIONS assignments to avoid
    "argument unused" warnings on armhf due to -fstack-clash-protection.
  * d/control, d/rules: Apply cross-build feedback from Helmut Grohne.
  * d/control: Add myself to Uploaders:, with Andres's blessing of course :)

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: Refresh for
      upstream changes
    - third_party/0002-regenerate-xnn-buildgn.patch: Refresh for upstream
      changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 24 Jun 2025 16:01:10 -0400

chromium (137.0.7151.119-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-6191: Integer overflow in V8. Reported by Shaheen Fazim.
    - CVE-2025-6192: Use after free in Profiler.
      Reported by Chaoyuan Peng (@ret2happy).
  * Include libtest_trace_processor.so in chromium-shell package.
    (closes: #1107837).
  * d/patches:
    - fixes/armhf-icf.patch: add workaround for build failure on armhf
      (thanks Daniel Richard G!).

 -- Andres Salomon <dilinger@debian.org>  Tue, 17 Jun 2025 19:12:16 -0400

chromium (137.0.7151.103-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-5958: Use after free in Media.
      Reported by Huang Xilin of Ant Group Light-Year Security Lab.
    - CVE-2025-5959: Type Confusion in V8.
      Reported by Seunghyun Lee as part of TyphoonPWN 2025.
  * Add build-dep on libc++-19-dev and switch to building statically
    against clang's libc++ (instead of gcc's libstdc++).
  * d/patches:
    - fixes/absl-optional.patch: drop, only needed for libstdc++.
    - fixes/font-gc-asan.patch: drop, only needed for libstdc++.
    - fixes/stdatomic.patch: drop, only needed for libstdc++.
    - fixes/make-pair.patch: drop, only needed for libstdc++.
    - bookworm/constflatset.patch: drop, only needed for libstdc++.
    - bookworm/constexpr2.patch: drop, only needed for libstdc++.
    - bookworm/constexpr3.patch: drop, only needed for libstdc++.
    - bookworm/foreach.patch: add patch from bookworm branch to fix
      clang-19 build failure.

 -- Andres Salomon <dilinger@debian.org>  Tue, 10 Jun 2025 15:08:42 -0400

chromium (137.0.7151.68-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon]
  * New upstream security release.
    - CVE-2025-5419: Out of bounds read and write in V8. Reported by
      Clement Lecigne and Benoît Sevens of Google Threat Analysis Group.
    - CVE-2025-5068: Use after free in Blink. Reported by Walkman.

  [ Jianfeng Liu ]
  * d/patches/ppc64le: merge ppc64le sandbox syscall patches

 -- Andres Salomon <dilinger@debian.org>  Tue, 03 Jun 2025 12:23:46 -0400

chromium (137.0.7151.55-3~deb12u1) bookworm-security; urgency=high

  [ Timothy Pearson ]
  * Fix FTBFS on ppc64el due to third party xnnpack library
  * d/patches/ppc64le:
    - third_party/0001-add-xnn-ppc64el-support.patch: Add ppc64el support to
      xnn build system
    - third_party/0002-regenerate-xnn-buildgn.patch: Regenerate xnn BUILD.gn
      file

 -- Andres Salomon <dilinger@debian.org>  Wed, 28 May 2025 18:47:40 -0400

chromium (137.0.7151.55-2) unstable; urgency=high

  * Switch build-deps with :all to :native.

 -- Andres Salomon <dilinger@debian.org>  Wed, 28 May 2025 01:55:46 -0400

chromium (137.0.7151.55-1) unstable; urgency=high

  [ Daniel Richard G. ]
  * d/control: Elaborate Build-Depends: clause for a cross build. Also drop
    x11-apps, as it appears to be unused, as well as libmodpbase64-dev as
    it is built in-tree under third_party/modp_b64/. Add a Build-Conflicts:
    clause to avoid some snafus on Ubuntu.
  * d/patches:
    - debianization/cross-build.patch: New patch implementing the bulk of our
      cross-build support.
    - upstream/cross-build-target.patch: New upstream patch that sets
      --target=... explicitly on all builds. Needed for a cross build.
    - fixes/clang-rust-target.patch: Drop, as this patch is made redundant by
      the preceding one.
  * d/rules: Add settings and environment exports needed for a cross build.

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-5063: Use after free in Compositing. Reported by Anonymous.
    - CVE-2025-5280: Out of bounds write in V8. Reported by [pwn2car].
    - CVE-2025-5064: Inappropriate implementation in Background Fetch API.
      Reported by Maurice Dauer .
    - CVE-2025-5065: Inappropriate implementation in FileSystemAccess API.
      Reported by NDevTK.
    - CVE-2025-5066: Inappropriate implementation in Messages.
      Reported by Mohit Raj (shadow2639) .
    - CVE-2025-5281: Inappropriate implementation in BFCache.
      Reported by Jesper van den Ende (Pelican Party Studios).
    - CVE-2025-5283: Use after free in libvpx. Reported by Mozilla.
    - CVE-2025-5067: Inappropriate implementation in Tab Strip.
      Reported by Khalil Zhani.
  * d/control: switch bindgen:any build-dep to bindgen:native.
  * d/rules: disable optimize_webui for now due to a rollup 3.x issue.
  * d/patches:
    - upstream/media-optional.patch: drop, merged upstream.
    - fixes/media-cstdint.patch: drop part of patch merged upstream.
    - fixes/perfetto-nullptr.patch: drop due to upstream code changes.
    - upstream/arm32-crel.patch: refresh.
    - disable/tests.patch: refresh.
    - system/gperf.patch: drop, merged upstream.
    - bookworm/gn-revert-path-exists.patch: refresh.
    - bookworm/gn-allowlist.patch: refresh.
    - ungoogled/disable-privacy-sandbox.patch: update from ungoogled.
    - bookworm/clang19.patch: add new unsupported arg removal
      (-fextend-variable-liveness).
    - upstream/span-fwd.patch: add build fix pulled from upstream.
    - upstream/mojo-optional.patch: add build fix pulled from upstream.
    - bookworm/constexpr3.patch: add yet another constexpr workaround.
    - upstream/opener-heur.patch: add build fix pulled from upstream.
    - upstream/allowed-state.patch: add build fix pulled from upstream.
    - upstream/pdfium-libpng.patch: add build fix pulled from upstream.
    - upstream/safety-hub-set.patch: add build fix pulled from upstream.
    - bookworm/gn-absl.patch: add global visibility for another type.
    - bookworm/constexpr.patch: refresh.
    - bookworm/stdarch-arm.patch: update path for rust crate.
    - bookworm/rust-is-none-or.patch: add another workaround for missing
      is_none_or() function.
    - bookworm/toktrie-utf8chunks.patch: add workaround for missing
      utf8_chunks() in rustc-web 1.78.
    - bookworm/derivre-create.patch: enable rust unstable features
      everywhere, and add some that derivre requires (from newer rustc).

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - sandbox/features.gni: refresh for upstream changes
    - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
      regenerate from upstream sources
    - fixes/fix-partition-alloc-compile.patch: refresh for upstream changes
    - third_party/skia-vsx-instructions.patch: refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 27 May 2025 23:46:49 -0400

chromium (136.0.7103.113-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-4664: Insufficient policy enforcement in Loader.
      Source: X post from @slonser_.
    - CVE-2025-4609: Incorrect handle provided in unspecified circumstances
      in Mojo. Reported by Micky.

 -- Andres Salomon <dilinger@debian.org>  Wed, 14 May 2025 14:41:31 -0400

chromium (136.0.7103.92-2) unstable; urgency=high

  * d/patches/upstream/arm32-crel.patch: add another armhf FTBFS fix;
    linking with CREL causes segfaults.

 -- Andres Salomon <dilinger@debian.org>  Wed, 07 May 2025 12:11:17 -0400

chromium (136.0.7103.92-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
   - CVE-2025-4372: Use after free in WebAudio.
      Reported by Huang Xilin of Ant Group Light-Year Security Lab.

  [ Daniel Richard G. ]
  * d/patches/fixes/armhf-no-thumb.patch: Fix armhf FTBFS due to use of a
    Rust target (thumbv7neon) that Debian does not ship.

 -- Andres Salomon <dilinger@debian.org>  Tue, 06 May 2025 14:13:50 -0400

chromium (136.0.7103.59-2~deb12u2) bookworm-security; urgency=high

  * Temporarily disable CVE verification check in order to fix build;
    will be restored on next upload.

 -- Andres Salomon <dilinger@debian.org>  Thu, 01 May 2025 12:18:24 -0400

chromium (136.0.7103.59-2~deb12u1) bookworm-security; urgency=high

  * Delete third_party/jetstream due to non-free ("do no evil") license.

 -- Andres Salomon <dilinger@debian.org>  Wed, 30 Apr 2025 17:38:38 -0400

chromium (136.0.7103.59-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous.
    - CVE-2025-4050: Out of bounds memory access in DevTools.
      Reported by Anonymous.
    - CVE-2025-4051: Insufficient data validation in DevTools.
      Reported by Daniel Fröjdendahl.
    - CVE-2025-4052: Inappropriate implementation in DevTools.
      Reported by vanillawebdev.
  * d/rules: disable warning-suppression-mappings; llvm too old.
  * d/control: drop libevent-dev build-dep, no longer used.
  * d/scripts/unbundle:
    - libavif no longer used, no need to specify bundling.
    - bundle simdutf, which isn't packaged for debian.
  * d/patches:
    - fixes/pipewire14.patch: drop, merged upstream.
    - disable/catapult.patch: refresh.
    - disable/buildtools-libc.patch: rework patch to be easier to maintain.
    - bookworm/gn-revert-path-exists.patch: update for a bunch of new
      path_exists() users.
    - disable/node-version-ck.patch: add patch to disable upstream's strict
      nodejs version check.
    - fixes/media-cstdint.patch: add missing header include.
    - upstream/media-optional.patch: add missing header include.
    - fixes/perfetto-nullptr.patch: add nullptr_t std qualification.
    - bookworm/gn-absl.patch: refresh.
    - bookworm/crabbyav1f.patch: update for changed rustflags location.
    - bookworm/node18-import.patch: add patch to work around bookworm's
      node 18 import rules.
    - bookworm/rust-is-none-or.patch: add patch to work around missing
      is_none_or() function in bookworm's rust 1.78.
    - bookworm/fmodf.patch: add gcc-12 specific build fix.
    - bookworm/dav1d-extern.patch: add linker fix for older libdav1d.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-third_party-lss-Don-t-look-for-mmap2-on-ppc64.patch:
      drop due to upstream fixes
    - third_party/0002-third_party-lss-kernel-structs.patch: refresh for
      upstream changes
    - breakpad/0001-Implement-support-for-ppc64-on-Linux.patch: refresh for
      upstream changes
    - core/cargo-add-ppc64.diff: drop due to upstream fixes

 -- Andres Salomon <dilinger@debian.org>  Tue, 29 Apr 2025 17:21:56 -0400

chromium (135.0.7049.114-1) unstable; urgency=high

  * New upstream security release.

 -- Andres Salomon <dilinger@debian.org>  Tue, 22 Apr 2025 22:42:31 -0400

chromium (135.0.7049.95-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2025-3619: Heap buffer overflow in Codecs. Reported by Elias Hohl.
    - CVE-2025-3620: Use after free in USB. Reported by @retsew0x01.

  [ Daniel Richard G. ]
  * d/copyright, d/patches/system/rapidjson.patch: Slightly narrow the scope
    of the bundled RapidJSON deletion, and rework this patch so that it does
    not require the deletion in order to apply. This allows applying the
    debianization directly to the unrepackaged upstream tarball source.
  * d/patches/system/gperf.patch: Import (self-authored) upstream patch to
    prevent build breakage due to changes in gperf 3.2 generated code
    (closes: #1103226).
  * d/rules: Add new check-version rule to validate the package version.
    Also squelch error messages due to absent clang and rustc executables.
  * d/rules: Download Gentoo's upstream source tarball straight from GitHub.

 -- Andres Salomon <dilinger@debian.org>  Tue, 15 Apr 2025 22:12:30 -0400

chromium (135.0.7049.84-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release (closes: #1101978).
    - CVE-2025-3066: Use after free in Site Isolation.
      Reported by Sven Dysthe (@svn-dys).
  * d/patches/fixes/rust-clanglib.patch: refresh.

 -- Andres Salomon <dilinger@debian.org>  Tue, 08 Apr 2025 16:57:37 -0400

chromium (135.0.7049.52-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-3066: Use after free in Navigations.
      Reported by Sven Dysthe (@svn-dys).
    - CVE-2025-3067: Inappropriate implementation in Custom Tabs.
      Reported by Philipp Beer (TU Wien).
    - CVE-2025-3068: Inappropriate implementation in Intents.
      Reported by Simon Rawet.
    - CVE-2025-3069: Inappropriate implementation in Extensions.
      Reported by NDevTK.
    - CVE-2025-3070: Insufficient validation of untrusted input in
      Extensions.
    - CVE-2025-3071: Inappropriate implementation in Navigations.
      Reported by David Erceg.
    - CVE-2025-3072: Inappropriate implementation in Custom Tabs.
      Reported by Om Apip.
    - CVE-2025-3073: Inappropriate implementation in Autofill.
      Reported by Hafiizh.
    - CVE-2025-3074: Inappropriate implementation in Downloads.
      Reported by Farras Givari.
  * d/patches:
    - upstream/optional.patch: drop, merged upstream.
    - upstream/qualifications.patch: drop, merged upstream.
    - fixes/lens-optional.patch: drop, merged upstream.
    - fixes/optional.patch: drop, merged upstream.
    - fixes/swiftshader-llvm.patch: drop, merged upstream.
    - fixes/variant.patch: drop, merged upstream.
    - bookworm/clang19.patch: refresh.
    - bookworm/gn-revert-path-exists.patch: add build fix to work around
      older gn.
    - ungoogled/disable-privacy-sandbox.patch: refresh from ungoogled.
    - fixes/make-pair.patch: add a gcc-specific build fix.
    - disable/buildtools-libc.patch: add patch to remove libc build stuff.
    - bookworm/gn-absl.patch: refresh.
    - bookworm/constexpr.patch: refresh.
    - bookworm/stdarch-arm.patch: refresh.
    - bookworm/eslint.patch: add bookworm-specific build fix; thanks
      Daniel Richard G. <skunk@iSKUNK.ORG>!
    - bookworm/crabbyav1f.patch: add rustc 1.78 build fix workaround.

  [ Timothy Pearson ]
  * Enable pointer compression on ppc64le
    This fixes V8 OOM conditions noted on e.g. https://trac.ffmpeg.org
  * d/patches/ppc64le:
    - v8/0001-Enable-ppc64-pointer-compression.patch
    - sandbox/0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
      refresh for upstream changes

  [ Daniel Richard G. ]
  * d/rules: Add switch to allow downloading either Google's upstream tarball,
    or an independently-created one from Gentoo. Default to the latter.

 -- Andres Salomon <dilinger@debian.org>  Wed, 02 Apr 2025 02:04:23 -0400

chromium (134.0.6998.117-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-2476: Use after free in Lens.
      Reported by SungKwon Lee of Enki Whitehat.

 -- Andres Salomon <dilinger@debian.org>  Wed, 19 Mar 2025 20:04:39 -0400

chromium (134.0.6998.88-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-1920: Type Confusion in V8. Reported by Excello s.r.o.
    - CVE-2025-2135: Type Confusion in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2025-24201: Out of bounds write in GPU on Mac. Reported by
      Apple Security Engineering and Architecture (SEAR).
    - CVE-2025-2136: Use after free in Inspector. Reported by Sakana.S.
    - CVE-2025-2137: Out of bounds read in V8. Reported by zeroxiaobai@.

 -- Andres Salomon <dilinger@debian.org>  Tue, 11 Mar 2025 14:28:43 -0400

chromium (134.0.6998.35-3) unstable; urgency=high

  * Fix FTBFS with pipewire 1.4.0.

 -- Andres Salomon <dilinger@debian.org>  Sat, 08 Mar 2025 13:35:36 -0500

chromium (134.0.6998.35-2) unstable; urgency=high

  * Revert "Have chromium-driver depend upon chromium-common instead of
    chromium" to make autopkgtests of various packages happy.

 -- Andres Salomon <dilinger@debian.org>  Fri, 07 Mar 2025 00:58:06 -0500

chromium (134.0.6998.35-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-1914: Out of bounds read in V8. Reported by
      Zhenghang Xiao (@Kipreyyy) and Nan Wang (@eternalsakura13).
    - CVE-2025-1915: Improper Limitation of a Pathname to a Restricted
      Directory in DevTools. Reported by Topi Lassila.
    - CVE-2025-1916: Use after free in Profiles.
      Reported by parkminchan, SSD Labs Korea.
    - CVE-2025-1917: Inappropriate Implementation in Browser UI.
      Reported by Khalil Zhani.
    - CVE-2025-1918: Out of bounds read in PDFium. Reported by asnine.
    - CVE-2025-1919: Out of bounds read in Media.
      Reported by @Bl1nnnk and @Pisanbao.
    - CVE-2025-1921: Inappropriate Implementation in Media Stream.
      Reported by Kaiido.
    - CVE-2025-1922: Inappropriate Implementation in Selection.
      Reported by Alesandro Ortiz.
    - CVE-2025-1923: Inappropriate Implementation in Permission Prompts.
      Reported by Khalil Zhani.
  * d/patches:
    - fixes/widevine-revision.patch: drop. Upstream says "with CDMs using
      manifest-based registration, no need to" hardcode version string.
    - disable/catapult.patch: refresh.
    - bookworm/clang19.patch: refresh.
    - ungoogled/disable-privacy-sandbox.patch: refresh from ungoogled.
    - bookworm/gn-allowlist.patch: add workaround for older gn.
    - bookworm/adler1.patch: add workaround for older rust.
    - fixes/stdatomic.patch: add build fix to ensure <stdatomic.h> isn't
      used.
    - fixes/variant.patch: add missing header include.
    - upstream/qualifications.patch: add fix to silence annoying warnings.
    - upstream/optional.patch: add more missing header includes.
    - bookworm/constflatset.patch: refresh.
    - bookworm/constexpr.patch: refresh.
    - bookworm/modff.patch: add workaround for libstdc++ build issue.
    - bookworm/foreach.patch: add workaround for libstdc++ build issue.
  * d/rules: update to ensure both qt5 AND qt6 are disabled.

  [ Timothy Pearson ]
  * d/patches:
    - fixes/swiftshader-llvm.patch: Add LLVM patches from upstream LLVM
      project to fix integrated SwiftShader LLVM FTBFS
  * d/patches/ppc64le:
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: Refresh for
      upstream changes

 -- Andres Salomon <dilinger@debian.org>  Wed, 05 Mar 2025 13:26:45 -0500

chromium (133.0.6943.141-2) unstable; urgency=high

  * Add a bunch of lintian overrides for embedded libraries.

 -- Andres Salomon <dilinger@debian.org>  Fri, 28 Feb 2025 22:37:45 -0500

chromium (133.0.6943.141-1) unstable; urgency=high

  * New upstream security release (no CVEs).
  * Move various .pak files from chromium package to chromium-common.
  * Have chromium-driver depend upon chromium-common instead of chromium.
  * Double quote args in chromium-shell script (closes: #971906).
  * Add new package 'chromium-headless-shell' that is equivalent to the
    now-removed --headless=old argument (closes: #1081204).
  * d/patches/fixes/headless-gn.patch: add build fix for headless_shell.

 -- Andres Salomon <dilinger@debian.org>  Fri, 28 Feb 2025 16:16:33 -0500

chromium (133.0.6943.126-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-0999: Heap buffer overflow in V8.
      Reported by Seunghyun Lee (@0x10n).
    - CVE-2025-1426: Heap buffer overflow in GPU.
      Reported by un3xploitable && GF.
    - CVE-2025-1006: Use after free in Network. Reported by Tal Keren, Sam
      Agranat, Eran Rom, Edouard Bochin, Adam Hatsir of Palo Alto Networks.
  * d/patches:
    - fixes/bindgen-unsafe-op.patch: drop now that sid's bindgen is fixed.

 -- Andres Salomon <dilinger@debian.org>  Thu, 20 Feb 2025 00:16:49 -0500

chromium (133.0.6943.98-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2025-0995: Use after free in V8. Reported by Popax21.
    - CVE-2025-0996: Inappropriate implementation in Browser UI.
      Reported by yuki yamaoto.
    - CVE-2025-0997: Use after free in Navigation. Reported by asnine.
    - CVE-2025-0998: Out of bounds memory access in V8.
      Reported by Alan Goodman.
  * d/patches:
    - fixes/bindgen-unsafe-op.patch: add a workaround for a bindgen bug
      that causes FTBFS on armhf.
    - bookworm/stdarch-arm.patch: add workaround to build w/ rust 1.78.

 -- Andres Salomon <dilinger@debian.org>  Wed, 12 Feb 2025 21:35:00 -0500

chromium (133.0.6943.53-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-0444: Use after free in Skia.
      Reported by Francisco Alonso (@revskills).
    - CVE-2025-0445: Use after free in V8. Reported by 303f06e3.
    - CVE-2025-0451: Inappropriate implementation in Extensions API.
      Reported by Vitor Torres and Alesandro Ortiz.
  * Stop deleting third_party/highway, drop libhwy-dev build-dep, and
    build against the bundled libhwy due to new API requirements.
  * d/patches:
    - fixes/highway-include-path.patch: drop; switching to bundled hwy.
    - bookworm/highway-blink.patch: drop; switching to bundled hwy.
    - upstream/array.patch: drop, merged upstream.
    - upstream/ink-isfinite.patch: drop, merged upstream.
    - upstream/ruy-include.patch: drop, merged upstream.
    - upstream/uint.patch: drop, merged upstream.
    - upstream/variant.patch: drop, merged upstream.
    - upstream/webrtc-optional.patch: drop, merged upstream.
    - fixes/perfetto.patch: drop, merged upstream.
    - system/event.patch: drop, upstream no longer uses libevent.
    - ungoogled/disable-privacy-sandbox.patch: refresh from upstream.
    - fixes/highway-include-path.patch: delete a libhwy build test, add
      another header build fix.
    - bookworm/clang19.patch: add patch to disable unsupported build args
    - fixes/optional.patch: add header build fix.
    - bookworm/gn-absl.patch: add global visibilty for more symbols.
    - bookworm/dq-forward-iterator.patch: add workaround for bookworm's
      libstdc++ 12.
    - bookworm/constflatset.patch, bookworm/constexpr.patch: add another
      workaround for bookworm's libstdc++ 12.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: Refresh for
      upstream changes
    - third_party/0002-Add-PPC64-generated-files-for-boringssl.patch:
      Refresh for upstream changes
    - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
      Refresh for upstream changes
    - third_party/0001-third-party-hwy-wrong-include.patch: Work around
      incorrect header include

 -- Andres Salomon <dilinger@debian.org>  Wed, 05 Feb 2025 00:18:56 -0500

chromium (132.0.6834.159-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2025-0762: Use after free in DevTools. Reported by Sakana.S.

  [ Daniel Richard G. ]
  * d/copyright: Sort the list of Files-Excluded: entries, remove a few
    that are no longer needed, and consolidate some others with brackets.
  * d/rules:
    - Use simple assignments for variables defined using $(shell ...)
      to avoid recursive-expansion issues with GNU Make 4.4.1.
    - Download the upstream lite tarball instead of the regular one now
      that the former has everything we need.
    - Delete empty directories when making the orig-source tarball.

 -- Andres Salomon <dilinger@debian.org>  Tue, 28 Jan 2025 20:26:06 -0500

chromium (132.0.6834.110-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2025-0611: Object corruption in V8. Reported by 303f06e3.
    - CVE-2025-0612: Out of bounds memory access in V8.
      Reported by Alan Goodman.
  * d/patches/upstream/mojo.patch: drop, upstream tarballs are now fixed.
  * d/chromium-shell.NEWS: ask users of the chromium-shell package to
    email me; otherwise, chromium-shell will be removed in the future.

  [ Ahmad Khalifa ]
  * d/NEWS uses missing release, set it to nearest to silence lintian.
  * d/control: replace obsolete pkg-config with pkgconf.
  * d/upstream/metadata: switch fields to expected case.
  * d/patches/series: help lintian ignore unused bullseye patches.

  [ Daniel Richard G. ]
  * d/etc/dev-shm: Add --disable-dev-shm-usage if the system has less than
    ~4 GB available in /dev/shm to avoid crashes (closes: #1072299).

  [ Jianfeng Liu ]
  * d/patches:
    - fixes/libsync-rk3588-panthor.patch: Fix upstream issue #343592370,
      which can cause browser crash when running with ozone wayland on
      rk3588 platform.

 -- Andres Salomon <dilinger@debian.org>  Wed, 22 Jan 2025 16:36:45 -0500

chromium (132.0.6834.83-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2025-0434: Out of bounds memory access in V8. Reported by ddme.
    - CVE-2025-0435: Inappropriate implementation in Navigation.
      Reported by Alesandro Ortiz.
    - CVE-2025-0436: Integer overflow in Skia.
      Reported by Han Zheng (HexHive).
    - CVE-2025-0437: Out of bounds read in Metrics.
      Reported by Xiantong Hou of Wuheng Lab and Pisanbao.
    - CVE-2025-0438: Stack buffer overflow in Tracing.
      Reported by Han Zheng (HexHive).
    - CVE-2025-0439: Race in Frames. Reported by Hafiizh.
    - CVE-2025-0440: Inappropriate implementation in Fullscreen.
      Reported by Umar Farooq.
    - CVE-2025-0441: Inappropriate implementation in Fenced Frames.
      Reported by someoneverycurious.
    - CVE-2025-0442: Inappropriate implementation in Payments.
      Reported by Ahmed ElMasry.
    - CVE-2025-0443: Insufficient data validation in Extensions.
      Reported by Anonymous.
    - CVE-2025-0446: Inappropriate implementation in Extensions.
      Reported by Hafiizh.
    - CVE-2025-0447: Inappropriate implementation in Navigation.
      Reported by Khiem Tran (@duckhiem).
    - CVE-2025-0448: Inappropriate implementation in Compositing.
      Reported by Dahyeon Park.
  * d/patches:
    - upstream/blink-fix-size-assertions.patch: drop, merged upstream.
    - upstream/dawn-strlen.patch: drop, merged upstream.
    - upstream/mrc-copy-op.patch: drop, merged upstream.
    - upstream/variant.patch: part of this was merged upstream; keep the
      rest.
    - fixes/freetype.patch: drop, merged upstream.
    - fixes/gpu-crash.patch: drop, merged upstream.
    - fixes/bindgen.patch: refresh and make patch even smaller. Also some
      upstream churn.
    - fixes/fix-assert-in-vnc-sessions.patch: refresh.
    - ungoogled/disable-privacy-sandbox.patch: refresh.
    - upstream/mojo.patch: fix missing files.
    - upstream/uint.patch: add gcc-specific build fix.
    - bookworm/constflatset.patch: add (probably) gcc-specific workaround.
    - fixes/lens-optional.patch: add gcc-specific build fix.
    - bookworm/gn-absl.patch: modify for new dependency.
    - bookworm/rust-visibility.patch: add build fix for older rustc.
    - bookworm/less-void.patch: add build fix for older libstdc++/gcc.
  * Downgrade to rollup3 for devtools-frontend stuff, due to the bundled
    rollup4 including wasm blobs. Update d/patches/system/rollup.patch to
    point to the right place as well, and build-dep on
    node-rollup-plugin-terser.
  * Build against newer bundled libtiff for memory limiting protection.
  * Switch to bundled libdrm due to DRM_IOCTL_SYNCOBJ_EVENTFD usage.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - workarounds/HACK-debian-clang-disable-skia-musttail.patch: Drop due
      to upstream fixes
    - third_party/skia-vsx-instructions.patch: Refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 14 Jan 2025 21:20:43 -0500

chromium (131.0.6778.264-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2025-0291: Type Confusion in V8. Reported by Popax21.
  * d/copyright: Delete some unused upstream binaries that we'd
    previously missed (closes: #1091459).

  [ Bo YU ]
  * Enable 0001-swiftshader-fix-build.patch on ppc64el again to fix
    FTBFS issue.

 -- Andres Salomon <dilinger@debian.org>  Wed, 08 Jan 2025 11:26:36 -0500

chromium (131.0.6778.204-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-12692: Type Confusion in V8.
      Reported by Seunghyun Lee (@0x10n).
    - CVE-2024-12693: Out of bounds memory access in V8.
      Reported by 303f06e3.
    - CVE-2024-12694: Use after free in Compositing. Reported by Anonymous.
    - CVE-2024-12695: Out of bounds write in V8. Reported by 303f06e3.
  * d/patches/fixes/absl-optional.patch: comment out __glibcxx_assert()
    that we keep hitting with gcc 12; it was previously commented out, but
    we lost the change when we switched from libstdc++ and then back.

  [ Bo Yu ]
  * Build swiftshader with llvm-16 instead of llvm-10.

 -- Andres Salomon <dilinger@debian.org>  Wed, 18 Dec 2024 16:52:56 -0500

chromium (131.0.6778.139-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-12381: Type Confusion in V8.
      Reported by Seunghyun Lee (@0x10n).
    - CVE-2024-12382: Use after free in Translate. Reported by
      lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group.
  * (Temporarily?) switch from llvm's libc++ to gcc's libstdc++ to
    simplify the prior clang-16/19 upgrades.
  * d/patches:
    - fixes/bindgen.patch: refresh.
    - upstream/dawn-strlen.patch: add gcc-specific build fix.
    - upstream/ink-isfinite.patch: add gcc-specific build fix.
    - upstream/webrtc-optional.patch: add gcc-specific build fix.
    - upstream/variant.patch: add gcc-specific build fixes.
    - upstream/array.patch: add gcc-specific build fix.
    - fixes/absl-optional.patch: re-introduce clang/gcc build workaround.
    - upstream/mrc-copy-op.patch: add gcc-specific build fix.
    - fixes/font-gc-asan.patch: add a better workaround for bad font-gc
      behavior under libstdc++. This is self-contained and small, unlike
      the prior reverts of the switch to font garbage collection.
    - bookworm/constexpr.patch: re-enable (and refresh) build fix
      specifically for gcc 12.
    - bookworm/constexpr2.patch: re-enable build fix for gcc 12.
    - bookworm/bubble-contents.patch: re-enable build fix for gcc 12.

  [ Nathan Teodosio ]
  * Simplify fixes/bindgen.patch so it doesn't need frequent rebasing.

  [ Daniel Richard G. ]
  * d/copyright: Expand list of Files-Excluded: entries.
  * d/rules: Various updates to get-orig-source rule, including use of
    grep-dctrl(1) and the LASTCHANGE.committime timestamp.
  * d/scripts/check-upstream: Avoid issues with inaccurate $(pwd) value and
    spaces in filenames, and print all errors instead of only the first one.

 -- Andres Salomon <dilinger@debian.org>  Wed, 11 Dec 2024 15:33:53 -0500

chromium (131.0.6778.108-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-12053: Type Confusion in V8.
      Reported by gal1ium and chluo.
  * Switch to clang-19 from clang-16 (closes: #1088162, #1088974).

 -- Andres Salomon <dilinger@debian.org>  Wed, 04 Dec 2024 01:55:50 -0500

chromium (131.0.6778.85-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2024-11110: Inappropriate implementation in Blink.
      Reported by Vsevolod Kokorin (Slonser) of Solidlab.
    - CVE-2024-11111: Inappropriate implementation in Autofill.
      Reported by Narendra Bhati, Suma Soft Pvt. Ltd - Pune (India).
    - CVE-2024-11112: Use after free in Media. Reported by
      Nan Wang(@eternalsakura13) and Zhenghang Xiao(@Kipreyyy) of
      360 Vulnerability Research Institute.
    - CVE-2024-11113: Use after free in Accessibility.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2024-11114: Inappropriate implementation in Views.
      Reported by Micky.
    - CVE-2024-11115: Insufficient policy enforcement in Navigation.
      Reported by mastersplinter.
    - CVE-2024-11116: Inappropriate implementation in Paint.
      Reported by Thomas Orlita.
    - CVE-2024-11117: Inappropriate implementation in FileSystem.
      Reported by Ameen Basha M K.
    - CVE-2024-11395: Type Confusion in V8. Reported by Anonymous.
  * d/patches:
    - upstream/wayland-gbm-pixmap.patch: drop, merged upstream.
    - disable/catapult.patch: refresh.
    - fixes/bindgen.patch: refresh.
    - fixes/freetype.patch: add new patch to fix missing
      enable_freetype arg declaration.
    - fixes/updater-test.patch: add simple build fix for deleted
      third_party/updater/.
    - upstream/stack-header.patch: drop, merged upstream.
    - bookworm/clang16.patch: refresh.
    - bookworm/bubble-contents.patch: refresh.
    - bookworm/constexpr.patch: refresh.
    - bookworm/gn-absl.patch: add a few more places where libs needed to
      be made visible.
    - bookworm/gn-funcs.patch: add another deletion of newer gn
      features.
    - bookworm/constexpr-assert.patch: add patch to work around more
      clang-16 constexpr bugs; this time a fun one with branching
      optimizations. Whee!

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - workarounds/HACK-debian-clang-disable-pa-musttail.patch: Work around
      additional upstream musttail definitions
    - workarounds/HACK-debian-clang-disable-base-musttail.patch: Refresh for
      upstream changes
    - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
      Refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Thu, 21 Nov 2024 16:12:03 -0500

chromium (130.0.6723.116-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-10826: Use after free in Family Experiences.
      Reported by Anonymous.
    - CVE-2024-10827: Use after free in Serial. Reported by Anonymous.

 -- Andres Salomon <dilinger@debian.org>  Wed, 06 Nov 2024 02:30:57 -0500

chromium (130.0.6723.91-2) unstable; urgency=high

  * d/patches/fixes/armhf-timespec.patch: add patch to fix armhf FTBFS.

 -- Andres Salomon <dilinger@debian.org>  Sun, 03 Nov 2024 02:47:53 -0500

chromium (130.0.6723.91-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-10487: Out of bounds write in Dawn.
      Reported by Apple Security Engineering and Architecture (SEAR).
    - CVE-2024-10488: Use after free in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).

 -- Andres Salomon <dilinger@debian.org>  Tue, 29 Oct 2024 20:36:38 -0400

chromium (130.0.6723.69-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-10229: Inappropriate implementation in Extensions.
      Reported by Vsevolod Kokorin (Slonser) of Solidlab.
    - CVE-2024-10230: Type Confusion in V8.
      Reported by Seunghyun Lee (@0x10n).
    - CVE-2024-10231: Type Confusion in V8.
      Reported by Seunghyun Lee (@0x10n).

  [ Timothy Pearson ]
  * d/patches:
    - bookworm/partially-deployed-mseal-syscall.patch: Work around newly
      introduced `mseal` syscall being inconsistently available on Bookworm kernels

 -- Andres Salomon <dilinger@debian.org>  Tue, 22 Oct 2024 21:34:57 -0400

chromium (130.0.6723.58-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2024-9954: Use after free in AI. Reported by DarkNavy.
    - CVE-2024-9955: Use after free in Web Authentication.
      Reported by anonymous.
    - CVE-2024-9956: Inappropriate implementation in Web Authentication.
      Reported by mastersplinter.
    - CVE-2024-9957: Use after free in UI. Reported by lime(@limeSec_) and
      fmyy(@binary_fmyy) From TIANGONG Team of Legendsec at QI-ANXIN Group.
    - CVE-2024-9958: Inappropriate implementation in PictureInPicture.
      Reported by Lyra Rebane (rebane2001).
    - CVE-2024-9959: Use after free in DevTools. Reported by Sakana.S.
    - CVE-2024-9960: Use after free in Dawn. Reported by Anonymous.
    - CVE-2024-9961: Use after free in Parcel Tracking. Reported by
      lime(@limeSec_) and fmyy(@binary_fmyy) From TIANGONG Team of
      Legendsec at QI-ANXIN Group.
    - CVE-2024-9962: Inappropriate implementation in Permissions.
      Reported by Shaheen Fazim.
    - CVE-2024-9963: Insufficient data validation in Downloads.
      Reported by Anonymous.
    - CVE-2024-9964: Inappropriate implementation in Payments.
      Reported by Hafiizh.
    - CVE-2024-9965: Insufficient data validation in DevTools.
      Reported by Shaheen Fazim.
    - CVE-2024-9966: Inappropriate implementation in Navigations.
      Reported by Harry Chen.
  * d/copyright: rollup -> @rollup  deletion.
  * d/patches:
    - debianization/sandbox.patch: refresh.
    - fixes/bindgen.patch: refresh.
    - disable/catapult.patch: refresh.
    - system/zlib.patch: drop. Upstream removed courgette, and its
      replacement (zucchini) doesn't appear to use zlib.
    - system/rollup.patch: update path due to upstream renaming; call
      ./rollup/.../rollup instead of ./@rollup/wasm-node/.../rollup.
    - system/event.patch: drop half of patch due to upstream deletions.
    - upstream/mojo-null.patch: merged into mojo.patch.
    - upstream/mojo.patch: update based on 130 test files.
    - bookworm/gn-absl.patch: refresh.
    - bookworm/gn-funcs.patch: refresh.
    - bookworm/cacheline.patch: add patch to revert usage of
      std::hardware_destructive_interference_size, which clang-16 lacks.
    - bookworm/constexpr2.patch: add around clang16 build failure
      workaround related to constexpr.
    - upstream/stack-header.patch: add missing include.

  [ Daniel Richard G. ]
  * d/rules: Drop the clang-16 -I/-Wl,-rpath flags from CXXFLAGS/LDFLAGS as
    they are no longer needed.

  [ Timothy Pearson ]
  * d/patches:
    - upstream/blink-fix-size-assertions.patch: Fix build on non-amd64
      platforms
    - fixes/fix-assert-in-vnc-sessions.patch: Fix assertion and SIGTRAP
      when starting Chromium from within a VNC session
  * d/patches/ppc64le:
    - core/add-ppc64-pthread-stack-size.patch: Define correct pthread
      stack size on ppc64 systems
    - core/cargo-add-ppc64.diff
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: Refresh for
      upstream changes
    - third_party/0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-
      .patch: Refresh for upstream changes
    - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
      Refresh for upstream changes
    - third_party/skia-vsx-instructions.patch: Refresh for upstream changes
    - workarounds/HACK-debian-clang-disable-skia-musttail.patch: Refresh
      for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Sat, 19 Oct 2024 01:12:11 -0400

chromium (129.0.6668.100-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-9602: Type Confusion in V8.
      Reported by Seunghyun Lee (@0x10n).
    - CVE-2024-9603: Type Confusion in V8.
      Reported by @WeShotTheMoon and @Nguyen Hoang Thach of starlabs.

 -- Andres Salomon <dilinger@debian.org>  Tue, 08 Oct 2024 19:36:09 -0400

chromium (129.0.6668.89-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-7025: Integer overflow in Layout.
      Reported by Tashita Software Security.
    - CVE-2024-9369: Insufficient data validation in Mojo.
      Reported by Xiantong Hou and Pisanbao of Wuheng Lab.
    - CVE-2024-9370: Inappropriate implementation in V8. Reported by
      Nguyễn Hoàng Thạch, Đỗ Minh Tuấn, and Wu JinLin of STAR Labs SG Pte Ltd.
  * d/patches:
    - bookworm/libxml-parseerr.patch: readd for downgraded libxml2 in
      unstable (closes: #1082907).
    - upstream/wayland-gbm-pixmap.patch: backport two patches to fix
      noisy wayland video playback (closes: #1077345).
  * Build against system libtiff, thanks to
    Soren Stoutner <soren@stoutner.com> for getting this fixed upstream
    (closes: #1033747).

 -- Andres Salomon <dilinger@debian.org>  Wed, 02 Oct 2024 01:07:19 -0400

chromium (129.0.6668.70-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-9120: Use after free in Dawn. Reported by Anonymous.
    - CVE-2024-9121: Inappropriate implementation in V8.
      Reported by Tashita Software Security.
    - CVE-2024-9122: Type Confusion in V8.
      Reported by Seunghyun Lee (@0x10n).
    - CVE-2024-9123: Integer overflow in Skia.
      Reported by raven at KunLun lab.
  * d/copyright: delete more upstream .clang, .git, and android residue.

  [ Timothy Pearson ]
  * d/patches:
    - fixes/predictor-denial-of-service.patch: Work around upstream
      issue #368562245, which can cause denial of service of the entire
      browser process on specific types of Web sites.

 -- Andres Salomon <dilinger@debian.org>  Wed, 25 Sep 2024 15:23:27 -0400

chromium (129.0.6668.58-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2024-8904: Type Confusion in V8. Reported by Popax21.
    - CVE-2024-8905: Inappropriate implementation in V8.
      Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team.
    - CVE-2024-8906: Incorrect security UI in Downloads.
      Reported by @retsew0x01.
    - CVE-2024-8907: Insufficient data validation in Omnibox.
      Reported by Muhammad Zaid Ghifari.
    - CVE-2024-8908: Inappropriate implementation in Autofill.
      Reported by Levit Nudi from Kenya.
    - CVE-2024-8909: Inappropriate implementation in UI.
      Reported by Shaheen Fazim.
  * d/patches:
    - debianization/sandbox.patch: refresh for upstream changes. Since we
      have some downstream users of this package, retain the Ubuntu wording.
    - disable/tests.patch: refresh.
    - disable/catapult.patch: refresh.
    - bookworm/clang16.patch: refresh, delete -Wno-dangling-assignment-gsl
    - ppc64le/crashpad/0001-Implement-support-for-PPC64-on-Linux.patch:
      refresh.
    - ppc64le/sandbox/Sandbox-linux-services-credentials.cc-PPC.patch:
      refresh.
    - ppc64le/third_party/dawn-fix-ppc64le-detection.patch: refresh.
    - bookworm/more-spaceships.patch: yet another clang-17 header
      backport for clang-16 inadequecies.
    - bookworm/signer-lambda.patch: clang-16 lambda bug workaround.
    - bookworm/bubble-contents.patch: refresh.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/dawn-fix-typos.patch: drop, applied upstream
    - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
      refresh for upstream changes
    - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh
      for upstream changes
    - core/cargo-add-ppc64.diff: Add ppc64 to cargo architecture definitions

 -- Andres Salomon <dilinger@debian.org>  Wed, 18 Sep 2024 20:47:23 -0400

chromium (128.0.6613.137-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-8636: Heap buffer overflow in Skia.
      Reported by Renan Rios (@hyhy_100).
    - CVE-2024-8637: Use after free in Media Router. Reported by
      lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group.
    - CVE-2024-8638: Type Confusion in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2024-8639: Use after free in Autofill. Reported by
      lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - core/add-ppc64-architecture-string.patch
    - fixes/fix-study-crash.patch

  [ Daniel Richard G. ]
  * d/copyright: Add some more Files-Excluded: entries.
  * d/rules: Ensure all files in orig source tarball are user-writable.
  * d/patches/disable:
    - tests.patch: Break out SwiftShader tests deletion to...
    - tests-swiftshader.patch: ...a separate file, to simplify resolving
      conflicts with the ungoogled-chromium patch series.

 -- Andres Salomon <dilinger@debian.org>  Tue, 10 Sep 2024 21:56:02 -0400

chromium (128.0.6613.119-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-8362: Use after free in WebAudio.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-7970: Out of bounds write in V8.
      Reported by Cassidy Kim(@cassidy6564).
  * Enable swiftshader support; thanks to Charles Samuels for helping out
    on this (closes: #1064465).
  * d/patches:
    - disable/swiftshader.patch: drop.
    - disable/swiftshader-2.patch: drop.
    - disable/tests.patch: some swiftshader tests deletion needed.

  [ Timothy Pearson ]
  * d/patches:
    - fixes/gpu-crash.patch: Fix GPU process crash (upstream issue #364568422)
    - ppc64le/third_party/0001-swiftshader-fix-build.patch: Fix SwiftShader
      build on ppc64el systems

 -- Andres Salomon <dilinger@debian.org>  Wed, 04 Sep 2024 15:05:06 -0400

chromium (128.0.6613.113-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-7969: Type Confusion in V8.
      Reported by CFF of Topsec Alpha Team.
    - CVE-2024-8193: Heap buffer overflow in Skia.
      Reported by Renan Rios (@hyhy_100).
    - CVE-2024-8194: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n).
    - CVE-2024-8198: Heap buffer overflow in Skia.
      Reported by Renan Rios (@hyhy_100).
  * d/control:
    - Bump rustc-web build-dep up to >= 1.74.
  * d/patches:
    - bookworm/rust-downgrade-osstr-users.patch: drop, now that we have a
      newer rust in bookworm.
    - bookworm/crabbyav1f.patch: drop, no longer needed w/ new rust.
    - bookworm/rust-no-thin-lto.patch: drop, we can now enable thinlto w/
      new rust.
    - fixes/clang-rust-target.patch: add, needed for thinlto in rust.
    - ppc64le/fixes/fix-different-data-layouts.patch: add, needed for
      mismatch between newer rust and older clang.

 -- Andres Salomon <dilinger@debian.org>  Thu, 29 Aug 2024 01:10:43 -0400

chromium (128.0.6613.84-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2024-7964: Use after free in Passwords. Reported by Anonymous.
    - CVE-2024-7965: Inappropriate implementation in V8. Reported by TheDog.
    - CVE-2024-7966: Out of bounds memory access in Skia.
      Reported by Renan Rios (@HyHy100).
    - CVE-2024-7967: Heap buffer overflow in Fonts.
      Reported by Tashita Software Security.
    - CVE-2024-7968: Use after free in Autofill.
      Reported by Han Zheng (HexHive).
    - CVE-2024-7969: Type Confusion in V8.
      Reported by CFF of Topsec Alpha Team.
    - CVE-2024-7971: Type confusion in V8. Reported by Microsoft Threat
      Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC).
    - CVE-2024-7972: Inappropriate implementation in V8.
      Reported by Simon Gerst (intrigus-lgtm).
    - CVE-2024-7973: Heap buffer overflow in PDFium. Reported by soiax.
    - CVE-2024-7974: Insufficient data validation in V8 API.
      Reported by bowu(@gocrashed).
    - CVE-2024-7975: Inappropriate implementation in Permissions.
      Reported by Thomas Orlita.
    - CVE-2024-7976: Inappropriate implementation in FedCM.
      Reported by Alesandro Ortiz.
    - CVE-2024-7977: Insufficient data validation in Installer.
      Reported by Kim Dong-uk (@justlikebono).
    - CVE-2024-7978: Insufficient policy enforcement in Data Transfer.
      Reported by NDevTK.
    - CVE-2024-7979: Insufficient data validation in Installer.
      Reported by VulnNoob.
    - CVE-2024-7980: Insufficient data validation in Installer.
      Reported by VulnNoob.
    - CVE-2024-7981: Inappropriate implementation in Views.
      Reported by Thomas Orlita.
    - CVE-2024-8033: Inappropriate implementation in WebApp Installs.
      Reported by Lijo A.T.
    - CVE-2024-8034: Inappropriate implementation in Custom Tabs.
      Reported by Bharat (mrnoob).
    - CVE-2024-8035: Inappropriate implementation in Extensions.
      Reported by Microsoft.
  * d/copyright: delete third_party/siso/ which contains binaries.
  * d/rules: set safe_browsing_use_unrar=false to disable unrar.
  * d/patches:
    - fixes/blink-frags.patch: drop, merged upstream.
    - fixes/stats-collector.patch: drop, upstream deleted broken code.
    - fixes/chromium-browser-ui-missing-deps.patch: drop, fixed upstream.
    - upstream/armhf-ftbfs.patch: drop, merged upstream.
    - upstream/containers-header.patch: drop, merged upstream.
    - upstream/crabbyav1f.patch: drop, merged upstream.
    - upstream/lock-impl.patch: drop, merged upstream.
    - upstream/paint-layer-header.patch: drop, merged upstream.
    - disable/unrar.patch: drop, merged upstream w/ build arg.
    - bookworm/nvt.patch: drop, no longer needed.
    - fixes/ps-print.patch: refresh.
    - system/openjpeg.patch: refresh.
    - bookworm/clang16.patch: refresh & remove another unsupported option.
    - bookworm/constexpr.patch: refresh & add more fixes.
    - bookworm/lex-3way.patch: pull in another STL function from clang-17.
    - bookworm/blink-attrib.patch: add build fix to reorder __attribute__.
    - fixes/highway-include-path.patch: upstream fixed the original issue
      in a broken way, making this worse. Add more to this patch to work
      around that.
    - bookworm/bubble-contents.patch: refresh.
    - bookworm/crabbyav1f.patch: refresh.
    - bookworm/gn-absl.patch: refresh.

  [ Daniel Richard G. ]
  * d/rules: Parameterize Rust sysroot to simplify using a different one.
  * d/patches:
    - bookworm/highway-blink.patch: Avoid armhf/arm64 FTBFS by disabling
      Blink feature that requires newer libhwy-dev version.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/dawn-fix-typos.patch: Refresh for upstream changes
    - third_party/use-sysconf-page-size-on-ppc64.patch: Refresh for upstream
      changes
    - third_party/0002-Add-PPC64-generated-files-for-boringssl.patch:
      Refresh for upstream changes
    - workarounds/HACK-debian-clang-disable-base-musttail.patch: Disable
      musttail on ppc64el platforms

 -- Andres Salomon <dilinger@debian.org>  Thu, 22 Aug 2024 14:06:28 -0400

chromium (127.0.6533.119-1) unstable; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
  * d/patches/upstream/armhf-ftbfs.patch: armhf FTBFS fix from upstream.

  [ Daniel Richard G. ]
  * d/patches:
    - ppc64le/crashpad/0002-Include-cstddef-to-fix-build.patch: Drop, as
      the original FTBFS that this fixed is no longer reproducible.
  * d/rules: Add to ppc64el CXXFLAGS to quash copious AltiVec warnings.

 -- Andres Salomon <dilinger@debian.org>  Wed, 14 Aug 2024 13:11:25 -0400

chromium (127.0.6533.99-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream security release.
    - CVE-2024-7532: Out of bounds memory access in ANGLE.
      Reported by wgslfuzz.
    - CVE-2024-7533: Use after free in Sharing. Reported by
      lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group.
    - CVE-2024-7550: Type Confusion in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2024-7534: Heap buffer overflow in Layout.
      Reported by Tashita Software Security.
    - CVE-2024-7535: Inappropriate implementation in V8.
      Reported by Tashita Software Security.
    - CVE-2024-7536: Use after free in WebAudio.
      Reported by Cassidy Kim(@cassidy6564).

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - core/add-ppc64-architecture-to-extensions.diff: Fix runtime assertion
      trap on ppc64el systems

  [ Daniel Richard G. ]
  * Enable ThinLTO (slower linking, faster runtime) on archs that can
    support it (closes: #1033305).
  * Avoid some hard-coded Debian references to simplify package builds for
    other distributions, e.g. Ubuntu.
  * d/patches:
    - bookworm/constexpr.patch: Add no_destroy attributes to quash many
      "declaration requires an exit-time destructor" warnings.
    - fixes/highway-include-path.patch: New patch to fix highway.h path.

  [ Grzegorz Szymaszek ]
  * Use https instead of http in initial_bookmarks.html.

 -- Andres Salomon <dilinger@debian.org>  Wed, 07 Aug 2024 00:18:54 -0400

chromium (127.0.6533.88-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2024-6988: Use after free in Downloads. Reported by
      lime(@limeSec_) from TIANGONG Team of Legendsec at QI-ANXIN Group.
    - CVE-2024-6989: Use after free in Loader. Reported by Anonymous.
    - CVE-2024-6991: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-6992: Out of bounds memory access in ANGLE.
      Reported by Xiantong Hou of Wuheng Lab and Pisanbao.
    - CVE-2024-6993: Inappropriate implementation in Canvas.
      Reported by Anonymous.
    - CVE-2024-6994: Heap buffer overflow in Layout.
      Reported by Huang Xilin of Ant Group Light-Year Security Lab.
    - CVE-2024-6995: Inappropriate implementation in Fullscreen.
      Reported by Alesandro Ortiz.
    - CVE-2024-6996: Race in Frames.
      Reported by Louis Jannett (Ruhr University Bochum).
    - CVE-2024-6997: Use after free in Tabs.
      Reported by Sven Dysthe (@svn-dys).
    - CVE-2024-6998: Use after free in User Education.
      Reported by Sven Dysthe (@svn-dys).
    - CVE-2024-6999: Inappropriate implementation in FedCM.
      Reported by Alesandro Ortiz.
    - CVE-2024-7000: Use after free in CSS. Reported by Anonymous.
    - CVE-2024-7001: Inappropriate implementation in HTML.
      Reported by Jake Archibald.
    - CVE-2024-7003: Inappropriate implementation in FedCM.
      Reported by Alesandro Ortiz.
    - CVE-2024-7004: Insufficient validation of untrusted input in Safe
      Browsing. Reported by Anonymous.
    - CVE-2024-7005: Insufficient validation of untrusted input in Safe
      Browsing. Reported by Umar Farooq.
    - CVE-2024-6990: Uninitialized Use in Dawn. Reported by gelatin dessert.
    - CVE-2024-7255: Out of bounds read in WebTransport.
      Reported by Marten Richter.
    - CVE-2024-7256: Insufficient data validation in Dawn.
      Reported by gelatin dessert.
  * Switch from building against (gcc's) libstdc++ to (clang's) libc++.
    Upstream is playing fast and loose with memory in ways that results
    in crashes with gcc's stricter libstdc++, but not with clang's libc++
    (which allows accessing deleting memory apparently). We can't maintain
    workarounds any more, and upstream really doesn't care (see, for
    example, https://crbug.com/346174906 , where they add workarounds only
    for their ASAN memory checker).
  * d/copyright:
    - delete new rust, cargo, llvm, and node binaries.
    - delete third_party/zstd so we can link against system zstd.
    - stop deleting the bundled woff, snappy, and jsoncpp; those can't be
      dynamically linked against with clang's libc++.
  * d/control:
    - build-dep against libzstd-dev and bindgen.
    - drop build-dep on libwoff-dev, libsnappy-dev, libjsoncpp-dev, and
      add build-deps on libc++-16-dev / libc++abi-16-dev.
  * d/rules:
    - drop use_goma=false (upstream switched to rbe).
    - set rust_bindgen_root.
    - rework get-orig-source to not use mk-origtargz, which is
    incredibly slow (total run 45 mins for the current 6.2G upstream
    release). Instead, use d/scripts/get-exludes.pl and tar's
    --exclude-from to drastically speed things up (total run now takes
    8 mins).
    - include bindgen 0.66.1-3 packages from snapshot.debian.org, as
      bookworm's bindgen 0.60.1 is too old. The packages are
      unpacked during build.
  * d/patches:
    - upstream/tabstrip-include.patch: drop, merged upstream.
    - upstream/quiche-deque.patch: drop, merged upstream.
    - upstream/gpu-header.patch: drop, merged upstream.
    - upstream/blink-header.patch: drop, merged upstream.
    - upstream/blink-header2.patch: drop, merged upstream.
    - upstream/blink-header3.patch: drop, merged upstream.
    - upstream/realtime-reporting.patch: drop, merged upstream.
    - upstream/urlvisit-header.patch: drop, merged upstream.
    - upstream/accessibility-format.patch: drop, merged upstream.
    - upstream/observer.patch: drop, merged upstream.
    - bookworm/clang16.patch: refresh.
    - bookworm/rust-downgrade-osstr-users.patch: refresh w/ minor changes.
    - ungoogled/disable-privacy-sandbox.patch: refresh.
    - disable/signin.patch: upstream dropped prefs::kAutologinEnabled.
    - upstream/crabbyav1f.patch: add build fix pulled from upstream.
    - upstream/lock-impl.patch: add build fix pulled from upstream.
    - upstream/containers-header.patch: add build fix pulled from upstream.
    - upstream/paint-layer-header.patch: add build fix pulled from upstream
    - fixes/bindgen.patch: work around bindgen-related things (hopefully
      correctly?)
    - bookworm/lex-3way.patch: add patch to support
      std::lexicographical_compare_three_way, which was added in clang-17.
    - bookworm/traitors.patch: another clang-16 hack; backport
      pointer_traits.h from libc++-18-dev to work around clang
      std::to_address() issue.
    - bookworm/constexpr.patch: add more of the usual constexpr
      workarounds; only needed for clang-16.
    - bookworm/constcountrycode.patch, bookworm/omnibox-constexpr.patch:
      remove, now part of bookworm/constexpr.patch.
    - fixes/absl-optional.patch: drop, only needed for libstdc++-dev.
    - fixes/bad-font-gc*: drop, only needed for libstdc++-dev.
    - fixes/chromium-browser-ui-missing-deps.patch: add a bunch of
      mojo-related dependency build fixes.
    - bookworm/bubble-contents.patch: refresh.
    - bookworm/gn-funcs.patch: add workarounds for missing functions in
      bookworm's older generate-ninja.
    - bookworm/gn-absl.patch: add workarounds for absl changes that rely
      on newer gn.
    - bookworm/crabbyav1f.patch: add experimental feature toggle, needed
      for older rustc.

  [ Timothy Pearson ]
  * d/patches:
    - fixes/fixes/memory-allocator-dcheck-assert-fix.patch: Fix assert on
      64k page systems such as aarch64 and ppc64el
  * d/patches/ppc64le:
    - ffmpeg/0001-Add-support-for-ppc64.patch: Drop, no longer needed
    - third_party/use-sysconf-page-size-on-ppc64.patch: Refresh for upstream
      changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 30 Jul 2024 23:50:29 -0400

chromium (126.0.6478.182-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-6772: Inappropriate implementation in V8.
      Reported by 5fceb6172bbf7e2c5a948183b53565b9.
    - CVE-2024-6773: Type Confusion in V8. Reported by 2ourc3 | Salim Largo.
    - CVE-2024-6774: Use after free in Screen Capture. Reported by
      lime(@limeSec_) and fmyy(@binary_fmyy) from TIANGONG Team of Legendsec
      at QI-ANXIN Group.
    - CVE-2024-6775: Use after free in Media Stream. Reported by Anonymous.
    - CVE-2024-6776: Use after free in Audio. Reported by
      lime(@limeSec_) and fmyy(@binary_fmyy) from TIANGONG Team of Legendsec
      at QI-ANXIN Group.
    - CVE-2024-6777: Use after free in Navigation.
      Reported by Sven Dysthe (@svn-dys).
    - CVE-2024-6778: Race in DevTools. Reported by Allen Ding.
    - CVE-2024-6779: Out of bounds memory access in V8.
      Reported by Seunghyun Lee (@0x10n).

 -- Andres Salomon <dilinger@debian.org>  Tue, 16 Jul 2024 16:50:59 -0400

chromium (126.0.6478.126-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-6290: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-6291: Use after free in Swiftshader.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-6292: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-6293: Use after free in Dawn. Reported by wgslfuzz.
  * d/patches/upstream/observer.patch: add crash-on-exit fix from
    upstream (closes: #1073378).

 -- Andres Salomon <dilinger@debian.org>  Tue, 25 Jun 2024 03:28:40 -0400

chromium (126.0.6478.114-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-6100: Type Confusion in V8. Reported by Seunghyun Lee
      (@0x10n) participating in SSD Secure Disclosure's TyphoonPWN 2024.
    - CVE-2024-6101: Inappropriate implementation in WebAssembly.
      Reported by @ginggilBesel.
    - CVE-2024-6102: Out of bounds memory access in Dawn.
      Reported by wgslfuzz.
    - CVE-2024-6103: Use after free in Dawn. Reported by wgslfuzz.

 -- Andres Salomon <dilinger@debian.org>  Tue, 18 Jun 2024 15:55:14 -0400

chromium (126.0.6478.56-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-5830: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2024-5831: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-5832: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-5833: Type Confusion in V8. Reported by @ginggilBesel.
    - CVE-2024-5834: Inappropriate implementation in Dawn.
      Reported by gelatin dessert.
    - CVE-2024-5835: Heap buffer overflow in Tab Groups.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2024-5836: Inappropriate Implementation in DevTools.
      Reported by Allen Ding.
    - CVE-2024-5837: Type Confusion in V8. Reported by Anonymous.
    - CVE-2024-5838: Type Confusion in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2024-5839: Inappropriate Implementation in Memory Allocator.
      Reported by Mickey.
    - CVE-2024-5840: Policy Bypass in CORS. Reported by Matt Howard.
    - CVE-2024-5841: Use after free in V8.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-5842: Use after free in Browser UI.
      Reported by Sven Dysthe (@svn_dy).
    - CVE-2024-5843: Inappropriate implementation in Downloads.
      Reported by hjy79425575.
    - CVE-2024-5844: Heap buffer overflow in Tab Strip. Reported by Sri.
    - CVE-2024-5845: Use after free in Audio. Reported by anonymous.
    - CVE-2024-5846: Use after free in PDFium.
      Reported by Han Zheng (HexHive).
    - CVE-2024-5847: Use after free in PDFium.
      Reported by Han Zheng (HexHive).
  * d/copyright: delete bullseye environment that upstream ships (??).
  * d/patches:
    - upstream/appservice-include.patch: drop, merged upstream.
    - upstream/lens-include.patch: drop, merged upstream.
    - upstream/mojo-bindings-include.patch: drop, merged upstream.
    - upstream/ninja.patch: drop, merged upstream.
    - upstream/no-vector-consts.patch: drop, merged upstream.
    - upstream/vulkan-include.patch: drop, merged upstream.
    - system/clang-format.patch: drop it; we broke it some time ago, and
      didn't notice. Guess we don't need it?
    - bookworm/clang16.patch: refresh.
    - fixes/bad-font-gc00000.patch: refresh
    - fixes/bad-font-gc11.patch: refresh
    - fixes/bad-font-gc2.patch: refresh
    - disable/signin.patch: refresh
    - upstream/quiche-deque.patch: gcc build fix pulled from upstream.
    - upstream/gpu-header.patch: add header build fix from upstream.
    - upstream/blink-header.patch: add header build fix from upstream.
    - upstream/blink-header2.patch: add header build fix from upstream.
    - upstream/blink-header3.patch: add header build fix from upstream.
    - upstream/realtime-reporting.patch: gcc build fix from upstream.
    - upstream/urlvisit-header.patch: add header build fix from upstream.
    - upstream/accessibility-format.patch: gcc build fix from upstream.
    - bookworm/urlhelper-ctor.patch: work around a clang-16 bug; add an
      explicit constructor.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - sandbox/0008-sandbox-fix-ppc64le-glibc234.patch: Modify for upstream
      changes
    - third_party/0002-Add-PPC64-generated-files-for-boringssl.patch: Modify
      for upstream changes
    - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: Refresh
      for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Thu, 13 Jun 2024 21:31:56 -0400

chromium (125.0.6422.141-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-5493: Heap buffer overflow in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-5494: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-5495: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-5496: Use after free in Media Session.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-5497: Out of bounds memory access in Keyboard Inputs.
      Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
    - CVE-2024-5498: Use after free in Presentation API.
    - CVE-2024-5499: Out of bounds write in Streams API.
  * d/patches/fixes/libxml-parseerr.patch: move to bookworm directory.
  * d/control: add versioned build-dep on libxml2-dev < 2.10.

 -- Andres Salomon <dilinger@debian.org>  Thu, 30 May 2024 22:11:26 -0400

chromium (125.0.6422.112-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-5274: Type Confusion in V8. Reported by Clément Lecigne of
      Google's Threat Analysis Group and Brendon Tiszka of Chrome Security.
  * Fix handling of quoted arguments (closes: #1071662).

 -- Andres Salomon <dilinger@debian.org>  Thu, 23 May 2024 20:51:14 -0400

chromium (125.0.6422.76-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-5157: Use after free in Scheduling. Reported by Looben Yang.
    - CVE-2024-5158: Type Confusion in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2024-5159: Heap buffer overflow in ANGLE.
      Reported by David Sievers (@loknop).
    - CVE-2024-5160: Heap buffer overflow in Dawn. Reported by wgslfuzz.
  * Don't silently ignore arguments meant for the wrapper script if chromium
    args happen to come first (closes: #1068096).

 -- Andres Salomon <dilinger@debian.org>  Tue, 21 May 2024 16:12:47 -0400

chromium (125.0.6422.60-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-4947: Type Confusion in V8. Reported by Vasily
      Berdnikov (@vaber_b) and Boris Larin (@oct0xor) of Kaspersky.
    - CVE-2024-4948: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-4949: Use after free in V8.
      Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team.
    - CVE-2024-4950: Inappropriate implementation in Downloads.
      Reported by Shaheen Fazim.
  * d/copyright: fix instrumented_libs deletion; upstream renamed it.
  * d/scripts/unbundle: bundle new requirement absl_crc (which is
    unavailable in bookworm).
  * d/patches:
    - upstream/uint-includes.patch: drop,merged upstream.
    - upstream/fps-optional.patch: drop, merged upstream.
    - upstream/span-optional.patch: drop, merged upstream.
    - upstream/extractor-bitset.patch: drop, merged upstream.
    - upstream/atomic.patch: drop, merged upstream.
    - upstream/webgpu-optional.patch: drop, merged upstream.
    - disable/catapult.patch: refresh.
    - i386/angle-lockfree.patch: drop, I _think_ it's no longer needed.
    - upstream/ruy-include.patch: add header build fix.
    - upstream/vulkan-include.patch: add header build fix.
    - upstream/mojo-bindings-include.patch: add header build fix.
    - upstream/appservice-include.patch: add header build fix.
    - upstream/no-vector-consts.patch: add build fix; gnu libstdc++
      doesn't allow const types inside vectors.
    - upstream/lens-include.patch: add header build fix.
    - bookworm/nvt2.patch: drop (replace with a better non-revert patch).
    - bookworm/v8-wrappable.patch: add nvt2.patch build fix replacement
      that just defines a single struct member.
    - upstream/ninja.patch: add build fix for failure triggered by
      ninja-1.12.
    - fixes/bad-font-gc00000.patch: add formatting patch revert to make
      other patches easier to apply.
    - fixes/bad-font-gc2.patch: add a build failure fix & refresh.
    - fixes/bad-font-gc11.patch: add a build failure fix & refresh.
    - bookworm/bubble-contents.patch: refresh.
    - bookworm/omnibox-constexpr.patch: add constexpr -> const build fix.
    - upstream/tabstrip-include.patch: add header build fix.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: Modify for
      upstream changes
    - third_party/0002-Add-PPC64-generated-files-for-boringssl.patch: Add
      pregenerated configuration for ppc64el support in BoringSSL
    - third_party/0002-third-party-boringssl-add-generated-files.patch:
      Rename to third_party/0002-Add-PPC64-generated-files-for-boringssl.patch
    - workarounds/HACK-debian-clang-disable-skia-musttail.patch: Refresh
      for upstream changes
    - third_party/skia-vsx-instructions.patch: Refresh for upstream changes
    - ffmpeg/0001-Add-support-for-ppc64.patch: Refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Thu, 16 May 2024 18:55:41 -0400

chromium (124.0.6367.207-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-4761: Out of bounds write in V8. Reported by Anonymous.

 -- Andres Salomon <dilinger@debian.org>  Tue, 14 May 2024 22:17:42 -0400

chromium (124.0.6367.201-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-4671: Use after free in Visuals. Reported by Anonymous.

 -- Andres Salomon <dilinger@debian.org>  Thu, 09 May 2024 20:37:07 -0400

chromium (124.0.6367.155-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-4558: Use after free in ANGLE. Reported by gelatin dessert.
    - CVE-2024-4559: Heap buffer overflow in WebAudio.
      Reported by Cassidy Kim(@cassidy6564).
  * d/control: replace libu2f-udev recommends with udev (closes: #1070283).

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/skia-vsx-instructions.patch: fix various issues.

 -- Andres Salomon <dilinger@debian.org>  Tue, 07 May 2024 14:47:32 -0400

chromium (124.0.6367.118-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-4331: Use after free in Picture In Picture.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2024-4368: Use after free in Dawn. Reported by wgslfuzz.
  * Build-dep on libhwy-dev and delete the bundled third_party/highway.
  * Build-dep on libharfbuzz-dev and delete the bundled harfbuzz-ng.
  * Build-dep on libdav1d-dev and delete the bundled third_party/dav1d.
  * d/patches:
    - ppc64le/third_party/0001-Add-PPC64-support-for-libdav1d.patch,
      ppc64le/third_party/0001-Fix-libdav1d-compilation-on-clang-ppc.patch,
      ppc64le/third_party/0003-thirdparty-fix-dav1d-gn.patch,
      fixes/arm64-ftbfs.patch: drop these 4 patches that are only needed
      for bundled libdav1d.
    - ppc64le/third_party/0001-Fix-highway-ppc-hwcap.patch,
      ppc64le/third_party/0002-Highway-disable-128-bit-vsx.patch: drop
      these two patches that were needed for bundled highway.
    - upstream/ozone1.patch: drop, merged upstream.
    - upstream/ozone2.patch: drop, merged upstream.
    - fixes/bad-font-gc2.patch: refresh.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: Fix inadvertent
      breakage of i386 build

 -- Andres Salomon <dilinger@debian.org>  Tue, 30 Apr 2024 17:53:52 -0400

chromium (124.0.6367.78-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-4058: Type Confusion in ANGLE.
      Reported by Toan (suto) Pham and Bao (zx) Pham of Qrious Secure.
    - CVE-2024-4059: Out of bounds read in V8 API. Reported by Eirik.
    - CVE-2024-4060: Use after free in Dawn. Reported by wgslfuzz.

 -- Andres Salomon <dilinger@debian.org>  Thu, 25 Apr 2024 19:07:35 -0400

chromium (124.0.6367.60-2~deb12u1) bookworm-security; urgency=high

  * d/patches/ppc64le:
     - third_party/0001-Add-PPC64-support-for-boringssl.patch: update for
       upstream boringssl changes and reenable
     - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
       regenerate from new ffmpeg source tree
     - third_party/skia-vsx-instructions.patch: update for upstream changes

  [ Andres Salomon ]
  * d/patches:
    - fixes/arm64-ftbfs.patch: add arm64-specific ftbfs fix for libdav1d.
    - upstream/ozone1.patch, upstream/ozone2.patch: backport fixes for
      broken wayland support (closes: #1069586).

 -- Timothy Pearson <tpearson@debian.org>  Thu, 25 Apr 2024 15:49:00 -0500

chromium (124.0.6367.60-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-3832: Object corruption in V8.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2024-3833: Object corruption in WebAssembly.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2024-3914: Use after free in V8. Reported by Seunghyun Lee
      (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024.
    - CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang
    - CVE-2024-3837: Use after free in QUIC.
      Reported by {rotiple, dch3ck} of CW Research Inc.
    - CVE-2024-3838: Inappropriate implementation in Autofill.
      Reported by Ardyan Vicky Ramadhan.
    - CVE-2024-3839: Out of bounds read in Fonts.
      Reported by Ronald Crane (Zippenhop LLC).
    - CVE-2024-3840: Insufficient policy enforcement in Site Isolation.
      Reported by Ahmed ElMasry.
    - CVE-2024-3841: Insufficient data validation in Browser Switcher.
      Reported by Oleg.
    - CVE-2024-3843: Insufficient data validation in Downloads.
      Reported by Azur.
    - CVE-2024-3844: Inappropriate implementation in Extensions.
      Reported by Alesandro Ortiz.
    - CVE-2024-3845: Inappropriate implementation in Network.
      Reported by Daniel Baulig.
    - CVE-2024-3846: Inappropriate implementation in Prompts.
      Reported by Ahmed ElMasry.
    - CVE-2024-3847: Insufficient policy enforcement in WebUI.
      Reported by Yan Zhu.
  * d/copyright:
    - delete __pycache__ directories to shut up dpkg warnings.
    - stop deleting bundled libwebp directory.
  * Drop build-dep on libwebp-dev and start building against the bundled
    libwebp. We need to do this because chromium uses features of libavif
    that require libsharpyuv-dev; but that's only available in sid/trixie.
  * d/patches:
    - upstream/std-to-address.patch: drop, merged upstream.
    - fixes/optional2.patch: drop, merged upstream.
    - fixes/blink-fonts-shape-result.patch: drop, merged upstream.
    - bookworm/constexpr-equality.patch: drop, merged upstream.
    - disable/catapult.patch: refresh.
    - disable/google-api-warning.patch: rework to be a smaller patch.
    - bookworm/clang16.patch: refresh.
    - ungoogled/disable-privacy-sandbox.patch: drop hunk related to deprecated
      preference.
    - upstream/mojo-null.patch: pull a (typescript) build fix from upstream.
    - upstream/uint-includes.patch: simple header build fix from upstream.
    - upstream/fps-optional.patch: add header build fix.
    - upstream/span-optional.patch: add header build fix.
    - upstream/extractor-bitset.patch: add header build fix.
    - upstream/atomic.patch: add header build fix.
    - upstream/webgpu-optional.patch: add header build fix.
    - fixes/absl-optional.patch: comment out assert() that caused crash.
      This could be another clang16/libstdc++ miscompilation issue, but
      needs further investigation.
    - fixes/bad-font-gc2.patch: drop a bunch of test-related pieces.
    - fixes/bad-font-gc0000.patch, fixes/bad-font-gc000.patch,
      fixes/bad-font-gc00.patch, fixes/bad-font-gc0.patch,
      fixes/bad-font-gc11.patch, fixes/bad-font-gc3.patch: revert a bunch
      more (new) upstream commits related to bad-font-gc2.patch. When the
      use-after-free bug gets fixed, all this can be dropped.
  * d/patches/ppc64le:
    - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch,
      third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch,
      workarounds/HACK-third_party-libvpx-use-generic-gnu.patch,
      breakpad/0001-Implement-support-for-ppc64-on-Linux.patch,
      ffmpeg/0001-Add-support-for-ppc64.patch,
      third_party/dawn-fix-typos.patch,
      third_party/use-sysconf-page-size-on-ppc64.patch: refresh.
    - third_party/skia-vsx-instructions.patch: refresh & update for header
      renaming.
    - third_party/0001-Add-PPC64-support-for-boringssl.patch,
      third_party/0002-third-party-boringssl-add-generated-files.patch:
      disable these two until Tim has a chance to look at them.

 -- Andres Salomon <dilinger@debian.org>  Fri, 19 Apr 2024 12:33:38 -0400

chromium (123.0.6312.122-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-3157: Out of bounds write in Compositing.
      Reported by DarkNavy.
    - CVE-2024-3516: Heap buffer overflow in ANGLE.
      Reported by Bao (zx) Pham and Toan (suto) Pham of Qrious Secure.
    - CVE-2024-3515: Use after free in Dawn. Reported by wgslfuzz.

 -- Andres Salomon <dilinger@debian.org>  Wed, 10 Apr 2024 21:21:05 -0400

chromium (123.0.6312.105-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-3156: Inappropriate implementation in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2024-3158: Use after free in Bookmarks. Reported by undoingfish.
    - CVE-2024-3159: Out of bounds memory access in V8. Reported by
      Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) of Palo Alto
      Networks, via Pwn2Own 2024.

 -- Andres Salomon <dilinger@debian.org>  Tue, 02 Apr 2024 18:28:18 -0400

chromium (123.0.6312.86-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-2883: Use after free in ANGLE.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-2885: Use after free in Dawn. Reported by wgslfuzz.
    - CVE-2024-2886: Use after free in WebCodecs. Reported by
      Seunghyun Lee (@0x10n) of KAIST Hacking Lab, via Pwn2Own 2024.
    - CVE-2024-2887: Type Confusion in WebAssembly.
      Reported by Manfred Paul, via Pwn2Own 2024.
  * d/patches/ppc64le:
    - fixes/fix-clang-selection.patch: select clang on ppc64 platforms
    - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: fix
      ARM builds.

  [ Andres Salomon ]
  * d/patches:
    - fixes/bad-font-gc1.patch, fixes/bad-font-gc2.patch: revert a pair of
      upstream commits that result in blink's garbage collector frequently
      deadlocking and crashing (closes: #1067886).

 -- Timothy Pearson <tpearson@debian.org>  Wed, 28 Mar 2024 16:58:00 -0500

chromium (123.0.6312.58-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-2625: Object lifecycle issue in V8.
      Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team.
    - CVE-2024-2626: Out of bounds read in Swiftshader.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-2627: Use after free in Canvas. Reported by Anonymous.
    - CVE-2024-2628: Inappropriate implementation in Downloads.
      Reported by Ath3r1s.
    - CVE-2024-2629: Incorrect security UI in iOS.
      Reported by Muneaki Nishimura (nishimunea).
    - CVE-2024-2630: Inappropriate implementation in iOS.
      Reported by James Lee (@Windowsrcer).
    - CVE-2024-2631: Inappropriate implementation in iOS.
      Reported by Ramit Gangwar.
  * d/patches:
    - upstream/bitset.patch: drop, merged upstream.
    - upstream/bookmarknode.patch: drop, merged upstream.
    - upstream/optional.patch: drop, merged upstream.
    - upstream/uniqptr.patch: drop, merged upstream.
    - fixes/gcc13-headers.patch: drop, merged upstream.
    - fixes/optional.patch: drop, merged upstream.
    - fixes/material-utils.patch: drop part that was merged upstream.
    - disable/catapult.patch: refresh.
    - bookworm/constexpr-equality.patch: include another similar fix.
    - bookworm/nvt.patch: refresh.
    - bookworm/undo-internal-alloc.patch: drop, as this was fixed upstream.
    - ungoogled/disable-privacy-sandbox.patch: update from ungoogled-chromium.
    - disable/angle-perftests.patch: drop, replace with a gn build argument.
    - bookworm/rust-downgrade-osstr-users.patch: add new patch to downgrade
      clap-lex crate, as it's using 1.74 features and we only have 1.70.
    - fixes/strlcpy.patch: add strlcpy declaration (closes: #1066235).
    - fixes/optional2.patch: add another missing <optional> inclusion.
    - fixes/stats-collector.patch: add build fix for wrong header.
    - disable/screen-ai-blob.patch: add patch to not register the
      ScreenAI component. Previously, if you opened a PDF and clicked
      "open in reader mode", it would download a binary blob to
      ~/.config/chromium/screen_ai/, and do OCR stuff (and who knows
      what else) in that opaque blob without warning you. We, uh, don't
      want that. (closes: #1066910).
    - bookworm/generate-ninja.patch: drop, merged upstream.
    - bookworm/bubble-contents.patch: update for renamed header.
    - bookworm/eraseif0.patch, eraseif-lambda.patch: drop, upstream merged
      a fix for g++-12 compilation.
    - bookworm/constexpr.patch: add yet another constexpr g++-12 fix.
    - bookworm/sizet.patch: another simple g++-12 build fix.
  * d/rules: add angle_build_tests=false build argument, which allows us to
    drop angle-perftests.patch.

  [ Timothy Pearson ]
  * d/patches:
    - fixes/blink-fonts-shape-result.patch: pull in upstream patch for
      compilation failure in Blink SameSizeAsShapeResult class
  * d/patches/ppc64le:
    - ffmpeg/0001-Add-support-for-ppc64.patch: refresh for upstream changes
    - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
      refresh for upstream changes
    - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh
      for upstream changes
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh for
      upstream changes
    - third_party/skia-vsx-instructions.patch: refresh & harden Skia against
      timing attacks.

 -- Andres Salomon <dilinger@debian.org>  Fri, 22 Mar 2024 12:45:06 -0400

chromium (122.0.6261.128-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-2400: Use after free in Performance Manager.
      Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.

 -- Andres Salomon <dilinger@debian.org>  Tue, 12 Mar 2024 18:43:05 -0400

chromium (122.0.6261.111-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-2173: Out of bounds memory access in V8.
      Reported by 5fceb6172bbf7e2c5a948183b53565b9.
    - CVE-2024-2174: Inappropriate implementation in V8.
      Reported by 5f46f4ee2e17957ba7b39897fb376be8.
    - CVE-2024-2176: Use after free in FedCM. Reported by Anonymous.
  * d/rules: drop bullseye nodejs workaround.
  * Add a build-dep on (the newly backported) rustc-web, drop
    d/patches/bookworm/undo-rust-req.patch, and enable rust.

 -- Andres Salomon <dilinger@debian.org>  Tue, 05 Mar 2024 16:40:05 -0500

chromium (122.0.6261.94-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - Type Confusion in V8. Reported by 5f46f4ee2e17957ba7b39897fb376be8.
    - Type Confusion in V8. Reported by
      Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab.

 -- Andres Salomon <dilinger@debian.org>  Tue, 27 Feb 2024 15:15:03 -0500

chromium (122.0.6261.57-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-1669: Out of bounds memory access in Blink.
      Reported by Anonymous.
    - CVE-2024-1670: Use after free in Mojo.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-1671: Inappropriate implementation in Site Isolation.
      Reported by Harry Chen.
    - CVE-2024-1672: Inappropriate implementation in Content Security Policy.
      Reported by Georg Felber (TU Wien) & Marco Squarcina (TU Wien).
    - CVE-2024-1673: Use after free in Accessibility.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2024-1674: Inappropriate implementation in Navigation.
      Reported by David Erceg.
    - CVE-2024-1675: Insufficient policy enforcement in Download.
      Reported by Bartłomiej Wacko.
    - CVE-2024-1676: Inappropriate implementation in Navigation.
      Reported by Khalil Zhani.
  * d/patches:
    - fixes/v8-compressed-ptrs.patch: drop, merged upstream.
    - fixes/stdint.patch: drop, merged upstream.
    - upstream/vector.patch: drop, merged upstream.
    - upstream/display-header.patch: drop, merged upstream.
    - upstream/bitset.patch: drop, merged upstream.
    - upstream/once_flag.patch: drop, merged upstream.
    - fixes/std-to-address.patch: refresh.
    - disable/signin.patch: refresh.
    - disable/catapult.patch: refresh.
    - bookworm/clang16.patch: refresh, and change
      -Wno-c++11-narrowing-const-reference to -Wno-c++11-narrowing.
    - bookworm/nvt.patch: refresh.
    - ungoogled/disable-privacy-sandbox.patch: update from ungoogled-chromium.
    - bookworm/undo-internal-alloc.patch: revert a commit that confuses
      clang16 w/ libstdc++. We need a better workaround than this.
    - upstream/mojo.patch: update from git.
    - bookworm/constexpr-equality.patch: add a few more build fixes
      (constexpr removals).
    - upstream/uniqptr.patch: add missing include.
    - upstream/optional.patch: add missing include.
    - upstream/bookmarknode.patch: add comparison equality fix pulled from
      upstream.
    - fixes/optional.patch: add missing includes.
    - bookworm/nvt2.patch: revert another upstream c++-20 change for clang-16.
    - upstream/bitset.patch: add missing include.
    - ppc64le/v8/0002-Add-ppc64-trap-instructions.patch: refresh.
    - bookworm/eraseif0.patch: revert another commit; needed by
      eraseif-lambda.patch.
    - bookworm/eraseif-lamba.patch: refresh.
    - bookworm/undo-rust-req.patch: refresh.
    - bookworm/bubble-contents.patch: remove static_assert() that fails with
      libstdc++12.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - 0001-Properly-detect-little-endian-PPC64-systems.patch: drop, upstream
      fix in GIT hash 25a6e6
    - 0001-Add-PPC64-support-for-boringssl.patch: refresh for upstream changes
    - 0002-third_party-libvpx-Remove-bad-ppc64-config.patch: refresh for
      upstream changes
    - skia-vsx-instructions.patch: refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Wed, 21 Feb 2024 19:56:32 -0500

chromium (121.0.6167.160-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-1284: Use after free in Mojo. Reported by Anonymous.
    - CVE-2024-1283: Heap buffer overflow in Skia.
      Reported by Jorge Buzeti (@r3tr074).

 -- Andres Salomon <dilinger@debian.org>  Tue, 06 Feb 2024 22:41:53 -0500

chromium (121.0.6167.139-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-1060: Use after free in Canvas. Reported by Anonymous.
    - CVE-2024-1059: Use after free in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2024-1077: Use after free in Network.
      Reported by Microsoft Security Research Center.

 -- Andres Salomon <dilinger@debian.org>  Wed, 31 Jan 2024 11:49:10 -0500

chromium (121.0.6167.85-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2024-0807: Use after free in WebAudio.
      Reported by Huang Xilin of Ant Group Light-Year Security Lab.
    - CVE-2024-0812: Inappropriate implementation in Accessibility.
      Reported by Anonymous.
    - CVE-2024-0808: Integer underflow in WebUI.
      Reported by Lyra Rebane (rebane2001).
    - CVE-2024-0810: Insufficient policy enforcement in DevTools.
      Reported by Shaheen Fazim.
    - CVE-2024-0814: Incorrect security UI in Payments.
      Reported by Muneaki Nishimura (nishimunea).
    - CVE-2024-0813: Use after free in Reading Mode. Reported by @retsew0x01.
    - CVE-2024-0806: Use after free in Passwords.
      Reported by 18楼梦想改造家.
    - CVE-2024-0805: Inappropriate implementation in Downloads.
      Reported by Om Apip.
    - CVE-2024-0804: Insufficient policy enforcement in iOS Security UI.
      Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) .
    - CVE-2024-0811: Inappropriate implementation in Extensions API.
      Reported by Jann Horn of Google Project Zero.
    - CVE-2024-0809: Inappropriate implementation in Autofill.
      Reported by Ahmed ElMasry.
  * d/copyright: drop another eu-strip binary.
  * d/patches:
    - fixes/atspi.patch: drop, merged upstream.
    - fixes/gcc13-headers.patch: drop portions that were merged upstream.
    - upstream/nullptr_t.patch: drop, merged upstream.
    - upstream/string-include.patch: drop, merged upstream.
    - ungoogled/disable-web-environment-integrity.patch: remove, upstream
      wisely backed off and removed WEI.
    - disable/signin.patch: refresh for minor upstream changes.
    - disable/catapult.patch: refresh for minor upstream changes.
    - system/openjpeg.patch: refresh for minor upstream changes.
    - bookworm/clang16.patch: drop portion that was merged upstream.
    - upstream/vector.patch: missing header fix, pulled from upstream.
    - upstream/display-header.patch: missing header fix, pulled from upstream.
    - upstream/bitset.patch: missing header fix, pulled from upstream.
    - upstream/once_flag.patch: missing header fix, pulled from upstream.
    - bookworm/constexpr-equality.patch: add clang-16 workaround.
    - bookworm/nvt.patch: revert an upstream c++-20 change that confuses
      clang-16.
    - fixes/libxml-parseerr.patch: revert change from a newer libxml than
      debian's.
    - bookworm/undo-rust-req.patch: revert change that makes rust required
      to build (for now).
    - bookworm/eraseif-lamba.patch: revert changes switching to std::erase_if
      to work around libstdc++-12 bug.

  [ Timothy Pearson ]
  * d/patches:
    - fixes/std-to-address.patch: work around incorrect template selection
      in Mojo ConvertTo()
    - fixes/stdint.patch: add missing stdint include to performance manager
  * d/patches/ppc64le:
    - fixes/fix-rust-linking.patch: allow linking C and Rust libraries in full
      archive mode
    - libaom/0001-Add-pregenerated-config-for-libaom-on-ppc64.patch: refresh
      for upstream changes
    - third_party/skia-vsx-instructions.patch: refresh for upstream changes
    - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
      refresh for upstream changes
    - third_party/0003-third_party-libvpx-Add-ppc64-generated-config.patch:
      refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 23 Jan 2024 17:59:49 -0500

chromium (120.0.6099.224-2) unstable; urgency=high

  * d/patches/ppc64le/fixes/fix-rustc.patch: add patch to fix ppc64le build.

 -- Andres Salomon <dilinger@debian.org>  Thu, 18 Jan 2024 03:05:12 -0500

chromium (120.0.6099.224-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-0517: Out of bounds write in V8.
      Reported by Toan (suto) Pham of Qrious Secure.
    - CVE-2024-0518: Type Confusion in V8.
      Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team.
    - CVE-2024-0519: Out of bounds memory access in V8. Reported by Anonymous.
  * d/rules: fix search path for clang libs.

 -- Andres Salomon <dilinger@debian.org>  Tue, 16 Jan 2024 15:35:05 -0500

chromium (120.0.6099.216-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-0333: Insufficient data validation in Extensions.
      Reported by Malcolm Stagg (@malcolmst) of SODIUM-24, LLC.

 -- Andres Salomon <dilinger@debian.org>  Tue, 09 Jan 2024 20:54:53 -0500

chromium (120.0.6099.199-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2024-0222: Use after free in ANGLE.
      Reported by Toan (suto) Pham of Qrious Secure.
    - CVE-2024-0223: Heap buffer overflow in ANGLE.
      Reported by Toan (suto) Pham and Tri Dang of Qrious Secure.
    - CVE-2024-0224: Use after free in WebAudio.
      Reported by Huang Xilin of Ant Group Light-Year Security Lab.
    - CVE-2024-0225: Use after free in WebGPU. Reported by Anonymous.

 -- Andres Salomon <dilinger@debian.org>  Wed, 03 Jan 2024 22:53:21 -0500

chromium (120.0.6099.129-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-7024: Heap buffer overflow in WebRTC. Reported by
      Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group.

 -- Andres Salomon <dilinger@debian.org>  Wed, 20 Dec 2023 21:05:12 -0500

chromium (120.0.6099.109-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-6702: Type Confusion in V8. Reported by
      Zhiyi Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group.
    - CVE-2023-6703: Use after free in Blink.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-6704: Use after free in libavif. Reported by Fudan University.
    - CVE-2023-6705: Use after free in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-6706: Use after free in FedCM. Reported by anonymous.
    - CVE-2023-6707: Use after free in CSS. Reported by @ginggilBesel.

 -- Andres Salomon <dilinger@debian.org>  Tue, 12 Dec 2023 19:52:08 -0500

chromium (120.0.6099.71-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2023-6508: Use after free in Media Stream.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-6509: Use after free in Side Panel Search.
      Reported by Khalil Zhani.
    - CVE-2023-6510: Use after free in Media Capture. Reported by [pwn2car].
    - CVE-2023-6511: Inappropriate implementation in Autofill.
      Reported by Ahmed ElMasry.
    - CVE-2023-6512: Inappropriate implementation in Web Browser UI.
      Reported by Om Apip.
  * d/copyright: adjust path for chai.js & mocha.js deletion.
    - delete third_party/libsecret.
  * d/control: new build depends on libsecret-1-dev.
  * d/scripts/unbundle: keep bundled libhwy; it's not available in bullseye.
    - also keep vulkan_memory_allocator and flatbuffers.
  * d/patches:
    - fixes/gcc13-headers.patch: refresh.
    - fixes/blink-frags.patch: drop part of patch & refresh.
    - disable/catapult.patch: refresh.
    - disable/driver-chrome-path.patch: update for minor upstream changes.
    - ungoogled/disable-privacy-sandbox.patch: update from ungoogled-chromium.
    - ungoogled/disable-web-environment-integrity.patch: update from
      from ungoogled-chromium.
    - upstream/mojo.patch: update patch from upstream's git.
    - bookworm/clang16.patch: new patch working around upstream's clang18 flags.
    - upstream/nullptr_t.patch: more libstdc++13 build fixes.
    - upstream/string-include.patch: add a simple header include build fix.
    - fixes/absl-optional.patch: add a workaround for a clang bug
      (https://github.com/llvm/llvm-project/issues/50248) by providing our
      own 'optional' header.
    - bookworm/constcountrycode.patch: add workaround for older libstdc++.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - third_party/0001-Add-PPC64-support-for-libdav1d.patch: refresh for
      upstream changes
    - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
      refresh for upstream changes
    - third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
      regenerate
    - third_party/skia-vsx-instructions.patch: refresh for upstream changes
    - third_party/use-sysconf-page-size-on-ppc64.patch: refresh for upstream
      changes
    - Mass refresh all other patches against 120 codebase.  No functional
      change.

 -- Andres Salomon <dilinger@debian.org>  Fri, 08 Dec 2023 11:40:41 -0500

chromium (119.0.6045.199-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-6348: Type Confusion in Spellcheck.
      Reported by Mark Brand of Google Project Zero.
    - CVE-2023-6347: Use after free in Mojo. Reported by
      Leecraso and Guang Gong of 360 Vulnerability Research Institute.
    - CVE-2023-6346: Use after free in WebAudio.
      Reported by Huang Xilin of Ant Group Light-Year Security Lab.
    - CVE-2023-6350: Out of bounds memory access in libavif.
      Reported by Fudan University.
    - CVE-2023-6351: Use after free in libavif. Reported by Fudan University.
    - CVE-2023-6345: Integer overflow in Skia. Reported by
      Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group.

 -- Andres Salomon <dilinger@debian.org>  Tue, 28 Nov 2023 23:33:06 -0500

chromium (119.0.6045.159-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-5997: Use after free in Garbage Collection.
      Reported by Anonymous.
    - CVE-2023-6112: Use after free in Navigation.
      Reported by Sergei Glazunov of Google Project Zero.
  * Don't show errors on startup if Crash Reports directory doesn't exist.
  * Check for $DISPLAY before trying to run xmessage in chromium's wrapper
    script. Fall back to just using echo (closes: #1055765).

 -- Andres Salomon <dilinger@debian.org>  Tue, 14 Nov 2023 20:04:30 -0500

chromium (119.0.6045.123-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-5996: Use after free in WebAudio. Reported by
      Huang Xilin of Ant Group Light-Year Security Lab via Tianfu Cup 2023.
  * Replace libgl1-mesa-dev build dependency with libgl-dev.
  * Drop d/patches/system/convertutf.patch; license issue has been fixed.
  * d/copyright: stop deleting convert_UTF.* and document Unicode copyright
    (closes: #1033136).
  * d/patches/ppc64le/fixes/fix-breakpad-compile.patch: refresh due to convertutf
    change.

 -- Andres Salomon <dilinger@debian.org>  Tue, 07 Nov 2023 23:49:10 -0500

chromium (119.0.6045.105-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2023-5480: Inappropriate implementation in Payments.
      Reported by Vsevolod Kokorin (Slonser) of Solidlab.
    - CVE-2023-5482: Insufficient data validation in USB. Reported by DarkNavy.
    - CVE-2023-5849: Integer overflow in USB. Reported by DarkNavy.
    - CVE-2023-5850: Incorrect security UI in Downloads.
      Reported by Mohit Raj (shadow2639) .
    - CVE-2023-5851: Inappropriate implementation in Downloads.
      Reported by Shaheen Fazim.
    - CVE-2023-5852: Use after free in Printing. Reported by [pwn2car].
    - CVE-2023-5853: Incorrect security UI in Downloads. Reported by Hafiizh.
    - CVE-2023-5854: Use after free in Profiles. Reported by
      Dohyun Lee (@l33d0hyun) of SSD-Disclosure Labs & DNSLab, Korea Univ.
    - CVE-2023-5855: Use after free in Reading Mode. Reported by ChaobinZhang.
    - CVE-2023-5856: Use after free in Side Panel.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2023-5857: Inappropriate implementation in Downloads.
      Reported by Will Dormann.
    - CVE-2023-5858: Inappropriate implementation in WebApp Provider.
      Reported by Axel Chong.
    - CVE-2023-5859: Incorrect security UI in Picture In Picture.
      Reported by Junsung Lee
  * d/patches:
    - patches/bullseye/constexpr.patch: Add MiracleParameter workaround
  * d/patches/ppc64le:
    - Mass refresh all patches against 119 codebase.  No functional change.

  [ Andres Salomon ]
  * d/patches:
    - fixes/gcc13-headers.patch: drop parts that have been merged upstream.
    - fixes/perfetto.patch: drop part that was merged upstream.
    - upstream/sensor-reading.patch: drop, merged upstream.
    - upstream/lweight.patch: drop, merged upstream.
    - upstream/freetype.patch: drop, merged upstream.
    - upstream/sizet.patch: drop, merged upstream.
    - disable/catapult.patch: drop an unused hunk.
    - disable/widevine-cdm-cu.patch: refresh.
    - disable/privacy-sandbox.patch: rename, sync up with ungoogled-chromium,
      and use the full ungoogled patch. The privacy sandbox config interface
      is now gone, with no way to enable it.
    - ungoogled/core/ungoogled-chromium/disable-web-environment-integrity.patch:
      sync up with ungoogled-chromium, and rename.
    - fixes/blink-frags.patch: additional build fix for libstdc++13.
    - fixes/gcc13-with-clang14.patch: drop, now that we've switched to clang-16.
    - fixes/atspi.patch: fix build failure with atspi >= 2.50.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Tue, 31 Oct 2023 23:50:00 -0500

chromium (118.0.5993.117-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-5472: Use after free in Profiles.
      Reported by @18楼梦想改造家.
  * Switch from clang-14 to clang-16.
  * d/patches:
    - bookworm/clang-attribs.patch: drop, now that we've switched to clang-16.
    - bookworm/typename.patch: drop, now that we've switched to clang-16.
    - bookworm/struct-ctor.patch: drop, now that we've switched to clang-16.
    - bookworm/structured-binding-scope-bug.patch: drop, now that we've
      switched to clang-16.
    - bookworm/stringpiece3.patch: drop, now that we've switched to clang-16.
    - bookworm/initialize-const-ctor.patch: drop, now that we've switched to
      clang-16.
    - bookworm/i386-lock-free.patch: drop, now that we've switched to clang-16.
    - bullseye/clang13.patch: drop, now that we've switched to clang-16.
    - fixes/brandversion-construct.patch: drop, now that we've switched to
      clang-16.
    - fixes/SkColor4f-init.patch: drop, now that we've switched to clang-16.

 -- Andres Salomon <dilinger@debian.org>  Tue, 24 Oct 2023 20:00:54 -0400

chromium (118.0.5993.70-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2023-5218: Use after free in Site Isolation.
      Reported by @18楼梦想改造家.
    - CVE-2023-5487: Inappropriate implementation in Fullscreen.
      Reported by Anonymous.
    - CVE-2023-5484: Inappropriate implementation in Navigation.
      Reported by Thomas Orlita.
    - CVE-2023-5475: Inappropriate implementation in DevTools.
      Reported by Axel Chong.
    - CVE-2023-5483: Inappropriate implementation in Intents.
      Reported by Axel Chong.
    - CVE-2023-5481: Inappropriate implementation in Downloads.
      Reported by Om Apip.
    - CVE-2023-5476: Use after free in Blink History. Reported by Yunqin Sun.
    - CVE-2023-5474: Heap buffer overflow in PDF. Reported by [pwn2car].
    - CVE-2023-5479: Inappropriate implementation in Extensions API.
      Reported by Axel Chong.
    - CVE-2023-5485: Inappropriate implementation in Autofill.
      Reported by Ahmed ElMasry.
    - CVE-2023-5478: Inappropriate implementation in Autofill.
      Reported by Ahmed ElMasry.
    - CVE-2023-5477: Inappropriate implementation in Installer.
      Reported by Bahaa Naamneh of Crosspoint Labs.
    - CVE-2023-5486: Inappropriate implementation in Input. Reported by Hafiizh.
    - CVE-2023-5473: Use after free in Cast. Reported by DarkNavy.
  * d/patches/ppc64le:
    - 0002-third_party-libvpx-Remove-bad-ppc64-config.patch: refresh for
       upstream changes
    - 0001-Add-PPC64-support-for-boringssl.patch: refresh for upstream changes
    - skia-vsx-instructions.patch: refresh for upstream changes
    - third_party/0003-third_party-libvpx-Add-ppc64-generated-config.patch:
      regenerate configs from upstream source
    - database/0001-Properly-detect-little-endian-PPC64-systems.patch:
      refresh
    - ffmpeg/0001-Add-support-for-ppc64.patch: refresh
    - fixes/fix-breakpad-compile.patch: refresh
    - fixes/fix-unknown-warning-option-messages.diff: refresh
    - libaom/0001-Add-ppc64-target-to-libaom.patch: refresh
    - sandbox/0001-sandbox-linux-Update-IsSyscallAllowed-in-broker_proc.patch:
      refresh
    - sandbox/0001-sandbox-linux-Update-syscall-helpers-lists-for-ppc64.patch:
      refresh
    - sandbox/0008-sandbox-fix-ppc64le-glibc234.patch: refresh
    - third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh
    - third_party/0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.patch:
      refresh
    - third_party/0001-third_party-libvpx-Properly-generate-gni-on-ppc64.patch:
      refresh
    - third_party/0002-third-party-boringssl-add-generated-files.patch: refresh
    - third_party/dawn-fix-ppc64le-detection.patch: refresh
    - third_party/dawn-fix-typos.patch: refresh
    - third_party/skia-vsx-instructions.patch: refresh
    - third_party/use-sysconf-page-size-on-ppc64.patch: refresh
    - workarounds/HACK-third_party-libvpx-use-generic-gnu.patch: refresh

  [ Andres Salomon]
  * d/copyright:
    - blanket.js is gone, no need to remove it any more.
    - delete some khronos images marked executable.
  * d/patches:
    - upstream/memory.patch: drop, merged upstream.
    - upstream/sensor-reading.patch: add, gcc13 build fix from upstream.
    - upstream/lweight.patch: add, gcc13 build fix from upstream.
    - upstream/freetype.patch: add, fix freetype header inclusion FTBFS.
    - upstream/sizet.patch: add, libstdc++ build fix from upstream.
    - disable/unrar.patch: update for minor upstream changes.
    - bookworm/struct-ctor.patch: add various new workarounds for clang-14.
    - bookworm/structured-binding-scope-bug.patch: drop part of the patch.
    - bullseye/constexpr.patch: drop bullseye patch from bookworm.
    - ungoogled/.../disable-web-environment-integrity.patch: sync with
      ungoogled-chromium for upstream changes.
    - bookworm/i386-lock-free.patch: refresh.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Tue, 10 Oct 2023 22:03:00 -0500

chromium (117.0.5938.149-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-5346: Type Confusion in V8. Reported by Amit Kumar.

 -- Andres Salomon <dilinger@debian.org>  Tue, 03 Oct 2023 19:31:26 -0400

chromium (117.0.5938.132-2) unstable; urgency=high

  * d/patches/fixes/v8-compressed-ptrs.patch: fix another armhf FTBFS.

 -- Andres Salomon <dilinger@debian.org>  Sun, 01 Oct 2023 15:46:49 -0400

chromium (117.0.5938.132-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx.
      Reported by Clément Lecigne of Google's Threat Analysis Group.
    - CVE-2023-5186: Use after free in Passwords. Reported by [pwn2car].
    - CVE-2023-5187: Use after free in Extensions. Reported by Thomas Orlita.
  * d/patches:
    - bookworm/i386-lock-free.patch: add to fix i386 build failure.
    - bookworm/freetype-COLRV1.patch: disable using freetype's COLRV1
      (closes: #1053142).

 -- Andres Salomon <dilinger@debian.org>  Thu, 28 Sep 2023 00:41:20 -0400

chromium (117.0.5938.92-1) unstable; urgency=high

  * New upstream stable release.
  * Enable NEON on armhf. See
    <https://lists.debian.org/debian-devel/2023/09/msg00175.html>.
  * Add check in d/rules & chromium wrapper to ensure we don't build or
    run on non-NEON armhf machines.

 -- Andres Salomon <dilinger@debian.org>  Wed, 27 Sep 2023 01:00:07 -0400

chromium (117.0.5938.62-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon]
  * New upstream stable release.
    - CVE-2023-4900: Inappropriate implementation in Custom Tabs.
      Reported by Levit Nudi from Kenya.
    - CVE-2023-4901: Inappropriate implementation in Prompts.
      Reported by Kang Ali.
    - CVE-2023-4902: Inappropriate implementation in Input.
      Reported by Axel Chong.
    - CVE-2023-4903: Inappropriate implementation in Custom Mobile Tabs.
      Reported by Ahmed ElMasry.
    - CVE-2023-4904: Insufficient policy enforcement in Downloads.
      Reported by Tudor Enache @tudorhacks.
    - CVE-2023-4905: Inappropriate implementation in Prompts.
      Reported by Hafiizh.
    - CVE-2023-4906: Insufficient policy enforcement in Autofill.
      Reported by Ahmed ElMasry.
    - CVE-2023-4907: Inappropriate implementation in Intents.
      Reported by Mohit Raj (shadow2639) .
    - CVE-2023-4908: Inappropriate implementation in Picture in Picture.
      Reported by Axel Chong.
    - CVE-2023-4909: Inappropriate implementation in Interstitials.
      Reported by Axel Chong.
  * d/copyright: drop rust, llvm, siso, & cargo binaries.
  * d/patches:
    - fixes/size.patch: drop, merged upstream.
    - fixes/variant.patch: drop, merged upstream.
    - fixes/vector.patch: drop, merged upstream.
    - upstream/contains.patch: drop, merged upstream.
    - upstream/hvec.patch: drop, merged upstream.
    - upstream/limits.patch: drop, merged upstream.
    - upstream/statelessV4L2.patch: drop, merged upstream.
    - fixes/widevine-locations.patch: refresh for minor upstream changes.
    - disable/android.patch: drop half the patch.
    - disable/catapult.patch: refresh for minor upstream changes.
    - disable/tests.patch: refresh for minor upstream changes.
    - disable/unrar.patch: refresh for minor upstream changes.
    - fixes/material-utils.patch: build fix for clang w/ libstdc++.
    - rename fixes/null.patch to fixes/perfetto.patch.
    - upstream/memory.patch: build fix for missing header.
    - bookworm/struct-ctor.patch: add a bunch more build workarounds for
      clang-14.
    - bookworm/stringpiece3.patch: another clang-14 StringPiece to
      std::string explicit conversion.
    - bookworm/typename.patch: add more explicit typename declarations for
      clang-14.
    - bookworm/structured-binding-scope-bug.patch: add more clang-14 binding
      scope workarounds.
    - bookworm/initialize-const-ctor.patch: clang-14 workaround to init a
      const member inside a struct.
    - ppc64le/libaom/0001-Add-ppc64-target-to-libaom.patch: refresh.
    - disable/privacy-sandbox.patch: ensure Privacy Sandbox "features" are
      off by default.
    - bookworm/generate-ninja.patch: fix build failure w/ bookworm's older gn.
  * Switch to using bundled brotli, as the version in debian is too old.
    And so we can drop d/patches/bookworm/brotli.patch, too.

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - 0001-Implement-support-for-PPC64-on-Linux.patch: refresh for upstream
       changes
    - 0001-Add-PPC64-support-for-boringssl.patch: refresh for upstream changes
    - 0002-third-party-boringssl-add-generated-files.patch: refresh for
       upstream changes
    - 0002-third_party-libvpx-Remove-bad-ppc64-config.patch: refresh for
       upstream changes
    - 0004-third_party-crashpad-port-curl-transport-ppc64.patch: refresh for
       upstream changes
    - skia-vsx-instructions.patch: refresh for upstream changes
    - 0003-third_party-ffmpeg-Add-ppc64-generated-config.patch: regenerate
    - 0001-third_party-boringssl-Properly-detect-ppc64le-in-BUI.patch: drop
  * d/patches/ungoogled:
    - core/ungoogled-chromium/disable-web-environment-integrity.patch: disable
      "Web Environment Integrity" trial and remove from build (closes: #1042111)

 -- Andres Salomon <dilinger@debian.org>  Wed, 13 Sep 2023 22:26:10 -0400

chromium (116.0.5845.180-1~deb12u1) bookworm-security; urgency=high

  [ Andres Salomon]
  * New upstream security release.
    - CVE-2023-4761: Out of bounds memory access in FedCM. Reported by DarkNavy.
    - CVE-2023-4762: Type Confusion in V8. Reported by Rong Jian of VRI.
    - CVE-2023-4763: Use after free in Networks. Reported by anonymous.
    - CVE-2023-4764: Incorrect security UI in BFCache.
      Reported by Irvan Kurniawan (sourc7).

  [ Timothy Pearson ]
  * d/patches/ppc64le:
    - 0001-Add-PPC64-support-for-boringssl.patch: Fix incorrect function call
      parameter types in gmult_func() and ghash_func() implementations

 -- Andres Salomon <dilinger@debian.org>  Tue, 05 Sep 2023 19:10:10 -0400

chromium (116.0.5845.140-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-4572: Use after free in MediaStream.
      Reported by fwnfwn(@_fwnfwn).
  * Drop d/chromium.conffiles; it's been a year (and major debian release)
    since started deleting /etc/chromium/policies/recommended/duckduckgo.json
    (closes: #1024981).

 -- Andres Salomon <dilinger@debian.org>  Wed, 30 Aug 2023 04:14:41 -0400

chromium (116.0.5845.110-1~deb12u1) bookworm-security; urgency=high

  [ Timothy Pearson ]
  * New upstream security release.
    - CVE-2023-4430: Use after free in Vulkan.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-4429: Use after free in Loader. Reported by Anonymous.
    - CVE-2023-4428: Out of bounds memory access in CSS.
      Reported by Francisco Alonso (@revskills).
    - CVE-2023-4427: Out of bounds memory access in V8.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-4431: Out of bounds memory access in Fonts.
      Reported by Microsoft Security Researcher.

  [ Andres Salomon ]
  * d/patches/upstream hvec.patch: add arm* v4l2 build fix.
  * d/rules: FTBFS if we're uploading to -security distribution w/out CVEs.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Wed, 23 Aug 2023 08:58:00 -0500

chromium (116.0.5845.96-2) unstable; urgency=high

  * d/patches/upstream/limits.patch: Add a build fix for arm64.

 -- Andres Salomon <dilinger@debian.org>  Wed, 16 Aug 2023 04:48:02 -0400

chromium (116.0.5845.96-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2023-2312: Use after free in Offline. Reported by avaue at S.S.L..
    - CVE-2023-4349: Use after free in Device Trust Connectors.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2023-4350: Inappropriate implementation in Fullscreen.
      Reported by Khiem Tran (@duckhiem).
    - CVE-2023-4351: Use after free in Network.
      Reported by Guang and Weipeng Jiang of VRI.
    - CVE-2023-4352: Type Confusion in V8.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-4353: Heap buffer overflow in ANGLE.
      Reported by Christoph Diehl / Microsoft Vulnerability Research.
    - CVE-2023-4354: Heap buffer overflow in Skia.
      Reported by Mark Brand of Google Project Zero.
    - CVE-2023-4355: Out of bounds memory access in V8.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-4356: Use after free in Audio.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2023-4357: Insufficient validation of untrusted input in XML.
      Reported by Igor Sak-Sakovskii.
    - CVE-2023-4358: Use after free in DNS.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2023-4359: Inappropriate implementation in App Launcher.
      Reported by @retsew0x01.
    - CVE-2023-4360: Inappropriate implementation in Color.
      Reported by Axel Chong.
    - CVE-2023-4361: Inappropriate implementation in Autofill.
      Reported by Thomas Orlita.
    - CVE-2023-4362: Heap buffer overflow in Mojom IDL.
      Reported by Zhao Hai of NanJing Cyberpeace TianYu Lab.
    - CVE-2023-4363: Inappropriate implementation in WebShare.
      Reported by Alesandro Ortiz.
    - CVE-2023-4364: Inappropriate implementation in Permission Prompts.
      Reported by Jasper Rebane.
    - CVE-2023-4365: Inappropriate implementation in Fullscreen.
      Reported by Hafiizh.
    - CVE-2023-4366: Use after free in Extensions. Reported by asnine.
    - CVE-2023-4367: Insufficient policy enforcement in Extensions API.
      Reported by Axel Chong.
    - CVE-2023-4368: Insufficient policy enforcement in Extensions API.
      Reported by Axel Chong.
  * d/patches:
   - fixes/cmath.patch: drop, merged upstream.
   - fixes/vector.patch: drop, merged upstream.
   - fixes/cookieresult.patch: drop, merged upstream.
   - upstream/feature-list-static.patch: drop, merged upstream.
   - disable/catapult.patch: refresh.
   - upstream/statelessV4L2.patch: refresh.
   - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh.
   - ppc64le/libaom/0001-Add-ppc64-target-to-libaom.patch: refresh.
   - ppc64le/breakpad/0001-Implement-support-for-ppc64-on-Linux.patch: refresh.
   - ppc64le/third_party/use-sysconf-page-size-on-ppc64.patch: refresh.
   - fixes/rust-clanglib.patch: add patch to handle new clang deps for rust.
   - debianization/clang-15.patch: add patch to use lld-15.
   - bookworm/typename.patch: more typename fixes needed.
   - fixes/variant.patch: add a missing header that libstdc++ needs.
   - fixes/vector.patch: add a missing header that libstdc++ needs.
   - fixes/null.patch: fix missing namespace for nullptr_t + header fix.
   - fixes/size.patch: missing header fix.
   - bookworm/brotli.patch: revert upstream change that requires newer brotli.
   - bookworm/struct-ctor.patch: add a bunch of explicit struct constructors
     to make clang-15 happy.
   - fixes/size.patch
   - bullseye/stringpiece.patch: drop, since we're bundling re2 now.
  * d/rules: automatically detect rust/clang versions & add needed rust args.
    But also disable rust for now.
  * d/rules: drop use_gnome_keyring=false, upstream has completely removed
    libgnome-keyring support in favor of gnome's libsecret.
  * Use bundled re2 (for now) instead of libre2-dev due to random crashes
    we're seeing. Adjust build-deps, Files-Excluded, d/clean,
    and d/scripts/unbundle accordingly.

  [ Timothy Pearson ]
   * d/patches/ppc64le:
     - database/0001-Properly-detect-little-endian-PPC64-systems.patch: refresh
       for upstream changes
     - third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
       refresh for upstream changes
     - third_party/0002-third-party-boringssl-add-generated-files.patch:
       refresh, no changes
     - third_party/use-sysconf-page-size-on-ppc64.patch: refresh for upstream
       changes
     - third_party/skia-vsx-instructions.patch: refresh for upstream changes

 -- Andres Salomon <dilinger@debian.org>  Tue, 15 Aug 2023 17:46:56 -0400

chromium (115.0.5790.170-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-4068: Type Confusion in V8. Reported by Jerry.
    - CVE-2023-4069: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2023-4070: Type Confusion in V8. Reported by Jerry.
    - CVE-2023-4071: Heap buffer overflow in Visuals.
      Reported by Guang and Weipeng Jiang of VRI.
    - CVE-2023-4072: Out of bounds read and write in WebGL.
      Reported by Apple Security Engineering and Architecture (SEAR).
    - CVE-2023-4073: Out of bounds memory access in ANGLE.
      Reported by Jaehun Jeong(@n3sk) of Theori.
    - CVE-2023-4074: Use after free in Blink Task Scheduling.
      Reported by Anonymous.
    - CVE-2023-4075: Use after free in Cast.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-4076: Use after free in WebRTC.
      Reported by Natalie Silvanovich of Google Project Zero.
    - CVE-2023-4077: Insufficient data validation in Extensions.
      Reported by Anonymous.
    - CVE-2023-4078: Inappropriate implementation in Extensions.
      Reported by Anonymous.
  * debian/patches/disable/driver-chrome-path.patch: refresh for minor changes.

 -- Andres Salomon <dilinger@debian.org>  Wed, 02 Aug 2023 19:26:52 -0400

chromium (115.0.5790.102-2) unstable; urgency=high

  * debian/patches/upstream/contains.patch:Yet Another v4l2 ARM build fix.

 -- Andres Salomon <dilinger@debian.org>  Tue, 25 Jul 2023 18:25:50 -0400

chromium (115.0.5790.102-1) unstable; urgency=high

  * New upstream stable release.
  * debian/patches/upstream/statelessV4L2.patch: add v4l2 build fix.

 -- Andres Salomon <dilinger@debian.org>  Fri, 21 Jul 2023 02:36:46 -0400

chromium (115.0.5790.98-2) unstable; urgency=high

  * Add build fix for gcc13 on arm64.

 -- Andres Salomon <dilinger@debian.org>  Wed, 19 Jul 2023 22:23:08 -0400

chromium (115.0.5790.98-1~deb12u1) bookworm-security; urgency=high

  * New upstream release
    - CVE-2023-3727: Use after free in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-3728: Use after free in WebRTC.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2023-3730: Use after free in Tab Groups. Reported by @ginggilBesel.
    - CVE-2023-3732: Out of bounds memory access in Mojo.
      Reported by Mark Brand of Google Project Zero.
    - CVE-2023-3733: Inappropriate implementation in WebApp Installs.
      Reported by Ahmed ElMasry.
    - CVE-2023-3734: Inappropriate implementation in Picture In Picture.
      Reported by Thomas Orlita.
    - CVE-2023-3735: Inappropriate implementation in Web API Permission Prompts.
      Reported by Ahmed ElMasry.
    - CVE-2023-3736: Inappropriate implementation in Custom Tabs.
      Reported by Philipp Beer (TU Wien).
    - CVE-2023-3737: Inappropriate implementation in Notifications.
      Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) .
    - CVE-2023-3738: Inappropriate implementation in Autofill.
      Reported by Hafiizh.
    - CVE-2023-3740: Insufficient validation of untrusted input in Themes.
      Reported by Fardeen Siddiqui.

  * d/rules:
    - use system rustc installation
  * Add build-dep on rustc.
  * d/patches:
    - debianization/master-preferences.patch: upstream variable renamed
    - disable/catapult.patch: upstream changes required reworking
    - disable/tests.patch: remove new upstream puffin test data file
      dependencies
    - disable/unrar.patch: upstream changes required reworking
    - fixes/cmath.patch: add missing header include for skia
    - fixes/vector.patch: add missing header include for net
    - upstream/sizet.patch: drop, merged upstream
    - ppc64le/fixes/fix-partition-alloc-compile.patch: refresh for upstream
      changes
    - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh
      for upstream changes
    - ppc64le/third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch:
      refresh for upstream changes
    - ppc64le/third_party/0003-third_party-libvpx-Add-ppc64-generated-config.patch:
      regenerate configs from upstream source
    - ppc64le/third_party/skia-vsx-instructions.patch: refresh for upstream
      changes

  [ Andres Salomon ]
    - fixes/clang-and-gcc11.patch: drop, (a different version) merged upstream.
    - bookworm/typename.patch: drop parts that were merged upstream, and add
      new build fixes.
    - bookworm/structured-binding-scope-bug.patch: drop some of it, add new bits
    - bullseye/constexpr.patch: refresh for string -> StringPiece change.
    - bullseye/stringpiece.patch: add to work around older libre2.
    - bullseye/default-equality-op.patch: add more workarounds for older
      compilers
    - fixes/brandversion-construct.patch: add to fix build failure.
    - fixes/SkColor4f-init.patch: another missing struct constructor fix.
    - fixes/cookieresult.patch: another struct ctor build fix.
    - ppc64le/third_party/0001-Add-PPC64-support-for-boringssl.patch: refresh.
    - ppc64le/libaom/0001-Add-ppc64-target-to-libaom.patch: refresh.
    - ppc64le/third_party/0002-third-party-boringssl-add-generated-files.patch:
      refresh.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Tue, 18 Jul 2023 17:50:00 -0500

chromium (114.0.5735.198-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-3420: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2023-3421: Use after free in Media.
      Reported by Piotr Bania of Cisco Talos.
    - CVE-2023-3422: Use after free in Guest View. Reported by asnine.

 -- Andres Salomon <dilinger@debian.org>  Tue, 27 Jun 2023 02:21:12 -0400

chromium (114.0.5735.133-1~deb12u1) bookworm-security; urgency=high

  * New upstream security release.
    - CVE-2023-3214: Use after free in Autofill payments.
      Reported by Rong Jian of VRI.
    - CVE-2023-3215: Use after free in WebRTC. Reported by asnine.
    - CVE-2023-3216: Type Confusion in V8.
      Reported by 5n1p3r0010 from Topsec ChiXiao Lab.
    - CVE-2023-3217: Use after free in WebXR.
      Reported by Sergei Glazunov of Google Project Zero.

 -- Andres Salomon <dilinger@debian.org>  Tue, 13 Jun 2023 13:31:55 -0400

chromium (114.0.5735.106-1~deb12u1) bookworm-security; urgency=high

  * New upstream stable release.
    - CVE-2023-3079: Type Confusion in V8.
      Reported by Clément Lecigne of Google's Threat Analysis Group.
  * d/patches:
    - ppc64le/third_party/skia-vsx-instructions.patch: rewrite for POWER8
      compatibility, fix graphics corruption, and enable in builds

 -- Timothy Pearson <tpearson@raptorengineering.com>  Mon, 05 Jun 2023 21:38:00 -0500

chromium (114.0.5735.90-2~deb12u1) bookworm-security; urgency=high

  * d/patches:
    - Add upstream/feature-list-static.patch
      This patch fixes an out of scope array access that can lead to crashes at startup

 -- Timothy Pearson <tpearson@raptorengineering.com>  Wed, 31 May 2023 12:36:00 -0500

chromium (114.0.5735.90-1) unstable; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2023-2929: Out of bounds write in Swiftshader.
      Reported by Jaehun Jeong(@n3sk) of Theori.
    - CVE-2023-2930: Use after free in Extensions. Reported by asnine.
    - CVE-2023-2931: Use after free in PDF.
      Reported by Huyna at Viettel Cyber Security.
    - CVE-2023-2932: Use after free in PDF.
      Reported by Huyna at Viettel Cyber Security.
    - CVE-2023-2933: Use after free in PDF. Reported by
      Quang Nguyễn (@quangnh89) of Viettel Cyber Security and Nguyen Phuong.
    - CVE-2023-2934: Out of bounds memory access in Mojo.
      Reported by Mark Brand of Google Project Zero.
    - CVE-2023-2935: Type Confusion in V8.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-2936: Type Confusion in V8.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-2937: Inappropriate implementation in Picture In Picture.
      Reported by NDevTK.
    - CVE-2023-2938: Inappropriate implementation in Picture In Picture.
      Reported by Alesandro Ortiz.
    - CVE-2023-2939: Insufficient data validation in Installer.
      Reported by ycdxsb from VARAS@IIE.
    - CVE-2023-2940: Inappropriate implementation in Downloads.
      Reported by Axel Chong.
    - CVE-2023-2941: Inappropriate implementation in Extensions API.
      Reported by Jasper Rebane.
  * d/copyright: properly delete some android & chromeos stuff.
  * d/patches:
    - fixes/clang-and-gcc11.patch: refresh.
    - upstream/webview-cstr.patch: drop, merged upstream.
    - upstream/monostate.patch: drop, merged upstream.
    - disable/unrar.patch: additional upstream changes required more reworking.
    - disable/android.patch: refresh, & add one more build fix.
    - disable/catapult.patch: refresh.
    - disable/swiftshader.patch: refresh.
    - disable/angle-perftest.patch: refresh.
    - system/jpeg.patch: refresh.
    - upstream/mojo.patch: regenerate from git.
    - upstream/sizet.patch: add an upstream build fix.
    - bookworm/typename.patch: include more build fixes.
    - bookworm/lambda-bug.patch -> bookworm/structured-binding-scope-bug.patch,
      and add another place it's happening (turns out it's not just lambdas).
  * Add build-dep on libevdev-dev - now required by upstream.

  [ Timothy Pearson ]
   * d/patches:
     - Refresh ppc64le patches

 -- Andres Salomon <dilinger@debian.org>  Wed, 31 May 2023 03:06:35 -0400

chromium (113.0.5672.126-1) unstable; urgency=low

  * New upstream security release.
    - CVE-2023-2721: Use after free in Navigation.
      Reported by Guang Gong of Alpha Lab, Qihoo 360.
    - CVE-2023-2722: Use after free in Autofill UI.
      Reported by Rong Jian of VRI.
    - CVE-2023-2723: Use after free in DevTools. Reported by asnine.
    - CVE-2023-2724: Type Confusion in V8.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-2725: Use after free in Guest View. Reported by asnine.
    - CVE-2023-2726: Inappropriate implementation in WebApp Installs.
      Reported by Ahmed ElMasry.

 -- Andres Salomon <dilinger@debian.org>  Tue, 16 May 2023 16:25:03 -0400

chromium (113.0.5672.63-2) unstable; urgency=low

  * d/patches:
    - Set baseline ppc64 CPU back to POWER ISA 2.07 (POWER8)

 -- Timothy Pearson <tpearson@raptorengineering.com>  Wed, 03 May 2023 10:47:00 -0500

chromium (113.0.5672.63-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2023-2459: Inappropriate implementation in Prompts.
      Reported by Rong Jian of VRI.
    - CVE-2023-2460: Insufficient validation of untrusted input in Extensions.
      Reported by Martin Bajanik, Fingerprint[.]com.
    - CVE-2023-2461: Use after free in OS Inputs. Reported by @ginggilBesel.
    - CVE-2023-2462: Inappropriate implementation in Prompts.
      Reported by Alesandro Ortiz.
    - CVE-2023-2463: Inappropriate implementation in Full Screen Mode.
      Reported by Irvan Kurniawan (sourc7).
    - CVE-2023-2464: Inappropriate implementation in PictureInPicture.
      Reported by Thomas Orlita.
    - CVE-2023-2465: Inappropriate implementation in CORS.
      Reported by @kunte_ctf.
    - CVE-2023-2466: Inappropriate implementation in Prompts.
      Reported by Jasper Rebane (popstonia).
    - CVE-2023-2467: Inappropriate implementation in Prompts.
      Reported by Thomas Orlita.
    - CVE-2023-2468: Inappropriate implementation in PictureInPicture.
      Reported by Alesandro Ortiz.

  [ Andres Salomon]
   * Remove Michel from Uploaders.
   * Build against libopenh264-dev (closes: #1031352).
   * d/copyright:
     - drop fuchsia*: entirely different OS.
     - drop chrome/build: 200MB of PGO optimizations for official chrome builds.
     - drop third_party/updater: upstream included update binary.
     - re-add part of chrome/browser/resources/chromeos/ and chrome/android/ to
       fix build errors.
   * d/patches:
     - debianization/master-preferences.patch: check for initial_preferences or
       master_preferences, rather than just for the latter (closes: #992178).
     - disable/unrar.patch: complete rewrite for upstream's nested archive changes.
     - disable/catapult.patch: refresh.
     - upstream/webview-cstr.patch: add simple build fix from upstream.
     - upstream/monostate.patch: add simple build fix from upstream.
     - bookworm/clang-attribs.patch: build fix for clang-14 to keep from
       generating hundreds of warnings per compilation unit.
     - bookworm/typename.patch: add another build fix for missing typename.
     - bookworm/lamba-bug.patch: add to work around compiler bug (clang < 16).
     - bullseye/constexpr.patch: work around build failure w/ bullseye's
       clang/libstdc++.
     - disable/openh264.patch -> bullseye/openh264.patch, and stop using it
       for sid & bookworm.

  [ Timothy Pearson ]
   * d/patches:
     - Set baseline ppc64 CPU to POWER ISA 3.0 (OpenPOWER, POWER9)
     - Enable VSX acceleration in Skia
     - Refresh ppc64le/third_party/0002-third_party-libvpx-Remove-bad-ppc64-config.patch
     - Add fixes for new Highway library on ppc64
     - Suppress harmless warning messages from compiler during ppc64 builds

 -- Timothy Pearson <tpearson@raptorengineering.com>  Wed, 03 May 2023 00:42:00 -0500

chromium (112.0.5615.138-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2023-2133: Out of bounds memory access in Service Worker API.
      Reported by Rong Jian of VRI.
    - CVE-2023-2134: Out of bounds memory access in Service Worker API.
      Reported by Rong Jian of VRI.
    - CVE-2023-2135: Use after free in DevTools.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-2136: Integer overflow in Skia.
      Reported by Clément Lecigne of Google's Threat Analysis Group.
    - CVE-2023-2137: Heap buffer overflow in sqlite.
      Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute
  * d/patches:
    - upstream/protobuf.patch: drop, merged upstream.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Tue, 18 Apr 2023 22:00:00 -0500

chromium (112.0.5615.121-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2023-2033: Type Confusion in V8.
      Reported by Clément Lecigne of Google's Threat Analysis Group.
  * Build-dep on rollup.
  * Delete the bundled acorn & rollup node modules, and build using the
    debian packaged version of those and other modules.
  * (Re-)enable optimize_webui.
  * Add d/patches/upstream/protobuf.patch to fix FTBFS due to race.

 -- Andres Salomon <dilinger@debian.org>  Sat, 15 Apr 2023 00:24:54 -0400

chromium (112.0.5615.49-2) unstable; urgency=high

  [ Andres Salomon ]
  * Add d/patches/i386/angle-lockfree.patch to fix FTBFS on i386. Also create
    & populate that d/patches/i386/ directory, since we now have multiple
    i386 patches.
  * Remove enable_js_type_check=false build arg; upstream dropped it.

  [ Timothy Pearson ]
   * d/patches:   
    - Re-add boringssl support for ppc64le (dropped by Google upstream)
    - Add ppc64le detection to partition allocator build
    - Regenerate 0003-third_party-ffmpeg-Add-ppc64-generated-config.patch

 -- Andres Salomon <dilinger@debian.org>  Fri, 07 Apr 2023 03:40:50 -0400

chromium (112.0.5615.49-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2023-1810: Heap buffer overflow in Visuals.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2023-1811: Use after free in Frames. Reported by Thomas Orlita.
    - CVE-2023-1812: Out of bounds memory access in DOM Bindings.
      Reported by Shijiang Yu.
    - CVE-2023-1813: Inappropriate implementation in Extensions.
      Reported by Axel Chong.
    - CVE-2023-1814: Insufficient validation of untrusted input in
      Safe Browsing. Reported by Young Min Kim (@ylemkimon),
      CompSec Lab at Seoul National University.
    - CVE-2023-1815: Use after free in Networking APIs. Reported by DDV_UA.
    - CVE-2023-1816: Incorrect security UI in Picture In Picture.
      Reported by NDevTK.
    - CVE-2023-1817: Insufficient policy enforcement in Intents.
      Reported by Axel Chong.
    - CVE-2023-1818: Use after free in Vulkan. Reported by Abdulrahman
      Alqabandi, Microsoft Browser Vulnerability Research, Eric Lawrence,
      Microsoft, Patrick Walker (@HomeSen), & Kirtikumar Anandrao Ramchandani.
    - CVE-2023-1819: Out of bounds read in Accessibility.
      Reported by Microsoft Edge Team.
    - CVE-2023-1820: Heap buffer overflow in Browser History.
      Reported by raven at KunLun lab.
    - CVE-2023-1821: Inappropriate implementation in WebShare.
      Reported by Axel Chong.
    - CVE-2023-1822: Incorrect security UI in Navigation. Reported by 강우진.
    - CVE-2023-1823: Inappropriate implementation in FedCM.
      Reported by Jasper Rebane (popstonia).
  * d/copyright: change location for deleted image_diff directory.
  * d/patches:
    - disable/unrar.patch: update for stuff dropped upstream.
    - disable/swiftshader.patch: straight refresh.
    - bullseye/clang13.patch: straight refresh.
    - ppc64le/third_party/0001-third_party-angle-Include-missing-header-cstddef-in-.patch:
      straight refresh.
    - ppc64le/third_party/use-sysconf-page-size-on-ppc64.patch: straight
      refresh.
    - debian/patches/ppc64le/third_party/0003-third_party-ffmpeg-Add-ppc64-generated-config.patch:
      change is_mac to is_apple.

 -- Andres Salomon <dilinger@debian.org>  Tue, 04 Apr 2023 18:44:47 -0400

chromium (111.0.5563.110-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2023-1528: Use after free in Passwords.
      Reported by Wan Choi of Seoul National University.
    - CVE-2023-1529: Out of bounds memory access in WebHID.
    - CVE-2023-1530: Use after free in PDF.
      Reported by The UK's National Cyber Security Centre (NCSC).
    - CVE-2023-1531: Use after free in ANGLE.
      Reported by Piotr Bania of Cisco Talos.
    - CVE-2023-1532: Out of bounds read in GPU Video.
      Reported by Mark Brand of Google Project Zero.
    - CVE-2023-1533: Use after free in WebProtect.
      Reported by Weipeng Jiang (@Krace) of VRI.
    - CVE-2023-1534: Out of bounds read in ANGLE.
      Reported by Jann Horn and Mark Brand of Google Project Zero.
  * Document how to properly enable Wayland support in README.Debian
    (closes: #1033223).
  * d/rules patch from "Daniel Richard G." <skunk@iSKUNK.ORG>:
    - Disable lto flags (closes: #1015367).
    - don't clobber LDFLAGS from dpkg-buildflags (closes: #1033015).

 -- Andres Salomon <dilinger@debian.org>  Wed, 22 Mar 2023 03:17:36 -0400

chromium (111.0.5563.64-1) unstable; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2023-1213: Use after free in Swiftshader.
      Reported by Jaehun Jeong(@n3sk) of Theori.
    - CVE-2023-1214: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab.
    - CVE-2023-1215: Type Confusion in CSS. Reported by Anonymous.
    - CVE-2023-1216: Use after free in DevTools.
      Reported by Ganjiang Zhou(@refrain_areu) of ChaMd5-H1 team.
    - CVE-2023-1217: Stack buffer overflow in Crash reporting.
      Reported by sunburst of Ant Group Tianqiong Security Lab.
    - CVE-2023-1218: Use after free in WebRTC. Reported by Anonymous.
    - CVE-2023-1219: Heap buffer overflow in Metrics.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-1220: Heap buffer overflow in UMA.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2023-1221: Insufficient policy enforcement in Extensions API.
      Reported by Ahmed ElMasry.
    - CVE-2023-1222: Heap buffer overflow in Web Audio API.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-1223: Insufficient policy enforcement in Autofill.
      Reported by Ahmed ElMasry.
    - CVE-2023-1224: Insufficient policy enforcement in Web Payments API.
      Reported by Thomas Orlita.
    - CVE-2023-1225: Insufficient policy enforcement in Navigation.
      Reported by Roberto Ffrench-Davis @Lihaft.
    - CVE-2023-1226: Insufficient policy enforcement in Web Payments API.
      Reported by Anonymous.
    - CVE-2023-1227: Use after free in Core. Reported by @ginggilBesel.
    - CVE-2023-1228: Insufficient policy enforcement in Intents.
      Reported by Axel Chong.
    - CVE-2023-1229: Inappropriate implementation in Permission prompts.
      Reported by Thomas Orlita.
    - CVE-2023-1230: Inappropriate implementation in WebApp Installs.
      Reported by Axel Chong.
    - CVE-2023-1231: Inappropriate implementation in Autofill.
      Reported by Yan Zhu, Brave.
    - CVE-2023-1232: Insufficient policy enforcement in Resource Timing.
      Reported by Sohom Datta.
    - CVE-2023-1233: Insufficient policy enforcement in Resource Timing.
      Reported by Soroush Karami.
    - CVE-2023-1234: Inappropriate implementation in Intents.
      Reported by Axel Chong.
    - CVE-2023-1235: Type Confusion in DevTools.
      Reported by raven at KunLun lab.
    - CVE-2023-1236: Inappropriate implementation in Internals.
      Reported by Alesandro Ortiz.
  * Document upcoming security support in README.Debian.security.
  * Document switching the default search engine in README.debian.
  * d/patches:
    - upstream/clamp.patch: drop, merged upstream.
    - upstream/pwman-const.patch: drop, merged upstream.
    - upstream/move-stack-to-isolate.patch: drop, merged upstream.
    - upstream/blink-dbl-float.patch: drop, merged upstream.
    - upstream/v4l2-fix.patch: drop, merged upstream.
    - disable/catapult.patch: refresh & remove unnecessary android bits.
    - disable/google-api-warning.patch: refresh.

  [ Timothy Pearson ]
   * d/patches:
    - ppc64le/third_party/0005-third_party-dav1d-crash-fix.patch: drop,
          merged upstream
    - ppc64le/workarounds/HACK-debian-clang-disable-skia-musttail.patch:
          skia musttail is back in upstream, disable on ppc64le due to
          contining Clang bugs
    - ppc64le: refresh libaom configuration

 -- Andres Salomon <dilinger@debian.org>  Tue, 07 Mar 2023 18:12:37 -0500

chromium (110.0.5481.177-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2023-0941: Use after free in Prompts. Reported by Anonymous.
    - CVE-2023-0927: Use after free in Web Payments API.
      Reported by Rong Jian of VRI.
    - CVE-2023-0928: Use after free in SwiftShader. Reported by Anonymous.
    - CVE-2023-0929: Use after free in Vulkan.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-0930: Heap buffer overflow in Video.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-0931: Use after free in Video.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-0932: Use after free in WebRTC.
      Reported by Omri Bushari (Talon Cyber Security).
    - CVE-2023-0933: Integer overflow in PDF. Reported by
      Zhiyi Zhang from Codesafe Team of Legendsec at QI-ANXIN Group.

 -- Andres Salomon <dilinger@debian.org>  Wed, 22 Feb 2023 16:11:07 -0500

chromium (110.0.5481.77-2) unstable; urgency=high

  * Fix build failure on arm* platforms with upstream/v4l2-fix.patch.

 -- Andres Salomon <dilinger@debian.org>  Wed, 08 Feb 2023 15:20:57 -0500

chromium (110.0.5481.77-1) unstable; urgency=high

  [ Andres Salomon ]
  * New upstream stable release.
    - CVE-2023-0696: Type Confusion in V8.
      Reported by Haein Lee at KAIST Hacking Lab.
    - CVE-2023-0697: Inappropriate implementation in Full screen mode.
      Reported by Ahmed ElMasry.
    - CVE-2023-0698: Out of bounds read in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-0699: Use after free in GPU.
      Reported by 7o8v and Cassidy Kim(@cassidy6564).
    - CVE-2023-0700: Inappropriate implementation in Download.
      Reported by Axel Chong.
    - CVE-2023-0701: Heap buffer overflow in WebUI.
      Reported by Sumin Hwang of SSD Labs.
    - CVE-2023-0702: Type Confusion in Data Transfer. Reported by Sri.
    - CVE-2023-0703: Type Confusion in DevTools.
      Reported by raven at KunLun lab.
    - CVE-2023-0704: Insufficient policy enforcement in DevTools.
      Reported by Rhys Elsmore and Zac Sims of the Canva security team.
    - CVE-2023-0705: Integer overflow in Core.
      Reported by SorryMybad (@S0rryMybad) of Kunlun Lab.
  * d/copyright: libpng16 binaries are gone, no longer need to exclude them.
  * d/scripts/unbundle: drop libjxl, which is dropped upstream. Add absl_log*.
  * d/patches:
    - debianization/optimization.patch: drop. This is unnecessary, as
      Debian's optimization flags override Chromium's by default.
    - disable/android.patch: upstream removed android_crazy_linker, so we can
      remove half of this patch.
    - disable/catapult.patch: refresh.
    - disable/google-api-warning.patch: refresh.
    - upstream/mojo.patch: refresh w/ what's in 110.
    - system/openjpeg.patch: completely rework due to upstream changes.
    - upstream/clamp.patch: backport a build fix.
    - upstream/blink-dbl-float.patch: another build fix.
  * Drop unused use_allocator="none" argument. This was used previously
    to switch from the default "partition" allocator. Upstream dropped
    the build flag in chromium v109. So in v109 we switched to the default
    "partition" allocator and I don't think anyone noticed, so let's just
    leave it on. Report issues if you notice any.

  [ Timothy Pearson ]
  * d/patches:
    - Refresh ppc64le patches for v110
    - Add upstream patches to fix build errors when use_custom_libcxx=false
    - Drop stack smashing fix patch for ppc64le due to fix included upstream

 -- Andres Salomon <dilinger@debian.org>  Wed, 08 Feb 2023 00:20:01 -0500

chromium (109.0.5414.119-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2023-0471: Use after free in WebTransport.
      Reported by chichoo Kim(chichoo) and Cassidy Kim(@cassidy6564).
    - CVE-2023-0472: Use after free in WebRTC.
      Reported by Cassidy Kim(@cassidy6564).
    - CVE-2023-0473: Type Confusion in ServiceWorker API.
      Reported by raven at KunLun lab.
    - CVE-2023-0474: Use after free in GuestView. Reported by avaue at S.S.L.
  * Re-enable v4l2 for arm platforms (closes: #1011346).

 -- Andres Salomon <dilinger@debian.org>  Wed, 25 Jan 2023 01:19:49 -0500

chromium (109.0.5414.74-2) unstable; urgency=high

  [ Andres Salomon ]
  * d/patches/bullseye/clang13.patch: don't use -gsimple-template-names in
    clang arguments, as it doesn't work with clang-13.

  [ Timothy Pearson ]
  * Fix crashes in dav1d during video playback on ppc64le
  * d/patches:
    - Apply upstream dav1d ppc64le fix from videolan merge request #1464

 -- Andres Salomon <dilinger@debian.org>  Thu, 12 Jan 2023 18:23:51 -0500

chromium (109.0.5414.74-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2023-0128: Use after free in Overview Mode. Reported by Khalil Zhani.
    - CVE-2023-0129: Heap buffer overflow in Network Service.
      Reported by asnine.
    - CVE-2023-0130: Inappropriate implementation in Fullscreen API.
      Reported by Hafiizh.
    - CVE-2023-0131: Inappropriate implementation in iframe Sandbox.
      Reported by NDevTK.
    - CVE-2023-0132: Inappropriate implementation in Permission prompts.
      Reported by Jasper Rebane (popstonia).
    - CVE-2023-0133: Inappropriate implementation in Permission prompts.
      Reported by Alesandro Ortiz.
    - CVE-2023-0134: Use after free in Cart.
      Reported by Chaoyuan Peng (@ret2happy).
    - CVE-2023-0135: Use after free in Cart.
      Reported by Chaoyuan Peng (@ret2happy).
    - CVE-2023-0136: Inappropriate implementation in Fullscreen API.
      Reported by Axel Chong.
    - CVE-2023-0137: Heap buffer overflow in Platform Apps.
      Reported by avaue and Buff3tts at S.S.L..
    - CVE-2023-0138: Heap buffer overflow in libphonenumber.
      Reported by Michael Dau.
    - CVE-2023-0139: Insufficient validation of untrusted input in Downloads.
      Reported by Axel Chong.
    - CVE-2023-0140: Inappropriate implementation in File System API.
      Reported by harrison.mitchell, cybercx.com.au.
    - CVE-2023-0141: Insufficient policy enforcement in CORS.
      Reported by scarlet.
  * d/patches:
    - upstream/re-fix-tflite.patch: drop, merged upstream.
    - disable/catapult.patch: refresh
    - disable/angle-perftests.patch: refresh

  [ Timothy Pearson ]
  *  d/patches:
    - Regenerate ppc64le configuration files from source
    - Fix register corruption in v8 on ppc64 systems

 -- Andres Salomon <dilinger@debian.org>  Thu, 12 Jan 2023 13:01:02 -0500

chromium (108.0.5359.124-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-4436: Use after free in Blink Media.
      Reported by Anonymous on 2022-11-15
    - CVE-2022-4437: Use after free in Mojo IPC.
      Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability
      Research Institute on 2022-11-30
    - CVE-2022-4438: Use after free in Blink Frames.
      Reported by Anonymous on 2022-11-07
    - CVE-2022-4439: Use after free in Aura.
      Reported by Anonymous on 2022-11-22
    - CVE-2022-4440: Use after free in Profiles.
      Reported by Anonymous on 2022-11-09

  [ Andres Salomon ]
  * Drop fixes/disable-cxx20.patch; turned out to be a clang-14 bug
    (https://bugs.debian.org/1025394) causing the issue that is now fixed.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Tue, 13 Dec 2022 19:10:00 -0600

chromium (108.0.5359.94-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-4262: Type Confusion in V8.
      Reported by Clement Lecigne of Google's Threat Analysis Group.
  * Drop bullseye/mulodic.patch from unstable, it's too difficult to get this
    right between the two distributions. It'll live in the bullseye branch only.

 -- Andres Salomon <dilinger@debian.org>  Sat, 03 Dec 2022 13:29:49 -0500

chromium (108.0.5359.71-2) unstable; urgency=high

  * Fix bullseye/mulodic.patch to actually work right on 32-bit platforms.
    Again.

  [ Timothy Pearson ]
  * Regenerate libaom configuration for ppc64el

 -- Andres Salomon <dilinger@debian.org>  Fri, 02 Dec 2022 15:03:21 -0500

chromium (108.0.5359.71-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-4174: Type Confusion in V8.
      Reported by Zhenghang Xiao (@Kipreyyy).
    - CVE-2022-4175: Use after free in Camera Capture.
      Reported by Leecraso and Guang Gong of 360 Alpha Lab.
    - CVE-2022-4176: Out of bounds write in Lacros Graphics.
      Reported by @ginggilBesel.
    - CVE-2022-4177: Use after free in Extensions.
      Reported by Chaoyuan Peng (@ret2happy).
    - CVE-2022-4178: Use after free in Mojo.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-4179: Use after free in Audio.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-4180: Use after free in Mojo. Reported by Anonymous.
    - CVE-2022-4181: Use after free in Forms. Reported by Aviv A.
    - CVE-2022-4182: Inappropriate implementation in Fenced Frames.
      Reported by Peter Nemeth.
    - CVE-2022-4183: Insufficient policy enforcement in Popup Blocker.
      Reported by David Sievers.
    - CVE-2022-4184: Insufficient policy enforcement in Autofill.
      Reported by Ahmed ElMasry.
    - CVE-2022-4185: Inappropriate implementation in Navigation.
      Reported by James Lee (@Windowsrcer).
    - CVE-2022-4186: Insufficient validation of untrusted input in Downloads.
      Reported by Luan Herrera (@lbherrera_).
    - CVE-2022-4187: Insufficient policy enforcement in DevTools.
      Reported by Axel Chong.
    - CVE-2022-4188: Insufficient validation of untrusted input in CORS.
      Reported by Philipp Beer (TU Wien).
    - CVE-2022-4189: Insufficient policy enforcement in DevTools.
      Reported by NDevTK.
    - CVE-2022-4190: Insufficient data validation in Directory.
      Reported by Axel Chong.
    - CVE-2022-4191: Use after free in Sign-In.
      Reported by Jaehun Jeong(@n3sk) of Theori.
    - CVE-2022-4192: Use after free in Live Caption.
      Reported by Samet Bekmezci @sametbekmezci.
    - CVE-2022-4193: Insufficient policy enforcement in File System API.
      Reported by Axel Chong.
    - CVE-2022-4194: Use after free in Accessibility. Reported by Anonymous.
    - CVE-2022-4195: Insufficient policy enforcement in Safe Browsing.
      Reported by Eric Lawrence of Microsoft.
  * d/copyright:
    - drop multiple ninja executables from upstream tarball.
    - Stop deleting chrome/test/data/*, since it's all just empty directories
      except for one BUILD.gn that is required to build.
  * d/scripts/unbundle: build against the bundled absl_utility.
  * d/patches:
    - upstream/fix-missing-cmath.patch: drop, merged upstream.
    - fixes/angle-wayland.patch: drop, merged upstream.
    - fixes/fix-arm-vfpv3-d16-libaom.patch: drop, merged upstream.
    - disable/unrar.patch: refresh due to 7z support added.
    - ppc64le/workarounds/HACK-third_party-libvpx-use-generic-gnu.patch:
      refresh for loongarch update.
    - ppc64le/third_party/use-sysconf-page-size-on-ppc64.patch: drop half of
      patch as upstream removed duplicate code.
    - fixes/disable-cxx20.patch: switch clang complication back to the c++17
      standard, as c++20 breaks linking.

 -- Andres Salomon <dilinger@debian.org>  Thu, 01 Dec 2022 22:23:10 -0500

chromium (107.0.5304.121-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-4135: Heap buffer overflow in GPU. Reported by Clement Lecigne
      of Google's Threat Analysis Group on 2022-11-22

 -- Timothy Pearson <tpearson@raptorengineering.com>  Sat, 26 Nov 2022 12:34:00 -0600

chromium (107.0.5304.110-2) unstable; urgency=high

  * Fix bullseye/mulodic.patch to actually work right. Sigh.

 -- Andres Salomon <dilinger@debian.org>  Thu, 10 Nov 2022 13:48:01 -0500

chromium (107.0.5304.110-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-3885: Use after free in V8. Reported by gzobqq@.
    - CVE-2022-3886: Use after free in Speech Recognition.
    - CVE-2022-3887: Use after free in Web Workers. Reported by anonymous.
    - CVE-2022-3888: Use after free in WebCodecs. Reported by Peter Nemeth.
    - CVE-2022-3889: Type Confusion in V8. Reported by anonymous.
    - CVE-2022-3890: Heap buffer overflow in Crashpad. Reported by anonymous.
  * Clean up old crash dump files on launch (closes: #1015931).
  * debian/patches:
    - bullseye/mulodic.patch: (hopefully!) fix FTBFS on bullseye under i386
      and armhf.

 -- Andres Salomon <dilinger@debian.org>  Wed, 09 Nov 2022 19:57:34 -0500

chromium (107.0.5304.87-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-3723: Type Confusion in V8. Reported by Jan Vojtěšek, Milánek,
      and Przemek Gmerek of Avast.
  * Revert v4l2 enable for arm platforms until a build error is fixed.

 -- Andres Salomon <dilinger@debian.org>  Fri, 28 Oct 2022 07:02:02 -0400

chromium (107.0.5304.68-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at
      S.S.L Team.
    - CVE-2022-3653: Heap buffer overflow in Vulkan. Reported by SeongHwan Park
      (SeHwa).
    - CVE-2022-3654: Use after free in Layout. Reported by Sergei Glazunov of
      Google Project Zero.
    - CVE-2022-3655: Heap buffer overflow in Media Galleries. Reported by
      koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute.
    - CVE-2022-3656: Insufficient data validation in File System. Reported by
      Ron Masas, Imperva.
    - CVE-2022-3657: Use after free in Extensions. Reported by Omri Bushari,
      Talon Cyber Security.
    - CVE-2022-3658: Use after free in Feedback service on Chrome OS. Reported
      by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research
      Institute.
    - CVE-2022-3659: Use after free in Accessibility. Reported by @ginggilBesel.
    - CVE-2022-3660: Inappropriate implementation in Full screen mode. Reported
      by Irvan Kurniawan (sourc7).
    - CVE-2022-3661: Insufficient data validation in Extensions. Reported by
      Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University.
  * Disable building against QT5 (for now).
    https://groups.google.com/a/chromium.org/g/chromium-packagers/c/-2VGexQAK6w
  * debian/copyright:
    - delete third_party/dawn/tools/golang binaries.
  * debian/patches:
    - upstream/armhf-ftbfs.patch: drop, merged upstream.
    - upstream/fix-nullptr-qual.patch: drop, merged upstream.
    - disable/catapult.patch: delete add'l blink reference to catapult.
    - bullseye/clang13.patch: refresh for minor upstream changes.
    - ppc64le/workarounds/HACK-third_party-libvpx-use-generic-gnu.patch: refresh
    - disable/clang-version-check.patch: added to fix build failure. Needs
      to go upstream.
    - ppc64le/workarounds/HACK-debian-clang-disable-skia-musttail.patch:
      drop, upstream skia stopped using clang::musttail.
    - upstream/re-fix-tflite.patch: re-add a build fix that upstream lost.

  [ Timothy Pearson ]
  * regenerate libaom configuration on ppc64el systems.

 -- Andres Salomon <dilinger@debian.org>  Tue, 25 Oct 2022 17:40:14 -0400

chromium (106.0.5249.119-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-3445: Use after free in Skia. Reported by Nan Wang
      (@eternalsakura13) and Yong Liu of 360 Vulnerability Research Institute on
      2022-09-16
    - CVE-2022-3446: Heap buffer overflow in WebSQL. Reported by Kaijie Xu
      (@kaijieguigui) on 2022-09-26
    - CVE-2022-3447: Inappropriate implementation in Custom Tabs. Reported by
      Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2022-09-22
    - CVE-2022-3448: Use after free in Permissions API. Reported by raven at
      KunLun lab on 2022-09-13
    - CVE-2022-3449: Use after free in Safe Browsing. Reported by asnine on
      2022-09-17
    - CVE-2022-3450: Use after free in Peer Connection. Reported by Anonymous on
      2022-09-30

 -- Timothy Pearson <tpearson@raptorengineering.com>  Tue, 11 Oct 2022 19:42:00 -0500

chromium (106.0.5249.103-2) unstable; urgency=low

  * Reduce baseline compatibility for ppc64el builds from POWER9
    to POWER8.  This matches the current Debian build farm.

 -- Timothy Pearson <tpearson@raptorengineering.com>  Sat, 08 Oct 2022 14:35:00 -0500

chromium (106.0.5249.103-1) unstable; urgency=medium

  * New upstream release.
  * Add ppc64el patches maintained by me, and enable builds for ppc64el
    (closes #1005083).

 -- Timothy Pearson <tpearson@raptorengineering.com>  Fri, 07 Oct 2022 17:54:00 -0500

chromium (106.0.5249.91-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-3370: Use after free in Custom Elements.
      Reported by Aviv A.
    - CVE-2022-3373: Out of bounds write in V8.
      Reported by Tibor Klajnscek.

 -- Andres Salomon <dilinger@debian.org>  Sat, 01 Oct 2022 03:21:58 -0400

chromium (106.0.5249.61-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-3304: Use after free in CSS. Reported by Anonymous.
    - CVE-2022-3201: Insufficient validation of untrusted input in
      Developer Tools. Reported by NDevTK.
    - CVE-2022-3305: Use after free in Survey. Reported by Nan
      Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability
      Research Institute.
    - CVE-2022-3306: Use after free in Survey. Reported by Nan
      Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability
      Research Institute.
    - CVE-2022-3307: Use after free in Media.
      Reported by Anonymous Telecommunications Corp. Ltd.
    - CVE-2022-3308: Insufficient policy enforcement in Developer Tools.
      Reported by Andrea Cappa (zi0Black) @ Shielder.
    - CVE-2022-3309: Use after free in Assistant.
      Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab.
    - CVE-2022-3310: Insufficient policy enforcement in Custom Tabs.
      Reported by Ashwin Agrawal from Optus, Sydney.
    - CVE-2022-3311: Use after free in Import.
      Reported by Samet Bekmezci @sametbekmezci.
    - CVE-2022-3312: Insufficient validation of untrusted input in VPN.
      Reported by Andr.Ess.
    - CVE-2022-3313: Incorrect security UI in Full Screen.
      Reported by Irvan Kurniawan (sourc7).
    - CVE-2022-3314: Use after free in Logging. Reported by Anonymous.
    - CVE-2022-3315: Type confusion in Blink. Reported by Anonymous.
    - CVE-2022-3316: Insufficient validation of untrusted input in Safe
      Browsing. Reported by Sven Dysthe (@svn_dy).
    - CVE-2022-3317: Insufficient validation of untrusted input in
      Intents. Reported by Hafiizh.
    - CVE-2022-3318: Use after free in ChromeOS Notifications.
      Reported by GraVity0.
  * debian/patches:
    - disable/angle-perftests.patch: drop most of patch.
      build_angle_perftests=false is set in d/rules, so no need to patch
      it and its dependencies.
    - upstream/browser-finder.patch: drop, merged upstream.
    - upstream/disk-cache.patch: drop, merged upstream.
    - upstream/masklayer-geom.patch: drop, merged upstream.
    - fixes/tflite.patch: drop, merged upstream.
    - bullseye/clang13.patch: update for upstream switching from one
      unsupported clang warning flag to another.
    - disable/catapult.patch: refresh.
    - disable/installer.patch: drop, as there's no real need to delete
      chrome/install_static; there's no licensing issues and it's only
      actually built on windows.
    - upstream/fix-missing-cmath.patch: added from upstream to fix ftbfs.
    - upstream/fix-nullptr-qual.patch: added from upstream to fix ftbfs.
    - fixes/fix-arm-vfpv3-d16-libaom.patch: add to fix a problem that
      was currently papered over by disabling libaom on arm. This new
      patch (hopefully) allows libaom to be built for the armhf arch.
    - disable/libaom-arm.patch: drop now that we've fixed libaom on arm.
    - system/event.patch: remove some old unused bits that patch gn.
  * Stop deleting chrome/install_static in d/copyright, and also start
    deleting third party libraries that we began linking to in v105 as
    well as tools/gn.
  * Remove mgilbert as an uploader; thanks for all your work on chromium
    packaging!

 -- Andres Salomon <dilinger@debian.org>  Tue, 27 Sep 2022 14:14:44 -0400

chromium (105.0.5195.125-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-3195: Out of bounds write in Storage. Reported by
      Ziling Chen and Nan Wang(@eternalsakura13) of 360 Vulnerability
      Research Institute.
    - CVE-2022-3196: Use after free in PDF. Reported by triplepwns.
    - CVE-2022-3197: Use after free in PDF. Reported by triplepwns.
    - CVE-2022-3198: Use after free in PDF. Reported by MerdroidSG.
    - CVE-2022-3199: Use after free in Frames. Reported by Anonymous.
    - CVE-2022-3200: Heap buffer overflow in Internals.
      Reported by Richard Lorenz, SAP.
    - CVE-2022-3201: Insufficient validation of untrusted input in
      DevTools. Reported by NDevTK

 -- Andres Salomon <dilinger@debian.org>  Wed, 14 Sep 2022 12:43:31 -0400

chromium (105.0.5195.102-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-3075: Insufficient data validation in Mojo.
  * Update the cpu check to allow pni instead of sse3 (closes: #1018937).
  * Enable v4l2 for arm platforms. This also disables VA-API on arm64, so
    if that breaks things let me know. Thanks
    Eschenbacher.Stefan@Scheidt-Bachmann.de for the patch (#1011346).
  * debian/patches:
    - upstream/armhf-ftbfs.patch: fix FTBFS introduced with v105 on armhf.

 -- Andres Salomon <dilinger@debian.org>  Mon, 05 Sep 2022 15:57:26 -0400

chromium (105.0.5195.52-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-3038: Use after free in Network Service.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-3039: Use after free in WebSQL. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability
      Research Institute.
    - CVE-2022-3040: Use after free in Layout. Reported by Anonymous.
    - CVE-2022-3041: Use after free in WebSQL. Reported by Ziling Chen and
      Nan Wang(@eternalsakura13) of 360 Vulnerability Research Institute.
    - CVE-2022-3042: Use after free in PhoneHub. Reported by koocola
      (@alo_cook) and Guang Gong of 360 Vulnerability Research Institute.
    - CVE-2022-3043: Heap buffer overflow in Screen Capture.
      Reported by @ginggilBesel.
    - CVE-2022-3044: Inappropriate implementation in Site Isolation.
      Reported by Lucas Pinheiro, Microsoft Browser Vulnerability Research
    - CVE-2022-3045: Insufficient validation of untrusted input in V8.
      Reported by Ben Noordhuis <info@bnoordhuis.nl>.
    - CVE-2022-3046: Use after free in Browser Tag.
      Reported by Rong Jian of VRI.
    - CVE-2022-3071: Use after free in Tab Strip.
      Reported by @ginggilBesel.
    - CVE-2022-3047: Insufficient policy enforcement in Extensions API.
      Reported by Maurice Dauer.
    - CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen.
      Reported by Andr.Ess.
    - CVE-2022-3049: Use after free in SplitScreen.
      Reported by @ginggilBesel.
    - CVE-2022-3050: Heap buffer overflow in WebUI.
      Reported by Zhihua Yao of KunLun Lab.
    - CVE-2022-3051: Heap buffer overflow in Exosphere.
      Reported by @ginggilBesel.
    - CVE-2022-3052: Heap buffer overflow in Window Manager.
      Reported by Khalil Zhani.
    - CVE-2022-3053: Inappropriate implementation in Pointer Lock.
      Reported by Jesper van den Ende (Pelican Party Studios).
    - CVE-2022-3054: Insufficient policy enforcement in DevTools.
      Reported by Kuilin Li.
    - CVE-2022-3055: Use after free in Passwords. Reported by Weipeng
      Jiang (@Krace) and Guang Gong of 360 Vulnerability Research
      Institute.
    - CVE-2022-3056: Insufficient policy enforcement in Content
      Security Policy. Reported by Anonymous.
    - CVE-2022-3057: Inappropriate implementation in iframe Sandbox.
      Reported by Gareth Heyes.
    - CVE-2022-3058: Use after free in Sign-In Flow.
      Reported by raven at KunLun lab.
  * Drop workaround for lack of older clang's -ffile-prefix-map. This
    should make reproducible builds happy.
  * debian/copyright:
    - Update for new libevent location (moved out of base/).
    - libopenjpeg20 -> libopenjpeg
  * debian/patches:
    - debianization/support-i386.patch: refresh.
    - disable/catapult.patch: refresh.
    - disable/libaom-arm.patch: refresh.
    - system/event.patch: update for new libevent location.
    - system/openjpeg.patch: refresh.
    - bullseye/clang13.patch: drop part of patch dropped upstream.
    - upstream/disk-cache.patch: build fix pulled from upstream.
    - upstream/browser-finder.patch: build fix pulled from upstream.
    - upstream/masklayer-geom.patch: build fix pulled from upstream.
    - system/jsoncpp.patch: drop, merged upstream.
    - fixes/angle-wayland: build fix due to mismatched wayland headers
      on sid. Only needed until angle updates its copy of wayland.
    - disable/welcome-page.patch: drop. Upstream fixed the original
      issue some time ago, and this new version finally cleaned up
      the workaround.
    - fixes/connection-message.patch: drop it. I looked at sending this
      upstream, but the original extension doesn't exist any more,
      and chromium properly prints an error if a proxy is unreachable.
      If you can still reproduce the issue (described in
      http://bugs.debian.org/864539), let me know so I can get it fixed
      upstream.
  * debian/scripts/unbundle: upstream tripled the number of (previously
    vendored) libraries that we can use system versions of. However,
    the majority of them are either not in bullseye or are too old, so
    we'll have to wait to use the debian versions for the ones not newly
    added as build-deps.
  * Disable optimize_webui, due to a build failure using nodejs from
    bullseye. I'll reenable this when it either gets fixed or we're done
    with bullseye security support.
  * Remove sse3-support dependency and just refuse to run if SSE3 is
    not present. Breaking via preinst script isn't appropriate for
    packages that might be installed by default (eg, by Debian Edu).
  * debian/control: add build-deps for brotli, libdouble-conversion-dev,
    libwoff-dev, and libxnvctrl-dev (closes: #987292).
  * Rework default search engine stuff. People did not like the "Your
    browser is managed" and "Your administrator can change your browser
    setup remotely" messages, which are admittedly alarming.
    Instead of using /etc/chromium/policies/recommended/duckduckgo.json,
    delete that and use /etc/chromium/master_preferences instead.

 -- Andres Salomon <dilinger@debian.org>  Wed, 31 Aug 2022 20:48:11 -0400

chromium (104.0.5112.101-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-2852: Use after free in FedCM.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2022-2854: Use after free in SwiftShader. Reported by Cassidy
      Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-2855: Use after free in ANGLE. Reported by Cassidy Kim
      of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-2857: Use after free in Blink. Reported by Anonymous
    - CVE-2022-2858: Use after free in Sign-In Flow.
      Reported by raven at KunLun lab
    - CVE-2022-2853: Heap buffer overflow in Downloads.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2022-2856: Insufficient validation of untrusted input in Intents
      Reported by Ashley Shen and Christian Resell of Google Threat
      Analysis Group
    - CVE-2022-2859: Use after free in Chrome OS Shell. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-2860: Insufficient policy enforcement in Cookies.
      Reported by Axel Chong
    - CVE-2022-2861: Inappropriate implementation in Extensions API.
      Reported by Rong Jian of VRI
  * Change default search engine to DuckDuckGo for privacy reasons.
    Set a different search engine under Settings -> Search Engine
    (closes: #956012).
  * Drop a bunch of versioned build-deps that have been satisfied
    since at least oldoldstable.
  * debian/NEWS.Debian:
    - Document upstream dropping support for older TLSv1 and TLSv1.1
      protocols (closes: #1005808).
    - Document upstream dropping support for older x86 CPUs without
      SSE3 instruction support (closes: #1010407).
    - Document the Google to DuckDuckGo change.
    - Document upstream's config renaming of AuthServerWhitelist to
      AuthServerAllowlist (closes: #1013268).

 -- Andres Salomon <dilinger@debian.org>  Tue, 16 Aug 2022 17:29:29 -0400

chromium (104.0.5112.79-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-2603: Use after free in Omnibox. Reported by Anonymous
    - CVE-2022-2604: Use after free in Safe Browsing. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-2605: Out of bounds read in Dawn. Reported by Looben Yang
    - CVE-2022-2606: Use after free in Managed devices API. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-2607: Use after free in Tab Strip. Reported by @ginggilBesel
    - CVE-2022-2608: Use after free in Overview Mode.
      Reported by Khalil Zhani
    - CVE-2022-2609: Use after free in Nearby Share. Reported by koocola
      (@alo_cook) and Guang Gong of 360 Vulnerability Research Institute
    - CVE-2022-2610: Insufficient policy enforcement in Background Fetch.
      Reported by Maurice Dauer
    - CVE-2022-2611: Inappropriate implementation in Fullscreen API.
      Reported by Irvan Kurniawan (sourc7)
    - CVE-2022-2612: Side-channel information leakage in Keyboard input.
      Reported by Erik Kraft (erik.kraft5@gmx.at),
      Martin Schwarzl (martin.schwarzl@iaik.tugraz.at)
    - CVE-2022-2613: Use after free in Input.
      Reported by Piotr Tworek (Vewd)
    - CVE-2022-2614: Use after free in Sign-In Flow.
      Reported by raven at KunLun lab
    - CVE-2022-2615: Insufficient policy enforcement in Cookies.
      Reported by Maurice Dauer
    - CVE-2022-2616: Inappropriate implementation in Extensions API.
      Reported by Alesandro Ortiz
    - CVE-2022-2617: Use after free in Extensions API.
      Reported by @ginggilBesel
    - CVE-2022-2618: Insufficient validation of untrusted input in
      Internals. Reported by asnine
    - CVE-2022-2619: Insufficient validation of untrusted input in Settings.
      Reported by Oliver Dunk
    - CVE-2022-2620: Use after free in WebUI. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-2621: Use after free in Extensions.
      Reported by Huyna at Viettel Cyber Security
    - CVE-2022-2622: Insufficient validation of untrusted input in
      Safe Browsing. Reported by Imre Rad (@ImreRad) and @j00sean
    - CVE-2022-2623: Use after free in Offline. Reported by
      raven at KunLun lab
    - CVE-2022-2624: Heap buffer overflow in PDF. Reported by YU-CHANG
      CHEN and CHIH-YEN CHANG, working with DEVCORE Internship Program
  * debian/patches:
    - bullseye/nomerge.patch: drop, was only needed for clang-11.
    - bullseye/clang11.patch: drop clang-11 bits, rename to clang13.patch.
    - bullseye/blink-constexpr.patch: drop, only needed for clang-11.
    - bullseye/byteswap-constexpr2.patch: drop, only needed for clang-11.
    - disable/angle-perftests.patch: refresh
    - disable/catapult.patch: refresh & drop some no longer needed bits.
    - fixes/tflite.patch: fix a build error.
  * debian/copyright:
    - upstream dropped perfetto/ui/src/gen/.

 -- Andres Salomon <dilinger@debian.org>  Thu, 04 Aug 2022 11:31:44 -0400

chromium (103.0.5060.134-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-2477 : Use after free in Guest View. Reported by anonymous
    - CVE-2022-2478 : Use after free in PDF. Reported by triplepwns
    - CVE-2022-2479 : Insufficient validation of untrusted input in File.
      Reported by anonymous
    - CVE-2022-2480 : Use after free in Service Worker API.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2022-2481: Use after free in Views. Reported by
      YoungJoo Lee(@ashuu_lee) of CompSecLab at Seoul National University
    - CVE-2022-2163: Use after free in Cast UI and Toolbar.
      Reported by Chaoyuan Peng (@ret2happy)

 -- Andres Salomon <dilinger@debian.org>  Wed, 20 Jul 2022 00:51:39 -0400

chromium (103.0.5060.114-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-2294: Heap buffer overflow in WebRTC. Reported by
      Jan Vojtesek from the Avast Threat Intelligence team
    - CVE-2022-2295: Type Confusion in V8.
      Reported by avaue and Buff3tts at S.S.L.
    - CVE-2022-2296: Use after free in Chrome OS Shell.
      Reported by Khalil Zhani

 -- Andres Salomon <dilinger@debian.org>  Sun, 10 Jul 2022 12:44:03 -0400

chromium (103.0.5060.53-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-2156: Use after free in Base.
      Reported by Mark Brand of Google Project Zero
    - CVE-2022-2157: Use after free in Interest groups. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-2158: Type Confusion in V8. Reported by
      Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab
    - CVE-2022-2160: Insufficient policy enforcement in DevTools.
      Reported by David Erceg
    - CVE-2022-2161: Use after free in WebApp Provider.
      Reported by Zhihua Yao of KunLun Lab
    - CVE-2022-2162: Insufficient policy enforcement in File System API.
      Reported by Abdelhamid Naceri (halov)
    - CVE-2022-2163: Use after free in Cast UI and Toolbar.
      Reported by Chaoyuan Peng (@ret2happy)
    - CVE-2022-2164: Inappropriate implementation in Extensions API.
      Reported by José Miguel Moreno Computer Security Lab (COSEC) at UC3M
    - CVE-2022-2165: Insufficient data validation in URL formatting.
      Reported by Rayyan Bijoora
  * debian/patches:
    - upstream/dawn-version-fix.patch: drop merged upstream.
    - upstream/blink-ftbfs.patch: drop, merged upstream.
    - upstream/libxml.patch: drop, merged upstream.
    - upstream/nested-nested-nested-nested-nested-nested-regex-patterns.patch:
      drop, merged upstream.
    - upstream/byteswap-constexpr.patch: drop, merged upstream.
    - bullseye/byteswap-constexpr2.patch: sys_byteswap.h moved directories.
    - disable/angle-perftests.patch: simple refresh.
    - disable/catapult.patch: simple refresh.
    - bullseye/clang11.patch: minor update for some code dropped upstream.
    - system/openjpeg.patch: update for libopenjp2-7-dev's 2.4 -> 2.5 path
      change.

 -- Andres Salomon <dilinger@debian.org>  Tue, 21 Jun 2022 02:59:01 +0000

chromium (102.0.5005.115-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-2007: Use after free in WebGPU. Reported by David Manouchehri
    - CVE-2022-2008: Out of bounds memory access in WebGL.
      Reported by khangkito - Tran Van Khang (VinCSS)
    - CVE-2022-2010: Out of bounds read in compositing.
      Reported by Mark Brand of Google Project Zero
    - CVE-2022-2011: Use after free in ANGLE.
      Reported by SeongHwan Park (SeHwa)
  * debian/patches:
    - bullseye/byteswap-constexpr2.patch - additional fix for bullseye
      builds on 32-bit platforms (closes: #1011096).
    - debianization/support-i386.patch - re-enable support for i386 builds.
      Upstream no longer officially supports i386 builds on linux, so we
      are on our own here.

 -- Andres Salomon <dilinger@debian.org>  Fri, 10 Jun 2022 02:37:57 +0000

chromium (102.0.5005.61-1) unstable; urgency=high

  * New upstream stable release.
    - CVE-2022-1853: Use after free in Indexed DB. Reported by Anonymous
    - CVE-2022-1854: Use after free in ANGLE.
      Reported by SeongHwan Park (SeHwa)
    - CVE-2022-1855: Use after free in Messaging. Reported by Anonymous
    - CVE-2022-1856: Use after free in User Education. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-1857: Insufficient policy enforcement in File System API.
      Reported by Daniel Rhea
    - CVE-2022-1858: Out of bounds read in DevTools. Reported by EllisVlad
    - CVE-2022-1859: Use after free in Performance Manager. Reported by
      Guannan Wang (@Keenan7310) of Tencent Security Xuanwu Lab
    - CVE-2022-1860: Use after free in UI Foundations.
      Reported by @ginggilBesel
    - CVE-2022-1861: Use after free in Sharing. Reported by Khalil Zhani
    - CVE-2022-1862: Inappropriate implementation in Extensions.
      Reported by Alesandro Ortiz
    - CVE-2022-1863: Use after free in Tab Groups. Reported by David Erceg
    - CVE-2022-1864: Use after free in WebApp Installs.
      Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab
    - CVE-2022-1865: Use after free in Bookmarks.
      Reported by Rong Jian of VRI
    - CVE-2022-1866: Use after free in Tablet Mode.
      Reported by @ginggilBesel
    - CVE-2022-1867: Insufficient validation of untrusted input in
      Data Transfer. Reported by Michał Bentkowski of Securitum
    - CVE-2022-1868: Inappropriate implementation in Extensions API.
      Reported by Alesandro Ortiz
    - CVE-2022-1869: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab
    - CVE-2022-1870: Use after free in App Service. Reported by
      Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-1871: Insufficient policy enforcement in File System API.
      Reported by Thomas Orlita
    - CVE-2022-1872: Insufficient policy enforcement in Extensions API.
      Reported by ChaobinZhang
    - CVE-2022-1873: Insufficient policy enforcement in COOP.
      Reported by NDevTK
    - CVE-2022-1874: Insufficient policy enforcement in Safe Browsing.
      Reported by hjy79425575
    - CVE-2022-1875: Inappropriate implementation in PDF. Reported by NDevTK
    - CVE-2022-1876: Heap buffer overflow in DevTools.
      Reported by @ginggilBesel
  * debian/patches:
    - system/jpeg.patch - straight refresh.
    - disable/swiftshader.patch - straight refresh.
    - disable/swiftshader-2.patch - refresh for upstream dropping of legacy
      swiftshader GL stuff; they now use ANGLE.
    - disable/angle-perftests.patch - refresh.
    - system/jsoncpp.patch - refresh for jsoncpp_no_deprecated_declarations
      argument change.
    - bullseye/clang11.patch - merge cast-call.patch into it, as well as
      dropping additional unsupported clang arguments.
    - bullseye/cast-call.patch - drop.
    - upstream/dawn-version-fix.patch - add patch to deal w/ FTBFS.
    - upstream/blink-ftbfs.patch - another FTBFS patch.
    - upstream/nested-nested-nested-nested-nested-nested-regex-patterns.patch -
      fix a build failure that only happens with clang + GNU's libstdc++.
    - upstream/byteswap-constexpr.patch - add this to fix bullsye builds on
      32-bit platforms (closes: #1011096).
  * Don't build unneccessary dawn build tests.

 -- Andres Salomon <dilinger@debian.org>  Wed, 25 May 2022 02:09:10 -0400

chromium (101.0.4951.64-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-1633: Use after free in Sharesheet. Reported by Khalil Zhani
    - CVE-2022-1634: Use after free in Browser UI. Reported by Khalil Zhani
    - CVE-2022-1635: Use after free in Permission Prompts.
      Reported by Anonymous
    - CVE-2022-1636: Use after free in Performance APIs.
      Reported by Seth Brenith, Microsoft
    - CVE-2022-1637: Inappropriate implementation in Web Contents.
      Reported by Alesandro Ortiz
    - CVE-2022-1638: Heap buffer overflow in V8 Internationalization.
      Reported by DoHyun Lee (@l33d0hyun) of DNSLab, Korea University
    - CVE-2022-1639: Use after free in ANGLE.
      Reported by SeongHwan Park (SeHwa)
    - CVE-2022-1640: Use after free in Sharing. Reported by Weipeng
      Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute
    - CVE-2022-1641: Use after free in Web UI Diagnostics.
      Reported by Rong Jian of VRI

 -- Andres Salomon <dilinger@debian.org>  Tue, 10 May 2022 21:52:11 -0400

chromium (101.0.4951.54-1) unstable; urgency=low

  * Depend on sse3-support to ensure that chromium is only installed on
    machines that support the SSE3 instruction set. Otherwise we crash,
    as described in #1010407. We can also remove the manual sse2 check now.
    Upstream describes the SSE3 requirement @ http://crbug.com/1123353
  * New upstream stable release.

 -- Andres Salomon <dilinger@debian.org>  Tue, 03 May 2022 12:16:07 -0400

chromium (101.0.4951.41-2) unstable; urgency=high

  * No changes, just the CVE list. The original blog post *did not*
    have CVEs.  >:(
    - CVE-2022-1477: Use after free in Vulkan.
      Reported by SeongHwan Park (SeHwa)
    - CVE-2022-1478: Use after free in SwiftShader.
      Reported by SeongHwan Park (SeHwa)
    - CVE-2022-1479: Use after free in ANGLE.
      Reported by Jeonghoon Shin of Theori
    - CVE-2022-1480: Use after free in Device API. Reported by @uwu7586
    - CVE-2022-1481: Use after free in Sharing. Reported by Weipeng Jiang
      (@Krace) and Guang Gong of 360 Vulnerability Research Institute
    - CVE-2022-1482: Inappropriate implementation in WebGL.
      Reported by Christoph Diehl, Microsoft
    - CVE-2022-1483: Heap buffer overflow in WebGPU.
      Reported by Mark Brand of Google Project Zero
    - CVE-2022-1484: Heap buffer overflow in Web UI Settings.
      Reported by Chaoyuan Peng (@ret2happy)
    - CVE-2022-1485: Use after free in File System API.
    - CVE-2022-1486: Type Confusion in V8. Reported by Brendon Tiszka
    - CVE-2022-1487: Use after free in Ozone. Reported by Sri
    - CVE-2022-1488: Inappropriate implementation in Extensions API.
      Reported by Thomas Beverley from Wavebox.io
    - CVE-2022-1489: Out of bounds memory access in UI Shelf.
      Reported by Khalil Zhani
    - CVE-2022-1490: Use after free in Browser Switcher.
      Reported by raven at KunLun lab
    - CVE-2022-1491: Use after free in Bookmarks.
      Reported by raven at KunLun lab
    - CVE-2022-1492: Insufficient data validation in Blink Editing.
      Reported by Michał Bentkowski of Securitum
    - CVE-2022-1493: Use after free in Dev Tools.
      Reported by Zhihua Yao of KunLun Lab
    - CVE-2022-1494: Insufficient data validation in Trusted Types.
      Reported by Masato Kinugawa
    - CVE-2022-1495: Incorrect security UI in Downloads.
      Reported by Umar Farooq
    - CVE-2022-1496: Use after free in File Manager. Reported by Zhiyi
      Zhang and Zhunki from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2022-1497: Inappropriate implementation in Input. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2022-1498: Inappropriate implementation in HTML Parser.
      Reported by SeungJu Oh (@real_as3617)
    - CVE-2022-1499: Inappropriate implementation in WebAuthentication.
      Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2022-1500: Insufficient data validation in Dev Tools.
      Reported by Hoang Nguyen
    - CVE-2022-1501: Inappropriate implementation in iframe.
      Reported by Oriol Brufau

 -- Andres Salomon <dilinger@debian.org>  Tue, 26 Apr 2022 18:06:08 -0400

chromium (101.0.4951.41-1) unstable; urgency=low

  * New upstream stable release.
  * debian/copyright:
    - Delete a bunch of file exclusion lines that no longer exist. That
      png file workaround also goes away.
    - Add a line to delete a prebuilt apache server & related modules that
      upstream now includes for some reason?
  * debian/patches:
    - upstream/rvo-workaround.patch - drop, merged upstream.
    - disable/android.patch - drop part of it that upstream fixed.
    - disable/swiftshader.patch - refresh.
    - upstream/libxml.patch - add fix for upstream bug related to
      building against the system libxml.
    - bullseye/cast-call.patch - add a patch to silence unsupported
      flag warnings in clang <= 13.

 -- Andres Salomon <dilinger@debian.org>  Tue, 26 Apr 2022 17:18:09 -0400

chromium (100.0.4896.127-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-1364: Type Confusion in V8.
      Reported by Clément Lecigne of Google's Threat Analysis Group

 -- Andres Salomon <dilinger@debian.org>  Thu, 14 Apr 2022 20:51:15 -0400

chromium (100.0.4896.88-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-1305: Use after free in storage. Reported by Anonymous
    - CVE-2022-1306: Inappropriate implementation in compositing.
      Reported by Sven Dysthe
    - CVE-2022-1307: Inappropriate implementation in full screen.
      Reported by Irvan Kurniawan (sourc7)
    - CVE-2022-1308: Use after free in BFCache.
      Reported by Samet Bekmezci @sametbekmezci
    - CVE-2022-1309: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2022-1310: Use after free in regular expressions.
      Reported by Brendon Tiszka
    - CVE-2022-1311: Use after free in Chrome OS shell.
      Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2022-1312: Use after free in storage. Reported by
      Leecraso and Guang Gong of 360 Vulnerability Research Institute
    - CVE-2022-1313: Use after free in tab groups. Reported by Thomas Orlita
    - CVE-2022-1314: Type Confusion in V8.
      Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab

 -- Andres Salomon <dilinger@debian.org>  Mon, 11 Apr 2022 23:45:07 -0400

chromium (100.0.4896.75-1) unstable; urgency=high

  * debian/copyright:
    - Stop dropping third_party/zlib/contrib/, which is just source code
      with acceptable licenses.
    - Replace the rule that dropped third_party/depot_tools with a more
      specific rule that drops just the ninja binaries. Also delete some
      unused png files to work around a bug in our scripts.
    - Replace a rule that dropped third_party/devtools-frontend/src/test
      with just dropping all wasm files ('*.wasm'), as well as
      third_party/devtools-frontend/src/test/screenshots/image_diff/.
  * debian/patches:
    - upstream/rvo-workaround.patch - added to fix FTBFS w/ clang-11. Pulled
      from upstream git.
    - disable/swiftshader-2.patch - drop most of it that's wrapped in a
      check for windows.
    - disable/fuzzers.patch - drop it; with the last release modifying
      fuzzer inclusion, we can now configure the build without this.
    - disable/owners.patch - drop it; no longer needed with depot_tools
      remaining in the source tree.
    - disable/devtools-unittests.patch - drop it; no longer needed if
      we keep third_party/devtools-frontend/src/test in the source tree.
    - disable/tests.patch - drop half of it; the media/gpu changes aren't
      needed, while keeping stuff in third_party/devtools-frontend/src/test
      from building is still necessary.
  * Drop enable_nacl_nonsfi=false from debian/rules, as upstream got rid
    of the variable.
  * New upstream security release.
    - CVE-2022-1232: Type Confusion in V8.
      Reported by Sergei Glazunov of Google Project Zero.

 -- Andres Salomon <dilinger@debian.org>  Wed, 06 Apr 2022 04:24:45 -0400

chromium (100.0.4896.60-1) unstable; urgency=high

  * Fix debian/watch to find the correct upstream version.
  * Ensure xz uses all available cpu cores when preparing orig.tar.gz
  * Switch to bundled ICU, since Debian's ICU is 2 years old at this point
    and upstream depends on a bunch of new API in ICU 69.1.
  * debian/copyright:
    - ensure all *.dlls are dropped from source.
    - Stop dropping '*fuzz' directories. It was too aggressive, resulting
      in build errors for perfectly fine BSD-3-clause and similar code.
    - Instead, drop '*corpus' and '*corpora' directories. Some of it is
      fine (lots generated by oss-fuzz with .dict files provided), but
      not all of it is and it's easier to just drop it.
    - Drop an esbuild binary.
    - The full upstream tarball includes additional stuff we don't want,
      so drop *.jar, tools/win, and some other stuff in third_party/.
  * debian/rules:
    - Disabling & deleting swiftshader now also needs to add
      dawn_use_swiftshader=false.
    - Switch from -lite upstream tarball to the full tarball in order to
      include ICU sources.
  * debian/patches:
    - upstream/libdrm.patch - drop, merged upstream.
    - debianization/manpage.patch - drop a small chunk merged upstream.
    - system/icu.patch - drop now that we're bundling ICU.
    - bullseye/icu-types.patch - drop now that we're bundling ICU.
    - system/convertutf.patch - update build for bundled ICU path.
    - fixes/closure.patch - drop now that we're no longer using lite tarball.
    - disable/driver-chrome-path.patch - refresh for BUILDFLAG() macro.
    - system/jsoncpp.patch - refresh for unrelated ios change.
    - disable/catapult.patch - refresh due to moving around of .pak files.
  * New upstream stable release.
    - CVE-2022-1125: Use after free in Portals. Reported by Khalil Zhani
    - CVE-2022-1127: Use after free in QR Code Generator.
      Reported by anonymous
    - CVE-2022-1128: Inappropriate implementation in Web Share API.
      Reported by Abdel Adim (@smaury92) Oisfi of Shielder
    - CVE-2022-1129: Inappropriate implementation in Full Screen Mode.
      Reported by Irvan Kurniawan (sourc7)
    - CVE-2022-1130: Insufficient validation of untrusted input in WebOTP.
      Reported by Sergey Toshin of Oversecurity Inc.
    - CVE-2022-1131: Use after free in Cast UI. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2022-1132: Inappropriate implementation in Virtual Keyboard.
      Reported by Andr.Ess
    - CVE-2022-1133: Use after free in WebRTC. Reported by Anonymous
    - CVE-2022-1134: Type Confusion in V8.
      Reported by Man Yue Mo of GitHub Security Lab
    - CVE-2022-1135: Use after free in Shopping Cart.
      Reported by Wei Yuan of MoyunSec VLab
    - CVE-2022-1136: Use after free in Tab Strip . Reported by Krace
    - CVE-2022-1137: Inappropriate implementation in Extensions.
      Reported by Thomas Orlita
    - CVE-2022-1138: Inappropriate implementation in Web Cursor.
      Reported by Alesandro Ortiz
    - CVE-2022-1139: Inappropriate implementation in Background Fetch API.
      Reported by Maurice Dauer
    - CVE-2022-1141: Use after free in File Manager.
      Reported by raven at KunLun lab
    - CVE-2022-1142: Heap buffer overflow in WebUI.
      Reported by Leecraso and Guang Gong of 360 Alpha Lab
    - CVE-2022-1143: Heap buffer overflow in WebUI.
      Reported by Leecraso and Guang Gong of 360 Alpha Lab
    - CVE-2022-1144: Use after free in WebUI.
      Reported by Leecraso and Guang Gong of 360 Alpha Lab
    - CVE-2022-1145: Use after free in Extensions.
      Reported by Yakun Zhang of Baidu Security
    - CVE-2022-1146: Inappropriate implementation in Resource Timing.
      Reported by Sohom Datta

 -- Andres Salomon <dilinger@debian.org>  Fri, 01 Apr 2022 15:02:16 -0400

chromium (99.0.4844.84-1) unstable; urgency=high

  * New upstream security ("just *ONE* security hole, that's it?!") release.
    - CVE-2022-1096: Type Confusion in V8. Reported by anonymous.

 -- Andres Salomon <dilinger@debian.org>  Sat, 26 Mar 2022 00:16:52 -0500

chromium (99.0.4844.74-1) unstable; urgency=high

  * New upstream security release.
    - CVE-2022-0971: Use after free in Blink Layout.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-0972: Use after free in Extensions.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-0973: Use after free in Safe Browsing.
      Reported by avaue and Buff3tts at S.S.L.
    - CVE-2022-0974 : Use after free in Splitscreen.
      Reported by @ginggilBesel.
    - CVE-2022-0975: Use after free in ANGLE.
      Reported by SeongHwan Park (SeHwa).
    - CVE-2022-0976: Heap buffer overflow in GPU. Reported by Omair.
    - CVE-2022-0977: Use after free in Browser UI. Reported by Khalil Zhani.
    - CVE-2022-0978: Use after free in ANGLE. Reported by Cassidy Kim of
      Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-0979: Use after free in Safe Browsing. Reported by anonymous.
    - CVE-2022-0980: Use after free in New Tab Page. Reported by Krace.

 -- Andres Salomon <dilinger@debian.org>  Wed, 16 Mar 2022 13:30:00 -0500

chromium (99.0.4844.51-2) unstable; urgency=medium

  * Change dependency on xdg-desktop-portal-* packages to be
    libgtk-3-0|xdg-desktop-portal-backend. Some folks don't want all
    the dependencies of the xdg portal packages, and chromium really just
    requires gtk unless runnning under KDE (closes: #1006267).
  * Disable fieldtrial testing config to fix some sandboxing issues. We
    used to do this, but the config flag was renamed (closes: #1003622).
  * Adjust patches:
    + system/zlib.patch: drop part of it that is unnecessary.

 -- Andres Salomon <dilinger@debian.org>  Sun, 06 Mar 2022 12:46:55 -0500

chromium (99.0.4844.51-1) unstable; urgency=high

  * Embed harfbuzz instead of using the system harfbuzz. Debian doesn't
    yet package harfbuzz-subset (see #988781). Once it is packaged, we
    can go back to using it.
  * Build against Debian's rapidjson-dev package instead of ANGLE's
    bundled rapidjson.
  * Adjust patches:
    + system/harfbuzz.patch - drop, we're using bundled harfbuzz now.
    + upstream/quiche-include.patch - drop, merged upstream.
    + upstream/restrict.patch - drop, merged upstream.
    + upstream/sequence-point.patch - drop, merged upstream.
    + disable/installer.patch - use new BUILDFLAG() macro.
    + disable/unrar.patch - use new BUILDFLAG() macro.
    + disable/welcome-page.patch - use new BUILDFLAG() macro.
    + disable/widevine-cdm.cu.patch - use new BUILDFLAG() macro.
    + disable/tests.patch - drop unnecessary parts of the patch (which ends
      up being most of it).
    + disable/angle-perftests.patch - drop config disabling ANGLE's rapidjson.
    + disable/swiftshader.patch - drop removal of rapidjson dependency.
    + system/rapidjson.patch - add to enable building w/ rapidjson-dev.
  * New upstream stable release.
    - CVE-2022-0789: Heap buffer overflow in ANGLE.
      Reported by SeongHwan Park (SeHwa).
    - CVE-2022-0790: Use after free in Cast UI. Reported by Anonymous.
    - CVE-2022-0791: Use after free in Omnibox.
      Reported by Zhihua Yao of KunLun Lab.
    - CVE-2022-0792: Out of bounds read in ANGLE.
      Reported by Jaehun Jeong(@n3sk) of Theori.
    - CVE-2022-0793: Use after free in Views. Reported by Thomas Orlita.
    - CVE-2022-0794: Use after free in WebShare. Reported by Khalil Zhani.
    - CVE-2022-0795: Type Confusion in Blink Layout. Reported by 0x74960.
    - CVE-2022-0796: Use after free in Media. Reported by Cassidy Kim
      of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-0797: Out of bounds memory access in Mojo.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-0798: Use after free in MediaStream.
      Reported by Samet Bekmezci @sametbekmezci.
    - CVE-2022-0799: Insufficient policy enforcement in Installer.
      Reported by Abdelhamid Naceri (halov).
    - CVE-2022-0800: Heap buffer overflow in Cast UI.
      Reported by Khalil Zhani.
    - CVE-2022-0801: Inappropriate implementation in HTML parser.
      Reported by Michał Bentkowski of Securitum.
    - CVE-2022-0802: Inappropriate implementation in Full screen mode.
      Reported by Irvan Kurniawan (sourc7).
    - CVE-2022-0803: Inappropriate implementation in Permissions.
      Reported by Abdulla Aldoseri.
    - CVE-2022-0804: Inappropriate implementation in Full screen mode.
      Reported by Irvan Kurniawan (sourc7).
    - CVE-2022-0805: Use after free in Browser Switcher.
      Reported by raven at KunLun Lab.
    - CVE-2022-0806: Data leak in Canvas. Reported by Paril.
    - CVE-2022-0807: Inappropriate implementation in Autofill.
      Reported by Alesandro Ortiz.
    - CVE-2022-0808: Use after free in Chrome OS Shell.
      Reported by @ginggilBesel.
    - CVE-2022-0809: Out of bounds memory access in WebXR.
      Reported by @uwu7586.

 -- Andres Salomon <dilinger@debian.org>  Wed, 02 Mar 2022 21:53:14 -0500

chromium (98.0.4758.102-1) unstable; urgency=high

  * Enable pipewire support in webrtc (closes: #954824).
  * Enable optimize_webui. This UI speed improvement was originally
    disabled due to nodejs deps, but recent upstream changes makes those
    deps necessary either way (closes: #970571).
  * Switch to using bundled node modules, to deal with (frequent) build
    failures (closes: #1005466).
  * Manually depend on xdg-desktop-portal-* packages. The file saving
    dialog needs a UI toolkit (closes: #1005230).
  * New upstream security release.
    - CVE-2022-0603: Use after free in File Manager.
      Reported by Chaoyuan Peng (@ret2happy).
    - CVE-2022-0604: Heap buffer overflow in Tab Groups. Reported by Krace.
    - CVE-2022-0605: Use after free in Webstore API.
      Reported by Thomas Orlita.
    - CVE-2022-0606: Use after free in ANGLE.
    - CVE-2022-0606: Use after free in ANGLE. Reported by Cassidy Kim of
      Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-0607: Use after free in GPU. Reported by 0x74960.
    - CVE-2022-0608: Integer overflow in Mojo.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-0609: Use after free in Animation. Reported by
      Adam Weidemann and Clément Lecigne of Google's Threat Analysis Group.
    - CVE-2022-0610: Inappropriate implementation in Gamepad API.
      Reported by Anonymous.

 -- Andres Salomon <dilinger@debian.org>  Tue, 15 Feb 2022 15:37:54 -0500

chromium (98.0.4758.80-1) unstable; urgency=high

  * Update manpage for package rename and everyone moving to https.
  * Drop libnpsr4-dev versioned dep.
  * Drop a bunch of patches (changes shouldn't affect chromium users).
    See https://salsa.debian.org/chromium-team/chromium/-/commits/master/
    for the dropped patches.
  * New upstream stable release.
    - CVE-2022-0452: Use after free in Safe Browsing.
      Reported by avaue at S.S.L.
    - CVE-2022-0453: Use after free in Reader Mode.
      Reported by Rong Jian of VRI.
    - CVE-2022-0454: Heap buffer overflow in ANGLE.
      Reported by Seong-Hwan Park (SeHwa).
    - CVE-2022-0455: Inappropriate implementation in Full Screen Mode.
      Reported by Irvan Kurniawan (sourc7).
    - CVE-2022-0456: Use after free in Web Search.
      Reported by Zhihua Yao of KunLun Lab.
    - CVE-2022-0457: Type Confusion in V8. Reported by rax of the Group0x58.
    - CVE-2022-0458: Use after free in Thumbnail Tab Strip.
      Reported by Anonymous.
    - CVE-2022-0459: Use after free in Screen Capture.
      Reported by raven (@raid_akame).
    - CVE-2022-0460: Use after free in Window Dialog. Reported by 0x74960.
    - CVE-2022-0461: Policy bypass in COOP. Reported by NDevTK.
    - CVE-2022-0462: Inappropriate implementation in Scroll.
      Reported by Youssef Sammouda.
    - CVE-2022-0463: Use after free in Accessibility.
      Reported by Zhihua Yao of KunLun Lab.
    - CVE-2022-0464: Use after free in Accessibility.
      Reported by Zhihua Yao of KunLun Lab.
    - CVE-2022-0465: Use after free in Extensions.
      Reported by Samet Bekmezci @sametbekmezci.
    - CVE-2022-0466: Inappropriate implementation in Extensions Platform.
      Reported by David Erceg.
    - CVE-2022-0467: Inappropriate implementation in Pointer Lock.
      Reported by Alesandro Ortiz.
    - CVE-2022-0468: Use after free in Payments. Reported by Krace.
    - CVE-2022-0469: Use after free in Cast. Reported by Thomas Orlita.
    - CVE-2022-0470: Out of bounds memory access in V8. Reported by Looben Yang.

 -- Andres Salomon <dilinger@debian.org>  Sat, 05 Feb 2022 01:12:10 -0500

chromium (97.0.4692.99-1) unstable; urgency=high

  * Add myself as an uploader.
  * Ack my NMU (closes: #1003440).
  * Remove Riku Voipio from uploaders at the request of the Debian MIA team -
    thanks for all your past work on chromium, Riku! (closes: #1001562)
  * Build-dep on terser | uglifyjs.terser (closes: #1001036).
  * Revert automatic wayland detection for now (closes: #1003689).
    We'll try again in chromium v98 or v99.
  * New upstream stable release.
    - CVE-2022-0289: Use after free in Safe browsing.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-0290: Use after free in Site isolation. Reported by
      Brendon Tiszka and Sergei Glazunov of Google Project Zero.
    - CVE-2022-0291: Inappropriate implementation in Storage.
      Reported by Anonymous.
    - CVE-2022-0292: Inappropriate implementation in Fenced Frames.
      Reported by Brendon Tiszka.
    - CVE-2022-0293: Use after free in Web packaging. Reported by
      Rong Jian and Guang Gong of 360 Alpha Lab.
    - CVE-2022-0294: Inappropriate implementation in Push messaging.
      Reported by Rong Jian and Guang Gong of 360 Alpha Lab.
    - CVE-2022-0295: Use after free in Omnibox. Reported by Weipeng Jiang
      (@Krace) and Guang Gong of 360 Vulnerability Research Institute.
    - CVE-2022-0296: Use after free in Printing. Reported by koocola(@alo_cook)
      and Guang Gong of 360 Vulnerability Research Institute.
    - CVE-2022-0297: Use after free in Vulkan. Reported by Cassidy Kim of
      Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-0298: Use after free in Scheduling.
      Reported by Yangkang (@dnpushme) of 360 ATA.
    - CVE-2022-0300: Use after free in Text Input Method Editor. Reported by
      Rong Jian and Guang Gong of 360 Alpha Lab.
    - CVE-2022-0301: Heap buffer overflow in DevTools. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research.
    - CVE-2022-0302: Use after free in Omnibox. Reported by Weipeng Jiang
      (@Krace) and Guang Gong of 360 Vulnerability Research Institute.
    - CVE-2022-0303: Race in GPU Watchdog.
      Reported by Yiğit Can YILMAZ (@yilmazcanyigit).
    - CVE-2022-0304: Use after free in Bookmarks. Reported by Rong Jian and
      Guang Gong of 360 Alpha Lab.
    - CVE-2022-0305: Inappropriate implementation in Service Worker API.
      Reported by @uwu7586.
    - CVE-2022-0306: Heap buffer overflow in PDFium.
      Reported by Sergei Glazunov of Google Project Zero.
    - CVE-2022-0307: Use after free in Optimization Guide.
      Reported by Samet Bekmezci @sametbekmezci.
    - CVE-2022-0308: Use after free in Data Transfer.
      Reported by @ginggilBesel.
    - CVE-2022-0309: Inappropriate implementation in Autofill.
      Reported by Alesandro Ortiz.
    - CVE-2022-0310: Heap buffer overflow in Task Manager.
      Reported by Samet Bekmezci @sametbekmezci.
    - CVE-2022-0311: Heap buffer overflow in Task Manager.
      Reported by Samet Bekmezci @sametbekmezci.

 -- Andres Salomon <dilinger@debian.org>  Wed, 19 Jan 2022 23:53:45 -0500

chromium (97.0.4692.71-0.1) unstable; urgency=high

  * Non-maintainer upload.
  * Stop building chromium's bunded gn and instead build-dep on generate-ninja.
  * Drop numerous patches related to gcc building, since we just build w/ clang.
  * Use python3 as default instead of relying on python2
    (closes: #942962, #996375).
  * Enable the ozone backend in the build (closes: #955540).
  * Automatically detect & enable Wayland support when launching chromium
    (closes: #861796).
  * Rename crashpad_handler to chrome_crashpad_handler.
  * No longer hardcode desktop GL implementation as default - it causes
    the chromium compositor's draw buffer to fill up & crash on my system.
  * Enable official builds.
  * Switch to using bundled ffmpeg instead of debian's ffmpeg.
  * New upstream stable release (closes: #995212).
    - CVE-2022-0096: Use after free in Storage. Reported by Yangkang
      (@dnpushme) of 360 ATA
    - CVE-2022-0097: Inappropriate implementation in DevTools. Reported by
      David Erceg
    - CVE-2022-0098: Use after free in Screen Capture. Reported by
      @ginggilBesel
    - CVE-2022-0099: Use after free in Sign-in. Reported by Rox
    - CVE-2022-0100: Heap buffer overflow in Media streams API. Reported by
      Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications
      Corp. Ltd.
    - CVE-2022-0101: Heap buffer overflow in Bookmarks. Reported by raven
      (@raid_akame)
    - CVE-2022-0102: Type Confusion in V8. Reported by Brendon Tiszka
    - CVE-2022-0103: Use after free in SwiftShader. Reported by Abraruddin
      Khan and Omair
    - CVE-2022-0104: Heap buffer overflow in ANGLE. Reported by Abraruddin
      Khan and Omair
    - CVE-2022-0105: Use after free in PDF. Reported by Cassidy Kim of Amber
      Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2022-0106: Use after free in Autofill. Reported by Khalil Zhani
    - CVE-2022-0107: Use after free in File Manager API. Reported by raven
      (@raid_akame)
    - CVE-2022-0108: Inappropriate implementation in Navigation. Reported by
      Luan Herrera (@lbherrera_)
    - CVE-2022-0109: Inappropriate implementation in Autofill. Reported by
      Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University
    - CVE-2022-0110: Incorrect security UI in Autofill. Reported by
      Alesandro Ortiz
    - CVE-2022-0111: Inappropriate implementation in Navigation. Reported by
      garygreen
    - CVE-2022-0112: Incorrect security UI in Browser UI. Reported by Thomas
      Orlita
    - CVE-2022-0113: Inappropriate implementation in Blink. Reported by Luan
      Herrera (@lbherrera_)
    - CVE-2022-0114: Out of bounds memory access in Web Serial. Reported by
      Looben Yang
    - CVE-2022-0115: Uninitialized Use in File API. Reported by Mark Brand
      of Google Project Zero
    - CVE-2022-0116: Inappropriate implementation in Compositing. Reported
      by Irvan Kurniawan (sourc7)
    - CVE-2022-0117: Policy bypass in Service Workers. Reported by
      Dongsung Kim (@kid1ng)
    - CVE-2022-0118: Inappropriate implementation in WebShare. Reported by
      Alesandro Ortiz
    - CVE-2022-0120: Inappropriate implementation in Passwords. Reported by
      CHAKRAVARTHI (Ruler96)
    (96.0.4664.110)
    - CVE-2021-4098: Insufficient data validation in Mojo. Reported by
      Sergei Glazunov of Google Project Zero
    - CVE-2021-4099: Use after free in Swiftshader. Reported by Aki Helin
      of Solita
    - CVE-2021-4100: Object lifecycle issue in ANGLE. Reported by Aki Helin
      of Solita
    - CVE-2021-4101: Heap buffer overflow in Swiftshader. Reported by
      Abraruddin Khan and Omair
    - CVE-2021-4102: Use after free in V8. Reported by Anonymous
    (96.0.4664.93)
    - CVE-2021-4052: Use after free in web apps. Reported by Wei Yuan of
      MoyunSec VLab
    - CVE-2021-4053: Use after free in UI. Reported by Rox
    - CVE-2021-4079: Out of bounds write in WebRTC. Reported by Brendon
      Tiszka
    - CVE-2021-4054: Incorrect security UI in autofill. Reported by
      Alesandro Ortiz
    - CVE-2021-4078: Type confusion in V8. Reported by Nan
      Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab
    - CVE-2021-4055: Heap buffer overflow in extensions. Reported by Chen
      Rong
    - CVE-2021-4056: Type Confusion in loader. Reported by @__R0ng of 360
      Alpha Lab
    - CVE-2021-4057: Use after free in file API. Reported by Sergei
      Glazunov of Google Project Zero
    - CVE-2021-4058: Heap buffer overflow in ANGLE. Reported by Abraruddin
      Khan and Omair
    - CVE-2021-4059: Insufficient data validation in loader. Reported by
      Luan Herrera (@lbherrera_)
    - CVE-2021-4061: Type Confusion in V8. Reported by Paolo Severini
    - CVE-2021-4062: Heap buffer overflow in BFCache. Reported by Leecraso
      and Guang Gong of 360 Alpha Lab
    - CVE-2021-4063: Use after free in developer tools. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-4064: Use after free in screen capture. Reported by
      @ginggilBesel
    - CVE-2021-4065: Use after free in autofill. Reported by 5n1p3r0010
      from Topsec ChiXiao Lab
    - CVE-2021-4066: Integer underflow in ANGLE. Reported by Jaehun
      Jeong(@n3sk) of Theori
    - CVE-2021-4067: Use after free in window manager. Reported by
      @ginggilBesel
    - CVE-2021-4068: Insufficient validation of untrusted input in new tab
      page. Reported by NDevTK
    (96.0.4664.45)
    - CVE-2021-38008: Use after free in media. Reported by Marcin Towalski
    - CVE-2021-38009: Inappropriate implementation in cache.
      Reported by Luan Herrera (@lbherrera_)
    - CVE-2021-38006: Use after free in storage foundation.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2021-38007: Type Confusion in V8. Reported by Polaris Feng and
      SGFvamll at Singular Security Lab
    - CVE-2021-38005: Use after free in loader.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2021-38010: Inappropriate implementation in service workers.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2021-38011: Use after free in storage foundation.
      Reported by Sergei Glazunov of Google Project Zero
    - CVE-2021-38012: Type Confusion in V8. Reported by Yonghwi Jin (@jinmo123)
    - CVE-2021-38013: Heap buffer overflow in fingerprint recognition.
      Reported by raven (@raid_akame)
    - CVE-2021-38014: Out of bounds write in Swiftshader.
      Reported by Atte Kettunen of OUSPG
    - CVE-2021-38015: Inappropriate implementation in input.
      Reported by David Erceg
    - CVE-2021-38016: Insufficient policy enforcement in background fetch.
      Reported by Maurice Dauer
    - CVE-2021-38017: Insufficient policy enforcement in iframe sandbox.
      Reported by NDevTK
    - CVE-2021-38018: Inappropriate implementation in navigation.
      Reported by Alesandro Ortiz
    - CVE-2021-38019: Insufficient policy enforcement in CORS.
      Reported by Maurice Dauer
    - CVE-2021-38020: Insufficient policy enforcement in contacts picker.
      Reported by Luan Herrera (@lbherrera_)
    - CVE-2021-38021: Inappropriate implementation in referrer.
      Reported by Prakash (@1lastBr3ath)
    - CVE-2021-38022: Inappropriate implementation in WebAuthentication.
      Reported by Michal Kepkowski
    (95.0.4638.69)
    - CVE-2021-37997: Use after free in Sign-In. Reported by Wei Yuan of
      MoyunSec VLab
    - CVE-2021-37998: Use after free in Garbage Collection. Reported by
      Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications
      Corp. Ltd.
    - CVE-2021-37999: Insufficient data validation in New Tab Page.
      Reported by Ashish Arun Dhone
    - CVE-2021-38000: Insufficient validation of untrusted input in Intents.
      Reported by Clement Lecigne, Neel Mehta, and Maddie Stone of Google
      Threat Analysis Group
    - CVE-2021-38001: Type Confusion in V8. Reported by @s0rrymybad of
      Kunlun Lab via Tianfu Cup
    - CVE-2021-38002: Use after free in Web Transport. Reported by @__R0ng
      of 360 Alpha Lab, 漏洞研究院青训队 via Tianfu Cup
    - CVE-2021-38003: Inappropriate implementation in V8. Reported by Clément
      Lecigne from Google TAG and Samuel Groß from Google Project Zero
    - CVE-2021-38004: Insufficient policy enforcement in Autofill. Reported
      by Mark Amery
    (95.0.4638.54)
    - CVE-2021-37981: Heap buffer overflow in Skia. Reported by Yangkang
      (@dnpushme) of 360 ATA
    - CVE-2021-37982: Use after free in Incognito. Reported by Weipeng Jiang
      (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2021-37983: Use after free in Dev Tools. Reported by Zhihua Yao
      of KunLun Lab
    - CVE-2021-37984: Heap buffer overflow in PDFium. Reported by Antti
      Levomäki, Joonas Pihlaja and Christian Jalio from Forcepoint
    - CVE-2021-37985: Use after free in V8. Reported by Yangkang (@dnpushme)
      of 360 ATA
    - CVE-2021-37986: Heap buffer overflow in Settings.
      Reported by raven (@raid_akame)
    - CVE-2021-37987: Use after free in Network APIs. Reported by
      Yangkang (@dnpushme) of 360 ATA
    - CVE-2021-37988: Use after free in Profiles. Reported by raven
     (@raid_akame)
    - CVE-2021-37989: Inappropriate implementation in Blink.
      Reported by Matt Dyas, Ankur Sundara
    - CVE-2021-37990: Inappropriate implementation in WebView. Reported by
      Kareem Selim of CyShield
    - CVE-2021-37991: Race in V8. Reported by Samuel Groß of Google Project
      Zero
    - CVE-2021-37992: Out of bounds read in WebAudio. Reported by
      sunburst@Ant Security Light-Year Lab
    - CVE-2021-37993: Use after free in PDF Accessibility. Reported by Cassidy
      Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd.
    - CVE-2021-37996: Insufficient validation of untrusted input in Downloads.
      Reported by Anonymous
    - CVE-2021-37994: Inappropriate implementation in iFrame Sandbox.
      Reported by David Erceg
    - CVE-2021-37995: Inappropriate implementation in WebApp Installer.
      Reported by Terence Eden
    (94.0.4606.81)
    - CVE-2021-37977: Use after free in Garbage Collection. Reported by
      Anonymous
    - CVE-2021-37978: Heap buffer overflow in Blink. Reported by Yangkang
      (@dnpushme) of 360 ATA
    - CVE-2021-37979: Heap buffer overflow in WebRTC. Reported by Marcin
      Towalski of Cisco Talos
    - CVE-2021-37980: Inappropriate implementation in Sandbox. Reported by
      Yonghwi Jin (@jinmo123) of Theori
    (94.0.4606.71)
    - CVE-2021-37974: Use after free in Safe Browsing. Reported by Weipeng
      Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2021-37975: Use after free in V8. Reported by Anonymous
    - CVE-2021-37976: Information leak in core. Reported by Clément Lecigne
      from Google TAG, with technical assistance from Sergei Glazunov and
      Mark Brand from Google Project Zero
    (94.0.4606.61)
    - CVE-2021-37973: Use after free in Portals. Reported by Clément Lecigne
      from Google TAG, with technical assistance from Sergei Glazunov and
      Mark Brand from Google Project Zero
    (94.0.4606.54)
    - CVE-2021-37956 Use after free in Offline use. Reported by Huyna at
      Viettel Cyber Security
    - CVE-2021-37957: Use after free in WebGPU. Reported by Looben Yang
    - CVE-2021-37958: Inappropriate implementation in Navigation. Reported by
      James Lee (@Windowsrcer)
    - CVE-2021-37959: Use after free in Task Manager. Reported by raven
      (@raid_akame)
    - CVE-2021-37961: Use after free in Tab Strip. Reported by Khalil Zhani
    - CVE-2021-37962: Use after free in Performance Manager. Reported by Sri
    - CVE-2021-37963: Side-channel information leakage in DevTools. Reported
      by Daniel Genkin and Ayush Agarwal, University of Michigan, Eyal Ronen
      and Shaked Yehezkel, Tel Aviv University, Sioli O’Connell, University of
      Adelaide, and Jason Kim, Georgia Institute of Technology
    - CVE-2021-37964: Inappropriate implementation in ChromeOS Networking.
      Reported by Hugo Hue and Sze Yiu Chau of the Chinese University of Hong
      Kong
    - CVE-2021-37965: Inappropriate implementation in Background Fetch API.
      Reported by Maurice Dauer
    - CVE-2021-37966: Inappropriate implementation in Compositing. Reported by
      Mohit Raj (shadow2639)
    - CVE-2021-37967: Inappropriate implementation in Background Fetch API.
      Reported by SorryMybad (@S0rryMybad) of Kunlun Lab
    - CVE-2021-37968: Inappropriate implementation in Background Fetch API.
      Reported by Maurice Dauer
    - CVE-2021-37969: Inappropriate implementation in Google Updater. Reported
      by Abdelhamid Naceri (halov)
    - CVE-2021-37970: Use after free in File System API. Reported by
      SorryMybad (@S0rryMybad) of Kunlun Lab
    - CVE-2021-37971: Incorrect security UI in Web Browser UI. Reported by
      Rayyan Bijoora
    - CVE-2021-37972: Out of bounds read in libjpeg-turbo. Reported by Xu
      Hanyu and Lu Yutao from Panguite-Forensics-Lab of Qianxin

 -- Andres Salomon <dilinger@debian.org>  Mon, 10 Jan 2022 01:38:13 -0500

chromium (93.0.4577.82-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2021-30625: Use after free in Selection API. Reported by Marcin
      Towalski of Cisco Talos
    - CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by
      Jeonghoon Shin of Theori
    - CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of
      OUSPG
    - CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong
      @n3sk of Theori
    - CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang
      @Krace from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2021-30630: Inappropriate implementation in Blink . Reported by
      SorryMybad @S0rryMybad of Kunlun Lab
    - CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen
      of OUSPG
    - CVE-2021-30632: Out of bounds write in V8. Reported by Anonymous
    - CVE-2021-30633: Use after free in Indexed DB API. Reported by Anonymous
    - CVE-2021-30606: Use after free in Blink. Reported by Nan Wang
      @eternalsakura13 and koocola @alo_cook of 360 Alpha Lab
    - CVE-2021-30607: Use after free in Permissions. Reported by Weipeng Jiang
      @Krace from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2021-30608: Use after free in Web Share. Reported by Huyna at Viettel
      Cyber Security
    - CVE-2021-30609: Use after free in Sign-In. Reported by raven @raid_akame
    - CVE-2021-30610: Use after free in Extensions API. Reported by Igor
      Bukanov from Vivaldi
    - CVE-2021-30611: Use after free in WebRTC. Reported by Nan Wang
      @eternalsakura13 and koocola @alo_cook of 360 Alpha Lab
    - CVE-2021-30612: Use after free in WebRTC. Reported by Nan Wang
      @eternalsakura13 and koocola @alo_cook of 360 Alpha Lab
    - CVE-2021-30613: Use after free in Base internals. Reported by Yangkang
      @dnpushme of 360 ATA
    - CVE-2021-30614: Heap buffer overflow in TabStrip. Reported by Huinian
      Yang @vmth6 of Amber Security Lab, OPPO Mobile Telecommunications Corp.
      Ltd.
    - CVE-2021-30615: Cross-origin data leak in Navigation. Reported by NDevTK
    - CVE-2021-30616: Use after free in Media. Reported by Anonymous
    - CVE-2021-30617: Policy bypass in Blink. Reported by NDevTK
    - CVE-2021-30618: Inappropriate implementation in DevTools. Reported by
      @DanAmodio and @mattaustin from Contrast Security
    - CVE-2021-30619: UI Spoofing in Autofill. Reported by Alesandro Ortiz
    - CVE-2021-30620: Insufficient policy enforcement in Blink. Reported by Jun
      Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2021-30621: UI Spoofing in Autofill. Reported by Abdulrahman
      Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-30622: Use after free in WebApp Installs. Reported by Jun
      Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2021-30623: Use after free in Bookmarks. Reported by Leecraso and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-30624: Use after free in Autofill. Reported by Wei Yuan of
      MoyunSec VLab
    - CVE-2021-30598: Type Confusion in V8. Reported by Manfred Paul
    - CVE-2021-30599: Type Confusion in V8. Reported by Manfred Paul
    - CVE-2021-30600: Use after free in Printing. Reported by Leecraso and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-30601: Use after free in Extensions API. Reported by koocola
      @alo_cook and Nan Wang @eternalsakura13 of 360 Alpha Lab
    - CVE-2021-30602: Use after free in WebRTC. Reported by Marcin Towalski of
      Cisco Talos
    - CVE-2021-30603: Race in WebAudio. Reported by Sergei Glazunov of Google
      Project Zero
    - CVE-2021-30604: Use after free in ANGLE. Reported by Seong-Hwan Park
      SeHwa of SecunologyLab
    - CVE-2021-30554: Use after free in WebGL. Reported by anonymous
    - CVE-2021-30555: Use after free in Sharing. Reported by David Erceg
    - CVE-2021-30556: Use after free in WebAudio. Reported by Yangkang
      @dnpushme of 360 ATA
    - CVE-2021-30557: Use after free in TabGroups. Reported by David Erceg
    - CVE-2021-30544: Use after free in BFCache. Reported by Rong Jian and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-30545: Use after free in Extensions. Reported by kkwon with
      everpall and kkomdal
    - CVE-2021-30546: Use after free in Autofill. Reported by Abdulrahman
      Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-30547: Out of bounds write in ANGLE. Reported by Seong-Hwan Park
      SeHwa of SecunologyLab
    - CVE-2021-30548: Use after free in Loader. Reported by Yangkang @dnpushme
      & Wanglu of Qihoo360 Qex Team
    - CVE-2021-30549: Use after free in Spell check. Reported by David Erceg
    - CVE-2021-30550: Use after free in Accessibility. Reported by David Erceg
    - CVE-2021-30551: Type Confusion in V8. Reported by Clement Lecigne of
      Google's Threat Analysis Group and Sergei Glazunov of Google Project Zero
    - CVE-2021-30552: Use after free in Extensions. Reported by David Erceg
    - CVE-2021-30553: Use after free in Network service. Reported by Anonymous
    - CVE-2021-30521: Heap buffer overflow in Autofill. Reported by ZhanJia
      Song
    - CVE-2021-30522: Use after free in WebAudio. Reported by Piotr Bania of
      Cisco Talos
    - CVE-2021-30523: Use after free in WebRTC. Reported by Tolyan Korniltsev
    - CVE-2021-30524: Use after free in TabStrip. Reported by David Erceg
    - CVE-2021-30525: Use after free in TabGroups. Reported by David Erceg
    - CVE-2021-30526: Out of bounds write in TabStrip. Reported by David Erceg
    - CVE-2021-30527: Use after free in WebUI. Reported by David Erceg
    - CVE-2021-30528: Use after free in WebAuthentication. Reported by Man Yue
      Mo of GitHub Security Lab
    - CVE-2021-30529: Use after free in Bookmarks. Reported by koocola
      @alo_cook and Nan Wang @eternalsakura13 of 360 Alpha Lab
    - CVE-2021-30530: Out of bounds memory access in WebAudio. Reported by
      kkwon
    - CVE-2021-30531: Insufficient policy enforcement in Content Security
      Policy. Reported by Philip Papurt
    - CVE-2021-30532: Insufficient policy enforcement in Content Security
      Policy. Reported by Philip Papurt
    - CVE-2021-30533: Insufficient policy enforcement in PopupBlocker. Reported
      by Eliya Stein
    - CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox.
      Reported by Alesandro Ortiz
    - CVE-2021-30535: Double free in ICU. Reported by nocma, leogan, cheneyxu
      of WeChat Open Platform Security Team
    - CVE-2021-21212: Insufficient data validation in networking. Reported by
      Hugo Hue and Sze Yiu Chau of the Chinese University of Hong Kong
    - CVE-2021-30536: Out of bounds read in V8. Reported by Chris Salls @salls
    - CVE-2021-30537: Insufficient policy enforcement in cookies. Reported by
      Jun Kokatsu @shhnjk
    - CVE-2021-30538: Insufficient policy enforcement in content security
      policy. Reported by Tianze Ding @D1iv3 of Tencent Security Xuanwu Lab
    - CVE-2021-30539: Insufficient policy enforcement in content security
      policy. Reported by unnamed researcher
    - CVE-2021-30540: Incorrect security UI in payments. Reported by
      @retsew0x01

 -- Michel Le Bihan <michel@lebihan.pl>  Thu, 16 Sep 2021 17:48:15 +0200

chromium (90.0.4430.212-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2021-30506: Incorrect security UI in Web App Installs. Reported by
      @retsew0x01
    - CVE-2021-30507: Inappropriate implementation in Offline. Reported by
      Alison Huffman
    - CVE-2021-30508: Heap buffer overflow in Media Feeds. Reported by Leecraso
      and Guang Gong
    - CVE-2021-30509: Out of bounds write in Tab Strip. Reported by David Erceg
    - CVE-2021-30510: Race in Aura. Reported by Weipeng Jiang
    - CVE-2021-30511: Out of bounds read in Tab Groups. Reported by David Erceg
    - CVE-2021-30512: Use after free in Notifications. Reported by ZhanJia Song
    - CVE-2021-30513: Type Confusion in V8. Reported by Man Yue Mo
    - CVE-2021-30514: Use after free in Autofill. Reported by koocola and Wang
    - CVE-2021-30515: Use after free in File API. Reported by Rong Jian and
      Guang Gong
    - CVE-2021-30516: Heap buffer overflow in History. Reported by ZhanJia Song
    - CVE-2021-30517: Type Confusion in V8. Reported by laural
    - CVE-2021-30518: Heap buffer overflow in Reader Mode. Reported by Jun
      Kokatsu
    - CVE-2021-30519: Use after free in Payments. Reported by asnine
    - CVE-2021-30520: Use after free in Tab Strip. Reported by Khalil Zhani

 -- Michael Gilbert <mgilbert@debian.org>  Thu, 13 May 2021 02:50:43 +0000

chromium (90.0.4430.93-1) unstable; urgency=medium

  * New upstream security release (closes: #987715).
    - CVE-2021-21227: Insufficient data validation in V8. Reported by Gengming
      Liu of Singular Security Lab
    - CVE-2021-21232: Use after free in Dev Tools. Reported by Abdulrahman
      Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-21233: Heap buffer overflow in ANGLE. Reported by Omair
    - CVE-2021-21228: Insufficient policy enforcement in extensions. Reported
      by Rob Wu
    - CVE-2021-21229: Incorrect security UI in downloads. Reported by Mohit Raj
      shadow2639
    - CVE-2021-21230: Type Confusion in V8. Reported by Manfred Paul
    - CVE-2021-21231: Insufficient data validation in V8. Reported by Sergei
      Glazunov of Google Project Zero
  * Disable libaom on arm to potentially fix FTBFS on armhf

 -- Michel Le Bihan <michel@lebihan.pl>  Wed, 28 Apr 2021 12:15:32 +0200

chromium (90.0.4430.85-1) unstable; urgency=medium

  * New upstream security release (closes: #987358).
    - CVE-2021-21222: Heap buffer overflow in V8. Reported by Guang Gong of
      Alpha Lab, Qihoo 360
    - CVE-2021-21223: Integer overflow in Mojo. Reported by Guang Gong of Alpha
      Lab, Qihoo 360
    - CVE-2021-21224: Type Confusion in V8. Reported by Jose Martinez tr0y4
      from VerSprite Inc.
    - CVE-2021-21225: Out of bounds memory access in V8. Reported by Brendon
      Tiszka @btiszka supporting the EFF
    - CVE-2021-21226: Use after free in navigation. Reported by Brendon Tiszka
      @btiszka supporting the EFF

 -- Michel Le Bihan <michel@lebihan.pl>  Thu, 22 Apr 2021 13:01:41 +0200

chromium (90.0.4430.72-1) unstable; urgency=medium

  * New upstream security release (closes: #987053).
    - CVE-2021-21201: Use after free in permissions. Reported by Gengming Liu
      and Jianyu Chen when working at Tencent KeenLab
    - CVE-2021-21202: Use after free in extensions. Reported by David Erceg
    - CVE-2021-21203: Use after free in Blink. Reported by asnine
    - CVE-2021-21204: Use after free in Blink. Reported by Chelse Tsai-Simek,
      Jeanette Ulloa, and Emily Voigtlander of Seesaw
    - CVE-2021-21205: Insufficient policy enforcement in navigation. Reported
      by Alison Huffman, Microsoft Browser Vulnerability Research
    - CVE-2021-21221: Insufficient validation of untrusted input in Mojo.
      Reported by Guang Gong of Alpha Lab, Qihoo 360
    - CVE-2021-21207: Use after free in IndexedDB. Reported by koocola
      @alo_cook and Nan Wang @eternalsakura13 of 360 Alpha Lab
    - CVE-2021-21208: Insufficient data validation in QR scanner. Reported by
      Ahmed Elsobky @0xsobky
    - CVE-2021-21209: Inappropriate implementation in storage. Reported by Tom
      Van Goethem @tomvangoethem
    - CVE-2021-21210: Inappropriate implementation in Network. Reported by
      @bananabr
    - CVE-2021-21211: Inappropriate implementation in Navigation. Reported by
      Akash Labade m0ns7er
    - CVE-2021-21212: Incorrect security UI in Network Config UI. Reported by
      Hugo Hue and Sze Yiu Chau of the Chinese University of Hong Kong
    - CVE-2021-21213: Use after free in WebMIDI. Reported by raven
      @raid_akame
    - CVE-2021-21214: Use after free in Network API. Reported by Anonymous
    - CVE-2021-21215: Inappropriate implementation in Autofill. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-21216: Inappropriate implementation in Autofill. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-21217: Uninitialized Use in PDFium. Reported by Zhou Aiting
      @zhouat1 of Qihoo 360 Vulcan Team
    - CVE-2021-21218: Uninitialized Use in PDFium. Reported by Zhou Aiting
      @zhouat1 of Qihoo 360 Vulcan Team
    - CVE-2021-21219: Uninitialized Use in PDFium. Reported by Zhou Aiting
      @zhouat1 of Qihoo 360 Vulcan Team

 -- Michel Le Bihan <michel@lebihan.pl>  Mon, 19 Apr 2021 19:13:47 +0200

chromium (89.0.4389.114-1) unstable; urgency=medium

  * New upstream security release (closes: #986335).
    - CVE-2021-21194: Use after free in screen capture. Reported by Leecraso
      and Guang Gong
    - CVE-2021-21195: Use after free in V8. Reported by Liu and Liang
    - CVE-2021-21196: Heap buffer overflow in TabStrip. Reported by Khalil
      Zhani
    - CVE-2021-21197: Heap buffer overflow in TabStrip. Reported by Abdulrahman
      Alqabandi
    - CVE-2021-21198: Out of bounds read in IPC. Reported by Mark Brand
    - CVE-2021-21199: Use Use after free in Aura. Reported by Weipeng Jiang

 -- Michael Gilbert <mgilbert@debian.org>  Sun, 04 Apr 2021 00:34:12 +0000

chromium (89.0.4389.90-1) unstable; urgency=medium

  * New upstream security release (closes: #985271).
    - CVE-2021-21191: Use after free in WebRTC. Reported by raven @raid_akame
    - CVE-2021-21192: Heap buffer overflow in tab groups. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-21193: Use after free in Blink. Reported by Anonymous
      (closes: #985142)
  * Fix build with libvpx 1.7.0 and libicu63 (closes: #984926).
  * Change debian/rules to not leave debian/scripts/mk-origtargz

 -- Michel Le Bihan <michel@lebihan.pl>  Mon, 15 Mar 2021 12:57:00 +0100

chromium (89.0.4389.82-1) unstable; urgency=medium

  * New upstream stable release (closes: #984532).
    - CVE-2021-21159: Heap buffer overflow in TabStrip. Reported by Khalil
      Zhani
    - CVE-2021-21160: Heap buffer overflow in WebAudio. Reported by Marcin
      'Icewall' Noga of Cisco Talos
    - CVE-2021-21161: Heap buffer overflow in TabStrip. Reported by Khalil
      Zhani
    - CVE-2021-21162: Use after free in WebRTC. Reported by Anonymous
    - CVE-2021-21163: Insufficient data validation in Reader Mode. Reported by
      Alison Huffman, Microsoft Browser Vulnerability Research
    - CVE-2021-21164: Insufficient data validation in Chrome for iOS. Reported
      by Muneaki Nishimura nishimunea
    - CVE-2021-21165: Object lifecycle issue in audio. Reported by Alison
      Huffman, Microsoft Browser Vulnerability Research
    - CVE-2021-21166: Object lifecycle issue in audio. Reported by Alison
      Huffman, Microsoft Browser Vulnerability Research
    - CVE-2021-21167: Use after free in bookmarks. Reported by Leecraso and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-21168: Insufficient policy enforcement in appcache. Reported by
      Luan Herrera @lbherrera_
    - CVE-2021-21169: Out of bounds memory access in V8. Reported by Bohan Liu
      @P4nda20371774 and Moon Liang of Tencent Security Xuanwu Lab
    - CVE-2021-21170: Incorrect security UI in Loader. Reported by David Erceg
    - CVE-2021-21171: Incorrect security UI in TabStrip and Navigation.
      Reported by Irvan Kurniawan sourc7
    - CVE-2021-21172: Insufficient policy enforcement in File System API.
      Reported by Maciej Pulikowski
    - CVE-2021-21173: Side-channel information leakage in Network Internals.
      Reported by Tom Van Goethem from imec-DistriNet, KU Leuven
    - CVE-2021-21174: Inappropriate implementation in Referrer. Reported by
      Ashish Gautam Kamble
    - CVE-2021-21175: Inappropriate implementation in Site isolation. Reported
      by Jun Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2021-21176: Inappropriate implementation in full screen mode.
      Reported by Luan Herrera @lbherrera_
    - CVE-2021-21177: Insufficient policy enforcement in Autofill. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2021-21178: Inappropriate implementation in Compositing. Reported by
      Japong
    - CVE-2021-21179: Use after free in Network Internals. Reported by
      Anonymous
    - CVE-2021-21180: Use after free in tab search. Reported by Abdulrahman
      Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2020-27844: Heap buffer overflow in OpenJPEG. Reported by Sean
      Campbell at Tableau
    - CVE-2021-21181: Side-channel information leakage in autofill. Reported by
      Xu Lin (University of Illinois at Chicago), Panagiotis Ilia University of
      Illinois at Chicago, Jason Polakis University of Illinois at Chicago
    - CVE-2021-21182: Insufficient policy enforcement in navigations. Reported
      by Luan Herrera @lbherrera_
    - CVE-2021-21183: Inappropriate implementation in performance APIs.
      Reported by Takashi Yoneuchi @y0n3uchy
    - CVE-2021-21184: Inappropriate implementation in performance APIs.
      Reported by James Hartig
    - CVE-2021-21185: Insufficient policy enforcement in extensions. Reported
      by David Erceg
    - CVE-2021-21186: Insufficient policy enforcement in QR scanning. Reported
      by dhirajkumarnifty
    - CVE-2021-21187: Insufficient data validation in URL formatting. Reported
      by Kirtikumar Anandrao Ramchandani
    - CVE-2021-21188: Use after free in Blink. Reported by Woojin Oh
      @pwn_expoit of STEALIEN
    - CVE-2021-21189: Insufficient policy enforcement in payments. Reported by
      Khalil Zhani
    - CVE-2021-21190: Uninitialized Use in PDFium. Reported by Zhou Aiting
      @zhouat1 of Qihoo 360 Vulcan Team

 -- Michel Le Bihan <michel@lebihan.pl>  Mon, 08 Mar 2021 09:48:03 +0100

chromium (88.0.4324.182-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2021-21149: Stack overflow in Data Transfer. Reported by Ryoya
      Tsukasaki
    - CVE-2021-21150: Use after free in Downloads. Reported by Woojin Oh
    - CVE-2021-21151: Use after free in Payments. Reported by Khalil Zhani
    - CVE-2021-21152: Heap buffer overflow in Media. Reported by Anonymous
    - CVE-2021-21153: Stack overflow in GPU Process. Reported by Jan Ruge
    - CVE-2021-21154: Heap buffer overflow in Tab Strip . Reported by
      Abdulrahman Alqabandi
    - CVE-2021-21155: Heap buffer overflow in Tab Strip . Reported by Khalil
      Zhani
    - CVE-2021-21156: Heap buffer overflow in V8. Reported by Sergei Glazunov
    - CVE-2021-21157: Use after free in Web Sockets. Reported by Anonymous

 -- Michael Gilbert <mgilbert@debian.org>  Thu, 18 Feb 2021 00:56:55 +0000

chromium (88.0.4324.150-1) unstable; urgency=medium

  * New upstream security release (closes: #982205).
    - CVE-2021-21148: Heap buffer overflow in V8. Reported by Mattias Buelens

 -- Michel Le Bihan <michel@lebihan.pl>  Tue, 09 Feb 2021 13:02:34 +0100

chromium (88.0.4324.146-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2021-21142: Use after free in Payments. Reported by Khalil Zhani
    - CVE-2021-21143: Heap buffer overflow in Extensions. Reported by Allen
      Parker & Alex Morgan of MU
    - CVE-2021-21144: Heap buffer overflow in Tab Groups. Reported by Leecraso
      and Guang Gong of 360 Alpha Lab
    - CVE-2021-21145: Use after free in Fonts. Reported by Anonymous
    - CVE-2021-21146: Use after free in Navigation. Reported by Alison Huffman
      and Choongwoo Han of Microsoft Browser Vulnerability Research
    - CVE-2021-21147: Inappropriate implementation in Skia. Reported by Roman
      Starkov

 -- Michel Le Bihan <michel@lebihan.pl>  Wed, 03 Feb 2021 11:11:02 +0100

chromium (88.0.4324.96-2) unstable; urgency=medium

  * Add Michel Le Bihan to uploaders.
  * Add openjpeg include dirs to pdfium BUILD.gn (closes: #981270).

 -- Michel Le Bihan <michel@lebihan.pl>  Fri, 29 Jan 2021 12:37:49 +0100

chromium (88.0.4324.96-1) unstable; urgency=medium

  * Organize patches.
  * Use system vpx again.
  * Support icu 6.3 and clang 7 in buster again.
  * Apply the non-maintainer uploads (closes: #972134).
    - Thanks to Michel Le Bihan, Jan Luca Naumann, and Peter Michael Green.

 -- Michael Gilbert <mgilbert@debian.org>  Wed, 27 Jan 2021 01:40:59 +0000

chromium (88.0.4324.96-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream stable release (closes: #980564).
    - CVE-2021-21117: Insufficient policy enforcement in Cryptohome. Reported
      by Rory McNamara
    - CVE-2021-21118: Insufficient data validation in V8. Reported by Tyler
      Nighswander @tylerni7 of Theori
    - CVE-2021-21119: Use after free in Media. Reported by Anonymous
    - CVE-2021-21120: Use after free in WebSQL. Reported by Nan Wang
      @eternalsakura13 and Guang Gong of 360 Alpha Lab
    - CVE-2021-21121: Use after free in Omnibox. Reported by Leecraso and Guang
      Gong of 360 Alpha Lab
    - CVE-2021-21122: Use after free in Blink. Reported by Renata Hodovan
    - CVE-2021-21123: Insufficient data validation in File System API. Reported
      by Maciej Pulikowski
    - CVE-2021-21124: Potential user after free in Speech Recognizer. Reported
      by Chaoyang Ding(@V4kst1z) from Codesafe Team of Legendsec at Qi'anxin
      Group
    - CVE-2021-21125: Insufficient policy enforcement in File System API.
      Reported by Ron Masas
    - CVE-2020-16044: Use after free in WebRTC. Reported by Ned Williamson of
      Project Zero
    - CVE-2021-21126: Insufficient policy enforcement in extensions. Reported
      by David Erceg
    - CVE-2021-21127: Insufficient policy enforcement in extensions. Reported
      by Jasminder Pal Singh, Web Services Point WSP, Kotkapura
    - CVE-2021-21128: Heap buffer overflow in Blink. Reported by Liang Dong
    - CVE-2021-21129: Insufficient policy enforcement in File System API.
      Reported by Maciej Pulikowski
    - CVE-2021-21130: Insufficient policy enforcement in File System API.
      Reported by Maciej Pulikowski
    - CVE-2021-21131: Insufficient policy enforcement in File System API.
      Reported by Maciej Pulikowski
    - CVE-2021-21132: Inappropriate implementation in DevTools. Reported by
      David Erceg
    - CVE-2021-21133: Insufficient policy enforcement in Downloads. Reported by
      wester0x01
    - CVE-2021-21134: Incorrect security UI in Page Info. Reported by
      wester0x01
    - CVE-2021-21135: Inappropriate implementation in Performance API. Reported
      by ndevtk
    - CVE-2021-21136: Insufficient policy enforcement in WebView. Reported by
      Shiv Sahni, Movnavinothan V and Imdad Mohammed
    - CVE-2021-21137: Inappropriate implementation in DevTools. Reported by
      bobblybear
    - CVE-2021-21138: Use after free in DevTools. Reported by Weipeng Jiang
      @Krace from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2021-21139: Inappropriate implementation in iframe sandbox. Reported
      by Jun Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2021-21140: Uninitialized Use in USB. Reported by David Manouchehri
    - CVE-2021-21141: Insufficient policy enforcement in File System API.
      Reported by Maciej Pulikowski

  [ Jan Luca Naumann ]
  * Add watch file.

  [ Mattia Rizzolo ]
  * Change get-orig-source to produce reproducible tarballs.

 -- Michel Le Bihan <michel@lebihan.pl>  Wed, 20 Jan 2021 23:23:08 +0100

chromium (87.0.4280.141-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream security release (closes: #979520).
    - CVE-2021-21106: Use after free in autofill. Reported by Weipeng Jiang
      @Krace from Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2021-21107: Use after free in drag and drop. Reported by Leecraso and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-21108: Use after free in media. Reported by Leecraso and Guang
      Gong of 360 Alpha Lab
    - CVE-2021-21109: Use after free in payments. Reported by Rong Jian and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-21110: Use after free in safe browsing. Reported by Anonymous
    - CVE-2021-21111: Insufficient policy enforcement in WebUI. Reported by
      Alesandro Ortiz
    - CVE-2021-21112: Use after free in Blink. Reported by YoungJoo Lee
      @ashuu_lee of Raon Whitehat
    - CVE-2021-21113: Heap buffer overflow in Skia. Reported by tsubmunu
    - CVE-2020-16043: Insufficient data validation in networking. Reported by
      Samy Kamkar, Ben Seri at Armis, Gregory Vishnepolsky at Armis
    - CVE-2021-21114: Use after free in audio. Reported by Man Yue Mo of GitHub
      Security Lab
    - CVE-2020-15995: Out of bounds write in V8. Reported by Bohan Liu
      @P4nda20371774 of Tencent Security Xuanwu Lab
    - CVE-2021-21115: Use after free in safe browsing. Reported by Leecraso and
      Guang Gong of 360 Alpha Lab
    - CVE-2021-21116: Heap buffer overflow in audio. Reported by Alison
      Huffman, Microsoft Browser Vulnerability Research

  [ Jan Luca Naumann ]
  * Use desktop gl implementation as default. (closes: #979135)

 -- Michel Le Bihan <michel@lebihan.pl>  Sat, 09 Jan 2021 11:24:58 +0100

chromium (87.0.4280.88-0.4) unstable; urgency=medium

  * Non-maintainer upload.

  [ Michel Le Bihan ]
  * Install ANGLE EGL and GLESv2 libs (closes: #977870).
  * Disable Widevine CDM component updater (closes: #960454).
  * Disable usage of google-chrome in driver (closes: #930543).

  [ Jan Luca Naumann ]
  * Remove python3-xcbgen from Build-Deps
  * Changes to allow building on buster
  * Add patch for explicit python2 usage in scripts

 -- Michel Le Bihan <michel@lebihan.pl>  Tue, 29 Dec 2020 10:58:42 +0100

chromium (87.0.4280.88-0.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix double-delete in content service worker (closes: #977901).

 -- Michel Le Bihan <michel@lebihan.pl>  Wed, 23 Dec 2020 11:55:48 +0100

chromium (87.0.4280.88-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Exclude debian dir from unversioned python conversion script

 -- Michel Le Bihan <michel@lebihan.pl>  Sun, 20 Dec 2020 22:14:50 +0100

chromium (87.0.4280.88-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream stable release (closes: #973848).
    - CVE-2020-16037: Use after free in clipboard. Reported by Ryoya Tsukasaki
    - CVE-2020-16038: Use after free in media. Reported by Khalil Zhani
    - CVE-2020-16039: Use after free in extensions. Reported by Anonymous
    - CVE-2020-16040: Insufficient data validation in V8. Reported by Lucas
      Pinheiro, Microsoft Browser Vulnerability Research
    - CVE-2020-16041: Out of bounds read in networking. Reported by Sergei
      Glazunov and Mark Brand of Google Project Zero
    - CVE-2020-16042: Uninitialized Use in V8. Reported by André Bargull
    - CVE-2020-16018: Use after free in payments. Reported by Man Yue Mo of
      GitHub Security Lab
    - CVE-2020-16019: Inappropriate implementation in filesystem. Reported by
      Rory McNamara
    - CVE-2020-16020: Inappropriate implementation in cryptohome. Reported by
      Rory McNamara
    - CVE-2020-16021: Race in ImageBurner. Reported by Rory McNamara
    - CVE-2020-16022: Insufficient policy enforcement in networking. Reported
      by @SamyKamkar
    - CVE-2020-16015: Insufficient data validation in WASM. Reported by Rong
      Jian and Leecraso of 360 Alpha Lab
    - CVE-2020-16014: Use after free in PPAPI. Reported by Rong Jian and
      Leecraso of 360 Alpha Lab
    - CVE-2020-16023: Use after free in WebCodecs. Reported by Brendon Tiszka
      and David Manouchehri supporting the @eff
    - CVE-2020-16024: Heap buffer overflow in UI. Reported by Sergei Glazunov
      of Google Project Zero
    - CVE-2020-16025: Heap buffer overflow in clipboard. Reported by Sergei
      Glazunov of Google Project Zero
    - CVE-2020-16026: Use after free in WebRTC. Reported by Jong-Gwon Kim
    - CVE-2020-16027: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2020-16028: Heap buffer overflow in WebRTC. Reported by asnine
    - CVE-2020-16029: Inappropriate implementation in PDFium. Reported by
      Anonymous
    - CVE-2020-16030: Insufficient data validation in Blink. Reported by Michał
      Bentkowski of Securitum
    - CVE-2019-8075: Insufficient data validation in Flash. Reported by
      Nethanel Gelernter, Cyberpion
    - CVE-2020-16031: Incorrect security UI in tab preview. Reported by
      wester0x01
    - CVE-2020-16032: Incorrect security UI in sharing. Reported by wester0x01
    - CVE-2020-16033: Incorrect security UI in WebUSB. Reported by Khalil Zhani
    - CVE-2020-16034: Inappropriate implementation in WebRTC. Reported by
      Benjamin Petermaier
    - CVE-2020-16035: Insufficient data validation in cros-disks. Reported by
      Rory McNamara
    - CVE-2020-16012: Side-channel information leakage in graphics. Reported by
      Aleksejs Popovs
    - CVE-2020-16036: Inappropriate implementation in cookies. Reported by Jun
      Kokatsu @shhnjk
    - CVE-2020-16013: Inappropriate implementation in V8. Reported by Anonymous
    - CVE-2020-16017: Use after free in site isolation. Reported by Anonymous
    - CVE-2020-16016: Inappropriate implementation in base. Reported by Rong
      Jian and Leecraso of 360 Alpha Lab
    - CVE-2020-16004: Use after free in user interface. Reported by Leecraso
      and Guang Gong of 360 Alpha Lab working with 360 BugCloud
    - CVE-2020-16005: Insufficient policy enforcement in ANGLE. Reported by
      Jaehun Jeong @n3sk of Theori
    - CVE-2020-16006: Inappropriate implementation in V8. Reported by Bill
      Parks
    - CVE-2020-16007: Insufficient data validation in installer. Reported by
      Abdelhamid Naceri
    - CVE-2020-16008: Stack buffer overflow in WebRTC. Reported by Tolya
      Korniltsev
    - CVE-2020-16009: Inappropriate implementation in V8. Reported by Clement
      Lecigne of Google's Threat Analysis Group and Samuel Groß of Google
      Project Zero
    - CVE-2020-16011: Heap buffer overflow in UI on Windows. Reported by Sergei
      Glazunov of Google Project Zero
    - CVE-2020-16000: Inappropriate implementation in Blink. Reported by
      amaebi_jp
    - CVE-2020-16001: Use after free in media. Reported by Khalil Zhani
    - CVE-2020-16002: Use after free in PDFium. Reported by Weipeng Jiang from
      Codesafe Team of Legendsec at Qi'anxin Group
    - CVE-2020-15999: Heap buffer overflow in Freetype. Reported by Sergei
      Glazunov of Google Project Zero
    - CVE-2020-16003: Use after free in printing. Reported by Khalil Zhani
    - CVE-2020-15967: Use after free in payments. Reported by Man Yue Mo of
      GitHub Security Lab
    - CVE-2020-15968: Use after free in Blink. Reported by Anonymous
    - CVE-2020-15969: Use after free in WebRTC. Reported by Anonymous
    - CVE-2020-15970: Use after free in NFC. Reported by Man Yue Mo of GitHub
      Security Lab
    - CVE-2020-15971: Use after free in printing. Reported by Jun Kokatsu,
      Microsoft Browser Vulnerability Research
    - CVE-2020-15972: Use after free in audio. Reported by Anonymous
    - CVE-2020-15990: Use after free in autofill. Reported by Rong Jian and
      Guang Gong of Alpha Lab, Qihoo 360
    - CVE-2020-15991: Use after free in password manager. Reported by Rong Jian
      and Guang Gong of Alpha Lab, Qihoo 360
    - CVE-2020-15973: Insufficient policy enforcement in extensions. Reported
      by David Erceg
    - CVE-2020-15974: Integer overflow in Blink. Reported by Juno Im of Theori
    - CVE-2020-15975: Integer overflow in SwiftShader. Reported by Anonymous
    - CVE-2020-15976: Use after free in WebXR. Reported by YoungJoo Lee
      @ashuu_lee of Raon Whitehat
    - CVE-2020-6557: Inappropriate implementation in networking. Reported by
      Matthias Gierlings and Marcus Brinkmann
    - CVE-2020-15977: Insufficient data validation in dialogs. Reported by
      Narendra Bhati
    - CVE-2020-15978: Insufficient data validation in navigation. Reported by
      Luan Herrera @lbherrera_
    - CVE-2020-15979: Inappropriate implementation in V8. Reported by Avihay
      Cohen @ SeraphicAlgorithms
    - CVE-2020-15980: Insufficient policy enforcement in Intents. Reported by
      Yongke Wang @Rudykewang and Aryb1n @aryb1n of Tencent Security Xuanwu Lab
    - CVE-2020-15981: Out of bounds read in audio. Reported by Christoph
      Guttandin
    - CVE-2020-15982: Side-channel information leakage in cache. Reported by
      Luan Herrera @lbherrera_
    - CVE-2020-15983: Insufficient data validation in webUI. Reported by Jun
      Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2020-15984: Insufficient policy enforcement in Omnibox. Reported by
      Rayyan Bijoora
    - CVE-2020-15985: Inappropriate implementation in Blink. Reported by
      Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research
    - CVE-2020-15986: Integer overflow in media. Reported by Mark Brand of
      Google Project Zero
    - CVE-2020-15987: Use after free in WebRTC. Reported by Philipp Hancke
    - CVE-2020-15992: Insufficient policy enforcement in networking. Reported
      by Alison Huffman, Microsoft Browser Vulnerability Research
    - CVE-2020-15988: Insufficient policy enforcement in downloads. Reported by
      Samuel Attard
    - CVE-2020-15989: Uninitialized Use in PDFium. Reported by Gareth Evans
    - CVE-2020-15960: Out of bounds read in storage. Reported by Anonymous
    - CVE-2020-15961: Insufficient policy enforcement in extensions. Reported
      by David Erceg
    - CVE-2020-15962: Insufficient policy enforcement in serial. Reported by
      Leecraso and Guang Gong of 360 Alpha Lab working with 360 BugCloud
    - CVE-2020-15963: Insufficient policy enforcement in extensions. Reported
      by David Erceg
    - CVE-2020-15965: Out of bounds write in V8. Reported by Lucas Pinheiro,
      Microsoft Browser Vulnerability Research
    - CVE-2020-15966: Insufficient policy enforcement in extensions. Reported
      by David Erceg
    - CVE-2020-15964: Insufficient data validation in media. Reported by Woojin
      Oh @pwn_expoit of STEALIEN
    - CVE-2020-6573: Use after free in video. Reported by Leecraso and Guang
      Gong of 360 Alpha Lab working with 360 BugCloud
    - CVE-2020-6574: Insufficient policy enforcement in installer. Reported by
      CodeColorist of Ant-Financial LightYear Labs
    - CVE-2020-6575: Race in Mojo. Reported by Microsoft
    - CVE-2020-6576: Use after free in offscreen canvas. Reported by Looben
      Yang
    - CVE-2020-15959: Insufficient policy enforcement in networking. Reported
      by Eric Lawrence of Microsoft
    - CVE-2020-6558: Insufficient policy enforcement in iOS. Reported by Alison
      Huffman, Microsoft Browser Vulnerability Research
    - CVE-2020-6559: Use after free in presentation API. Reported by Liu Wei
      and Wu Zekai of Tencent Security Xuanwu Lab
    - CVE-2020-6560: Insufficient policy enforcement in autofill. Reported by
      Nadja Ungethuem from www.unnex.de
    - CVE-2020-6561: Inappropriate implementation in Content Security Policy.
      Reported by Rob Wu
    - CVE-2020-6562: Insufficient policy enforcement in Blink. Reported by
      Masato Kinugawa
    - CVE-2020-6563: Insufficient policy enforcement in intent handling.
      Reported by Pedro Oliveira
    - CVE-2020-6564: Incorrect security UI in permissions. Reported by Khalil
      Zhani
    - CVE-2020-6565: Incorrect security UI in Omnibox. Reported by Khalil Zhani
    - CVE-2020-6566: Insufficient policy enforcement in media. Reported by Jun
      Kokatsu, Microsoft Browser Vulnerability Research
    - CVE-2020-6567: Insufficient validation of untrusted input in command line
      handling. Reported by Joshua Graham of TSS
    - CVE-2020-6568: Insufficient policy enforcement in intent handling.
      Reported by Yongke Wang @Rudykewang and Aryb1n @aryb1n of Tencent
      Security Xuanwu Lab
    - CVE-2020-6569: Integer overflow in WebUSB. Reported by guaixiaomei
    - CVE-2020-6570: Side-channel information leakage in WebRTC. Reported by
      Signal/Tenable
    - CVE-2020-6571: Incorrect security UI in Omnibox. Reported by Rayyan
      Bijoora
    - CVE-2020-6556: Heap buffer overflow in SwiftShader. Reported by Alison
      Huffman, Microsoft Browser Vulnerability Research
    - CVE-2020-6542: Use after free in ANGLE. Reported by Piotr Bania of Cisco
      Talos
    - CVE-2020-6543: Use after free in task scheduling. Reported by Looben Yang
    - CVE-2020-6544: Use after free in media. Reported by Tim Becker of Theori
    - CVE-2020-6545: Use after free in audio. Reported by Anonymous
    - CVE-2020-6546: Inappropriate implementation in installer. Reported by
      Andrew Hess
    - CVE-2020-6547: Incorrect security UI in media. Reported by David Albert
    - CVE-2020-6548: Heap buffer overflow in Skia. Reported by Choongwoo Han,
      Microsoft Browser Vulnerability Research
    - CVE-2020-6549: Use after free in media. Reported by Sergei Glazunov of
      Google Project Zero
    - CVE-2020-6550: Use after free in IndexedDB. Reported by Sergei Glazunov
      of Google Project Zero
    - CVE-2020-6551: Use after free in WebXR. Reported by Sergei Glazunov of
      Google Project Zero
    - CVE-2020-6552: Use after free in Blink. Reported by Tim Becker of Theori
    - CVE-2020-6553: Use after free in offline mode. Reported by Alison
      Huffman, Microsoft Browser Vulnerability Research
    - CVE-2020-6554: Use after free in extensions. Reported by Anonymous
    - CVE-2020-6555: Out of bounds read in WebGL. Reported by Marcin Towalski
      of Cisco Talos

 -- Michel Le Bihan <michel@lebihan.pl>  Tue, 01 Dec 2020 00:00:00 +0000

chromium (84.0.4147.105-1) experimental; urgency=medium

  * New upstream security release.
    - CVE-2020-6537: Type Confusion in V8. Reported by Rong Jian and Guang Gong
    - CVE-2020-6532: Use after free in SCTP. Reported by Anonymous
    - CVE-2020-6538: Inappropriate implementation in WebView. Reported by
      Yongke Wang and Aryb1n
    - CVE-2020-6539: Use after free in CSS. Reported by Oriol Brufau
    - CVE-2020-6540: Heap buffer overflow in Skia. Reported by Zhen Zhou
    - CVE-2020-6541: Use after free in WebUSB. Reported by Sergei Glazunov

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 01 Aug 2020 03:00:31 +0000

chromium (84.0.4147.89-1) experimental; urgency=medium

  * New upstream stable release.
    - CVE-2020-6510: Heap buffer overflow in background fetch. Reported by
      Leecraso and Guang Gong
    - CVE-2020-6511: Side-channel information leakage in content security
      policy. Reported by Mikhail Oblozhikhin
    - CVE-2020-6512: Type Confusion in V8. Reported by nocma, leogan, cheneyxu
    - CVE-2020-6513: Heap buffer overflow in PDFium. Reported by Aleksandar
      Nikolic
    - CVE-2020-6514: Inappropriate implementation in WebRTC. Reported by
      Natalie Silvanovich
    - CVE-2020-6515: Use after free in tab strip. Reported by DDV_UA
    - CVE-2020-6516: Policy bypass in CORS. Reported by Yongke Wang and Aryb1n
    - CVE-2020-6517: Heap buffer overflow in history. Reported by ZeKai Wu
    - CVE-2020-6518: Use after free in developer tools. Reported by David Erceg
    - CVE-2020-6519: Policy bypass in CSP. Reported by Gal Weizman
    - CVE-2020-6520: Heap buffer overflow in Skia. Reported by Zhen Zhou
    - CVE-2020-6521: Side-channel information leakage in autofill. Reported by
      Xu Lin, Panagiotis Ilia, Jason Polakis
    - CVE-2020-6522: Inappropriate implementation in external protocol
      handlers. Reported by Eric Lawrence
    - CVE-2020-6523: Out of bounds write in Skia. Reported by Liu Wei and Wu
      Zekai
    - CVE-2020-6524: Heap buffer overflow in WebAudio. Reported by Sung Ta
    - CVE-2020-6525: Heap buffer overflow in Skia. Reported by Zhen Zhou
    - CVE-2020-6526: Inappropriate implementation in iframe sandbox. Reported
      by Jonathan Kingston
    - CVE-2020-6527: Insufficient policy enforcement in CSP. Reported by Zhong
      Zhaochen
    - CVE-2020-6528: Incorrect security UI in basic auth. Reported by Rayyan
      Bijoora
    - CVE-2020-6529: Inappropriate implementation in WebRTC. Reported by
      kaustubhvats7
    - CVE-2020-6530: Out of bounds memory access in developer tools. Reported
      by myvyang
    - CVE-2020-6531: Side-channel information leakage in scroll to text.
      Reported by Jun Kokatsu
    - CVE-2020-6533: Type Confusion in V8. Reported by Avihay Cohen
    - CVE-2020-6534: Heap buffer overflow in WebRTC. Reported by Anonymous
    - CVE-2020-6535: Insufficient data validation in WebUI. Reported by Jun
      Kokatsu
    - CVE-2020-6536: Incorrect security UI in PWAs. Reported by Zhiyang Zeng
  * Update information in debian/copyright.
  * Include more upstream metadata information.

 -- Michael Gilbert <mgilbert@debian.org>  Sun, 26 Jul 2020 15:21:41 +0000

chromium (83.0.4103.116-3.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add 64-bit time syscalls to syscall whitelist and clock selection
    parameter filtering code
  * Switch to explicitly versioned python2
    + Update build-depends
    + Replace references to /usr/bin/python and to env python
      with /usr/bin/python2 and env python2
    + make exec_script in gn use python2
    + add code in debian/rules clean to set the shebang in
      third_party/closure_compiler/compiler.py it seems someting in the upstream
      build system sometimes resets it.

 -- Peter Michael Green <plugwash@debian.org>  Tue, 15 Sep 2020 13:10:35 +0000

chromium (83.0.4103.116-3) unstable; urgency=high

  * Fix crashes when a connection error occurs (closes: #963548).
    - Thank you so much to Riku Voipio.

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 11 Jul 2020 14:56:34 +0000

chromium (83.0.4103.116-2) unstable; urgency=medium

  * Fix crashes due to ffmpeg 4.3 (closes: #963035).

 -- Michael Gilbert <mgilbert@debian.org>  Mon, 29 Jun 2020 10:28:15 +0000

chromium (83.0.4103.116-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6509: Use after free in extensions. Reported by Anonymous

 -- Michael Gilbert <mgilbert@debian.org>  Mon, 22 Jun 2020 19:45:51 +0000

chromium (83.0.4103.106-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6493: Use after free in WebAuthentication. Reported by Anonymous
    - CVE-2020-6494: Incorrect security UI in payments. Reported by Juho
      Nurminen
    - CVE-2020-6495: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2020-6496: Use after free in payments. Reported by Khalil Zhani
    - CVE-2020-6497: Insufficient policy enforcement in Omnibox. Reported by
      Rayyan Bijoora
    - CVE-2020-6498: Incorrect security UI in progress display. Reported by
      Rayyan Bijoora
    - CVE-2020-6505: Use after free in speech. Reported by Khalil Zhani
    - CVE-2020-6506: Insufficient policy enforcement in WebView. Reported by
      Alesandro Ortiz
    - CVE-2020-6507: Out of bounds write in V8. Reported by Sergei Glazunov
  * Conflict with ffmpeg 4.3 (closes: #963080).
  * Support building with icu 67 (closes: #960236).
  * Support building with re2 20200501 (closes: #960361).

 -- Michael Gilbert <mgilbert@debian.org>  Fri, 19 Jun 2020 00:40:28 +0000

chromium (83.0.4103.83-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2020-6457: Use after free in speech recognizer. Reported by Leecraso
      and Guang Gong
    - CVE-2020-6458: Out of bounds read and write in PDFium. Reported by
      Aleksandar Nikolic
    - CVE-2020-6459: Use after free in payments. Reported by Zhe Jin
    - CVE-2020-6460: Insufficient data validation in URL formatting. Reported
      by Anonymous
    - CVE-2020-6461: Use after free in storage. Reported by Zhe Jin
    - CVE-2020-6462: Use after free in task scheduling. Reported by Zhe Jin
    - CVE-2020-6463: Use after free in ANGLE. Reported by Pawel Wylecial
    - CVE-2020-6464: Type Confusion in Blink. Reported by Looben Yang
    - CVE-2020-6465: Use after free in reader mode. Reported by Woojin Oh
    - CVE-2020-6466: Use after free in media. Reported by Zhe Jin
    - CVE-2020-6467: Use after free in WebRTC. Reported by ZhanJia Song
    - CVE-2020-6468: Type Confusion in V8. Reported by Chris Salls and Jake
      Corina
    - CVE-2020-6469: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2020-6470: Insufficient validation of untrusted input in clipboard.
      Reported by Michał Bentkowski
    - CVE-2020-6471: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2020-6472: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2020-6473: Insufficient policy enforcement in Blink. Reported by
      Soroush Karami and Panagiotis Ilia
    - CVE-2020-6474: Use after free in Blink. Reported by Zhe Jin
    - CVE-2020-6475: Incorrect security UI in full screen. Reported by Khalil
      Zhani
    - CVE-2020-6476: Insufficient policy enforcement in tab strip. Reported by
      Alexandre Le Borgne
    - CVE-2020-6478: Inappropriate implementation in full screen. Reported by
      Khalil Zhani
    - CVE-2020-6479: Inappropriate implementation in sharing. Reported by Zhong
      Zhaochen
    - CVE-2020-6480: Insufficient policy enforcement in enterprise. Reported by
      Marvin Witt
    - CVE-2020-6481: Insufficient policy enforcement in URL formatting.
      Reported by Rayyan Bijoora
    - CVE-2020-6482: Insufficient policy enforcement in developer tools.
      Reported by Abdulrahman Alqabandi
    - CVE-2020-6483: Insufficient policy enforcement in payments. Reported by
      Jun Kokatsu
    - CVE-2020-6484: Insufficient data validation in ChromeDriver. Reported by
      Artem Zinenko
    - CVE-2020-6485: Insufficient data validation in media router. Reported by
      Sergei Glazunov
    - CVE-2020-6486: Insufficient policy enforcement in navigations. Reported
      by David Erceg
    - CVE-2020-6487: Insufficient policy enforcement in downloads. Reported by
      Jun Kokatsu
    - CVE-2020-6488: Insufficient policy enforcement in downloads. Reported by
      David Erceg
    - CVE-2020-6489: Inappropriate implementation in developer tools. Reported
      by @lovasoa
    - CVE-2020-6490: Insufficient data validation in loader. Reported by
      Twitter
    - CVE-2020-6491: Incorrect security UI in site information. Reported by
      Sultan Haikal
    - CVE-2020-6831: Stack buffer overflow in SCTP. Reported by Natalie
      Silvanovich

 -- Michael Gilbert <mgilbert@debian.org>  Thu, 18 Jun 2020 02:05:11 +0000

chromium (81.0.4044.92-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2020-6423: Use after free in audio. Reported by Anonymous
    - CVE-2020-6430: Type Confusion in V8. Reported by Avihay Cohen
    - CVE-2020-6431: Insufficient policy enforcement in full screen. Reported
      by Luan Herrera
    - CVE-2020-6432: Insufficient policy enforcement in navigations. Reported
      by David Erceg
    - CVE-2020-6433: Insufficient policy enforcement in extensions. Reported by
      David Erceg
    - CVE-2020-6434: Use after free in devtools. Reported by HyungSeok Han
    - CVE-2020-6435: Insufficient policy enforcement in extensions. Reported by
      Sergei Glazunov
    - CVE-2020-6436: Use after free in window management. Reported by Igor
      Bukanov
    - CVE-2020-6437: Inappropriate implementation in WebView. Reported by Jann
      Horn
    - CVE-2020-6438: Insufficient policy enforcement in extensions. Reported by
      Ng Yik Phang
    - CVE-2020-6439: Insufficient policy enforcement in navigations. Reported
      by remkoboonstra
    - CVE-2020-6440: Inappropriate implementation in extensions. Reported by
      David Erceg
    - CVE-2020-6441: Insufficient policy enforcement in omnibox. Reported by
      David Erceg
    - CVE-2020-6442: Inappropriate implementation in cache. Reported by B@rMey
    - CVE-2020-6443: Insufficient data validation in developer tools. Reported
      by @lovasoa
    - CVE-2020-6444: Uninitialized use in WebRTC. Reported by mlfbrown
    - CVE-2020-6445: Insufficient policy enforcement in trusted types. Reported
      by Jun Kokatsu
    - CVE-2020-6446: Insufficient policy enforcement in trusted types. Reported
      by Jun Kokatsu
    - CVE-2020-6447: Inappropriate implementation in developer tools. Reported
      by David Erceg
    - CVE-2020-6448: Use after free in V8. Reported by Guang Gong
    - CVE-2020-6454: Use after free in extensions. Reported by leecraso and
      Guang Gong
    - CVE-2020-6455: Out of bounds read in WebSQL. Reported by Nan Wang and
      Guang Gong
    - CVE-2020-6456: Insufficient validation of untrusted input in clipboard.
      Reported by Michał Bentkowski

 -- Michael Gilbert <mgilbert@debian.org>  Tue, 07 Apr 2020 23:05:20 +0000

chromium (80.0.3987.162-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6450: Use after free in WebAudio. Reported by Man Yue Mo
    - CVE-2020-6451: Use after free in WebAudio. Reported by Man Yue Mo
    - CVE-2020-6452: Heap buffer overflow in media. Reported by asnine

 -- Michael Gilbert <mgilbert@debian.org>  Wed, 01 Apr 2020 04:30:14 +0000

chromium (80.0.3987.149-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2019-20503: Out of bounds read in usersctplib. Reported by Natalie
      Silvanovich
    - CVE-2020-6422: Use after free in WebGL. Reported by David Manouchehri
    - CVE-2020-6424: Use after free in media. Reported by Sergei Glazunov
    - CVE-2020-6425: Insufficient policy enforcement in extensions. Reported by
      Sergei Glazunov
    - CVE-2020-6426: Inappropriate implementation in V8. Reported by Avihay
      Cohen
    - CVE-2020-6427: Use after free in audio. Reported by Man Yue Mo
    - CVE-2020-6428: Use after free in audio. Reported by Man Yue Mo
    - CVE-2020-6429: Use after free in audio. Reported by Man Yue Mo
    - CVE-2020-6449: Use after free in audio. Reported by Man Yue Mo

 -- Michael Gilbert <mgilbert@debian.org>  Fri, 20 Mar 2020 00:18:06 +0000

chromium (80.0.3987.132-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6420: Insufficient policy enforcement in media. Reported by
      Taras Uzdenov

 -- Michael Gilbert <mgilbert@debian.org>  Fri, 06 Mar 2020 16:40:19 +0000

chromium (80.0.3987.122-2) unstable; urgency=medium

  * Reduce debugging symbols to avoid memory exhaustion while linking.

 -- Michael Gilbert <mgilbert@debian.org>  Tue, 03 Mar 2020 04:15:34 +0000

chromium (80.0.3987.122-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6407: Out of bounds memory access in streams. Reported by
      Sergei Glazunov
    - CVE-2020-6418: Type confusion in V8. Reported by Clement Lecigne

 -- Michael Gilbert <mgilbert@debian.org>  Sun, 01 Mar 2020 01:25:59 +0000

chromium (80.0.3987.116-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6383: Type confusion in V8. Reported by Sergei Glazunov
    - CVE-2020-6384: Use after free in WebAudio. Reported by David Manouchehri
    - CVE-2020-6386: Use after free in speech. Reported by Zhe Jin

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 22 Feb 2020 03:01:15 +0000

chromium (80.0.3987.106-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2019-19923: Out of bounds memory access in SQLite. Reported by
      Richard Lorenz
    - CVE-2019-19925: Vulnerability in SQLite. Reported by Richard Lorenz
    - CVE-2019-19926: Inappropriate implementation in SQLite. Reported by
      Richard Lorenz
    - CVE-2019-19880: Vulnerability in SQLite. Reported by Richard Lorenz
    - CVE-2020-6381: Integer overflow in JavaScript. Reported by The UK's
      National Cyber Security Centre
    - CVE-2020-6382: Type Confusion in JavaScript. Reported by Soyeon Park and
      Wen Xu
    - CVE-2020-6385: Insufficient policy enforcement in storage. Reported by
      Sergei Glazunov
    - CVE-2020-6387: Out of bounds write in WebRTC. Reported by Natalie
      Silvanovich
    - CVE-2020-6388: Out of bounds memory access in WebAudio. Reported by
      Sergei Glazunov
    - CVE-2020-6389: Out of bounds write in WebRTC. Reported by Natalie
      Silvanovich
    - CVE-2020-6390: Out of bounds memory access in streams. Reported by Sergei
      Glazunov
    - CVE-2020-6391: Insufficient validation of untrusted input in Blink.
      Reported by Michał Bentkowski
    - CVE-2020-6392: Insufficient policy enforcement in extensions. Reported by
      Microsoft Edge Team
    - CVE-2020-6393: Insufficient policy enforcement in Blink. Reported by Mark
      Amery
    - CVE-2020-6394: Insufficient policy enforcement in Blink. Reported by Phil
      Freo
    - CVE-2020-6395: Out of bounds read in JavaScript. Reported by Pierre
      Langlois
    - CVE-2020-6396: Inappropriate implementation in Skia. Reported by William
      Luc Ritchie
    - CVE-2020-6397: Incorrect security UI in sharing. Reported by Khalil Zhani
    - CVE-2020-6398: Uninitialized use in PDFium. Reported by pdknsk
    - CVE-2020-6399: Insufficient policy enforcement in AppCache. Reported by
      Luan Herrera
    - CVE-2020-6400: Inappropriate implementation in CORS. Reported by Takashi
      Yoneuchi
    - CVE-2020-6401: Insufficient validation of untrusted input in Omnibox.
      Reported by Tzachy Horesh
    - CVE-2020-6402: Insufficient policy enforcement in downloads. Reported by
      Vladimir Metnew
    - CVE-2020-6403: Incorrect security UI in Omnibox. Reported by Khalil Zhani
    - CVE-2020-6404: Inappropriate implementation in Blink. Reported by kanchi
    - CVE-2020-6405: Out of bounds read in SQLite. Reported by Yongheng Chen
      and Rui Zhong
    - CVE-2020-6406: Use after free in audio. Reported by Sergei Glazunov
    - CVE-2020-6408: Insufficient policy enforcement in CORS. Reported by Zhong
      Zhaochen
    - CVE-2020-6409: Inappropriate implementation in Omnibox. Reported by
      Divagar S and Bharathi V
    - CVE-2020-6410: Insufficient policy enforcement in navigation. Reported by
      evi1m0
    - CVE-2020-6411: Insufficient validation of untrusted input in Omnibox.
      Reported by Khalil Zhani
    - CVE-2020-6412: Insufficient validation of untrusted input in Omnibox.
      Reported by Zihan Zheng
    - CVE-2020-6413: Inappropriate implementation in Blink. Reported by Michał
      Bentkowski
    - CVE-2020-6414: Insufficient policy enforcement in Safe Browsing. Reported
      by Lijo A.T
    - CVE-2020-6415: Inappropriate implementation in JavaScript. Reported by
      Avihay Cohen
    - CVE-2020-6416: Insufficient data validation in streams. Reported by
      Woojin Oh
    - CVE-2020-6417: Inappropriate implementation in installer. Reported by
      Renato Moraes and Altieres Rohr
  * Remove --ignore-gpu-blacklist from the default flags (closes: #947207).
  * Update standards version to 4.5.0.
  * Build with clang instead of gcc.

 -- Michael Gilbert <mgilbert@debian.org>  Sun, 16 Feb 2020 23:33:50 +0000

chromium (79.0.3945.130-2) unstable; urgency=medium

  * Add libx11-xcb-dev as a build dependency.

 -- Michael Gilbert <mgilbert@debian.org>  Sun, 19 Jan 2020 08:42:14 +0000

chromium (79.0.3945.130-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2020-6377: Use after free in audio. Reported by Zhe Jin
    - CVE-2020-6378: Use-after-free in speech recognizer. Reported by Antti
      Levomäki and Christian Jalio
    - CVE-2020-6379: Use-after-free in speech recognizer. Reported by Guang
      Gong
    - CVE-2020-6380: Extension message verification error. Reported by Sergei
      Glazunov
    - CVE-2019-13767: Use after free in media picker. Reported by Sergei
      Glazunov
  * Fix memory instrumentation singleton initialization errors caused by
    tracing patch included in the previous upload (closes: #945920).

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 18 Jan 2020 20:26:26 +0000

chromium (79.0.3945.79-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2019-13725: Use after free in Bluetooth. Reported by Gengming Liu and
      Jianyu Chen
    - CVE-2019-13726: Heap buffer overflow in password manager. Reported by
      Sergei Glazunov
    - CVE-2019-13727: Insufficient policy enforcement in WebSockets. Reported
      by @piochu
    - CVE-2019-13728: Out of bounds write in V8. Reported by Rong Jian and
      Guang Gong
    - CVE-2019-13729: Use after free in WebSockets. Reported by Zhe Jin
    - CVE-2019-13730: Type Confusion in V8. Reported by Soyeon Park and Wen Xu
    - CVE-2019-13732: Use after free in WebAudio. Reported by Sergei Glazunov
    - CVE-2019-13734: Out of bounds write in SQLite. Reported by Wenxiang Qian
    - CVE-2019-13735: Out of bounds write in V8. Reported by Gengming Liu and
      Zhen Feng
    - CVE-2019-13764: Type Confusion in V8. Reported by Soyeon Park and Wen Xu
    - CVE-2019-13736: Integer overflow in PDFium. Reported by Anonymous
    - CVE-2019-13737: Insufficient policy enforcement in autocomplete. Reported
      by Mark Amery
    - CVE-2019-13738: Insufficient policy enforcement in navigation. Reported
      by Johnathan Norman and Daniel Clark
    - CVE-2019-13739: Incorrect security UI in Omnibox. Reported by xisigr
    - CVE-2019-13740: Incorrect security UI. Reported by Khalil Zhani
    - CVE-2019-13741: Insufficient validation of untrusted input in Blink.
      Reported by Michał Bentkowski
    - CVE-2019-13742: Incorrect security UI in Omnibox. Reported by Khalil
      Zhani
    - CVE-2019-13743: Incorrect security UI in external protocol handling.
      Reported by Zhiyang Zeng
    - CVE-2019-13744: Insufficient policy enforcement in cookies. Reported by
      Prakash
    - CVE-2019-13745: Insufficient policy enforcement in audio. Reported by
      Luan Herrera
    - CVE-2019-13746: Insufficient policy enforcement in Omnibox. Reported by
      David Erceg
    - CVE-2019-13747: Uninitialized Use in rendering. Reported by Ivan
      Popelyshev and André Bonatti
    - CVE-2019-13748: Insufficient policy enforcement in developer tools.
      Reported by David Erceg
    - CVE-2019-13749: Incorrect security UI in Omnibox. Reported by Khalil
      Zhani
    - CVE-2019-13750: Insufficient data validation in SQLite. Reported by
      Wenxiang Qian
    - CVE-2019-13751: Uninitialized Use in SQLite. Reported by Wenxiang Qian
    - CVE-2019-13752: Out of bounds read in SQLite. Reported by Wenxiang Qian
    - CVE-2019-13753: Out of bounds read in SQLite. Reported by Wenxiang Qian
    - CVE-2019-13754: Insufficient policy enforcement in extensions. Reported
      by Cody Crews
    - CVE-2019-13755: Insufficient policy enforcement in extensions. Reported
      by Masato Kinugawa
    - CVE-2019-13756: Incorrect security UI in printing. Reported by Khalil
      Zhani
    - CVE-2019-13757: Incorrect security UI in Omnibox. Reported by Khalil
      Zhani
    - CVE-2019-13758: Insufficient policy enforcement in navigation. Reported
      by Khalil Zhani
    - CVE-2019-13759: Incorrect security UI. Reported by Wenxu Wu
    - CVE-2019-13761: Incorrect security UI in Omnibox. Reported by Khalil
      Zhani
    - CVE-2019-13762: Insufficient policy enforcement in downloads. Reported by
      csanuragjain
    - CVE-2019-13763: Insufficient policy enforcement in payments. Reported by
      weiwangpp93

 -- Michael Gilbert <mgilbert@debian.org>  Thu, 12 Dec 2019 04:36:09 +0000

chromium (79.0.3945.56-1) experimental; urgency=medium

  * New upstream beta release.
  * Update standards version to 4.4.1.
  * Ignore the gpu blacklist by default again.

 -- Michael Gilbert <mgilbert@debian.org>  Wed, 27 Nov 2019 23:59:29 +0000

chromium (78.0.3904.108-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2019-13723: Use-after-free in Bluetooth. Reported by Yuxiang Li
    - CVE-2019-13724: Out-of-bounds in Bluetooth. Reported by Yuxiang Li
  * Disable vaapi on armhf (closes: #944627).

 -- Michael Gilbert <mgilbert@debian.org>  Wed, 20 Nov 2019 23:46:06 +0000

chromium (78.0.3904.97-1) unstable; urgency=medium

  * New upstream security release.
  * Enable vaapi (closes: #940074).
  * Fix crash during profile manager shutdown.
  * Drop libglewmx-dev build dependency (closes: #941050).

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 09 Nov 2019 03:33:52 +0000

chromium (78.0.3904.87-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2019-5869: Use-after-free in Blink. Reported by Zhe Jin
    - CVE-2019-5870: Use-after-free in media. Reported by Guang Gong
    - CVE-2019-5871: Heap overflow in Skia. Reported by Anonymous
    - CVE-2019-5872: Use-after-free in Mojo. Reported by Zhe Jin
    - CVE-2019-5874: External URIs may trigger other browsers. Reported by
      James Lee
    - CVE-2019-5875: URL bar spoof. Reported by Khalil
      Zhani
    - CVE-2019-5876: Use-after-free in media. Reported by Man Yue Mo
    - CVE-2019-5877: Out-of-bounds access in V8. Reported by Guang Gong
    - CVE-2019-5878: Use-after-free in V8. Reported by Guang Gong
    - CVE-2019-5879: Extensions can read some local files. Reported by Jinseo
      Kim
    - CVE-2019-5880: SameSite cookie bypass. Reported by Jun Kokatsu
    - CVE-2019-13659: URL spoof. Reported by Lnyas Zhang
    - CVE-2019-13660: Full screen notification overlap. Reported by Wenxu Wu
    - CVE-2019-13661: Full screen notification spoof. Reported by Wenxu Wu
    - CVE-2019-13662: CSP bypass. Reported by David Erceg
    - CVE-2019-13663: IDN spoof. Reported by Lnyas Zhang
    - CVE-2019-13664: CSRF bypass. Reported by thomas "zemnmez" shadwell
    - CVE-2019-13665: Multiple file download protection bypass. Reported by
      Jun Kokatsu
    - CVE-2019-13666: Side channel using storage size estimate. Reported by
      Tom Van Goethem
    - CVE-2019-13667: URI bar spoof when using external app URIs. Reported by
      Khalil Zhani
    - CVE-2019-13668: Global window leak via console. Reported by David Erceg
    - CVE-2019-13669: HTTP authentication spoof. Reported by Khalil Zhani
    - CVE-2019-13670: V8 memory corruption in regex. Reported by Guang Gong
    - CVE-2019-13671: Dialog box fails to show origin. Reported by xisigr
    - CVE-2019-13673: Cross-origin information leak using devtools. Reported
      by David Erceg
    - CVE-2019-13674: IDN spoofing. Reported by Khalil Zhani
    - CVE-2019-13675: Extensions can be disabled by trailing slash. Reported
      by Jun Kokatsu
    - CVE-2019-13676: Google URI shown for certificate warning. Reported by
      Wenxu Wu
    - CVE-2019-13677: Chrome web store origin needs to be isolated. Reported
      by Jun Kokatsu
    - CVE-2019-13678: Download dialog spoofing. Reported by Ronni Skansing
    - CVE-2019-13679: User gesture needed for printing. Reported by Conrad
      Irwin
    - CVE-2019-13680: IP address spoofing to servers. Reported by Thijs
      Alkemade
    - CVE-2019-13681: Bypass on download restrictions. Reported by David Erceg
    - CVE-2019-13682: Site isolation bypass. Reported by Jun Kokatsu
    - CVE-2019-13683: Exceptions leaked by devtools. Reported by David Erceg
    - CVE-2019-13685: Use-after-free in UI. Reported by Khalil Zhani
    - CVE-2019-13686: Use-after-free in offline pages. Reported by Brendon
    - CVE-2019-13687: Use-after-free in media. Reported by Man Yue Mo
    - CVE-2019-13688: Use-after-free in media. Reported by Man Yue Mo
      Tiszka
    - CVE-2019-13691: Omnibox spoof. Reported by David Erceg
    - CVE-2019-13692: SOP bypass. Reported by Jun Kokatsu
    - CVE-2019-13693: Use-after-free in IndexedDB. Reported by Guang Gong
    - CVE-2019-13694: Use-after-free in WebRTC. Reported by banananapenguin
    - CVE-2019-13695: Use-after-free in audio. Reported by Man Yue Mo
    - CVE-2019-13696: Use-after-free in V8. Reported by Guang Gong
    - CVE-2019-13697: Cross-origin size leak. Reported by Luan Herrera
    - CVE-2019-13699: Use-after-free in media. Reported by Man Yue Mo
    - CVE-2019-13700: Buffer overrun in Blink. Reported by Man Yue Mo
    - CVE-2019-13701: URL spoof in navigation. Reported by David Erceg
    - CVE-2019-13702: Privilege elevation in Installer. Reported by Phillip
      Langlois and Edward Torkington
    - CVE-2019-13703: URL bar spoofing. Reported by Khalil Zhani
    - CVE-2019-13704: CSP bypass. Reported by Jun Kokatsu
    - CVE-2019-13705: Extension permission bypass. Reported by Luan Herrera
    - CVE-2019-13706: Out-of-bounds read in PDFium. Reported by pdknsk
    - CVE-2019-13707: File storage disclosure. Reported by Andrea Palazzo
    - CVE-2019-13708: HTTP authentication spoof. Reported by Khalil Zhani
    - CVE-2019-13709: File download protection bypass. Reported by Zhong
      Zhaochen
    - CVE-2019-13710: File download protection bypass. Reported by
      bernardo.mrod
    - CVE-2019-13711: Cross-context information leak. Reported by David Erceg
    - CVE-2019-13713: Cross-origin data leak. Reported by David Erceg
    - CVE-2019-13714: CSS injection. Reported by Jun Kokatsu
    - CVE-2019-13715: Address bar spoofing. Reported by xisigr
    - CVE-2019-13716: Service worker state error. Reported by Barron Hagerman
    - CVE-2019-13717: Notification obscured. Reported by xisigr
    - CVE-2019-13718: IDN spoof. Reported by Khalil Zhani
    - CVE-2019-13719: Notification obscured. Reported by Khalil Zhani
    - CVE-2019-13720: Use-after-free in audio. Reported by Anton Ivanov and
      Alexey Kulaev
    - CVE-2019-13721: Use-after-free in PDFium. Reported by banananapenguin
  * Drop support for building with gcc 6 and gtk 2.

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 02 Nov 2019 22:30:42 +0000

chromium (76.0.3809.100-1) unstable; urgency=medium

  * New upstream security release.
    - CVE-2019-5867: Out-of-bounds read in V8. Reported by Lucas Pinheiro
    - CVE-2019-5868: Use-after-free in PDFium ExecuteFieldAction. Reported by
      banananapenguin

 -- Michael Gilbert <mgilbert@debian.org>  Fri, 09 Aug 2019 19:58:55 +0000

chromium (76.0.3809.87-2) unstable; urgency=medium

  * Fix inverted logic in enum comparison (closes: #933598).

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 03 Aug 2019 14:31:59 +0000

chromium (76.0.3809.87-1) unstable; urgency=medium

  * New upstream stable release.
    - CVE-2019-5847: V8 sealed/frozen elements cause crash. Reported by m3plex
    - CVE-2019-5848: Font sizes may expose sensitive information. Reported by
      Mark Amery
    - CVE-2019-5850: Use-after-free in offline page fetcher. Reported by
      Brendon Tiszka
    - CVE-2019-5851: Use-after-poison in offline audio context. Reported by Zhe
      Jin
    - CVE-2019-5852: Object leak of utility functions. Reported by David Erceg
    - CVE-2019-5853: Memory corruption in regexp length check. Reported by
      yngwei and sakura
    - CVE-2019-5854: Integer overflow in PDFium text rendering. Reported by
      Zhen Zhou
    - CVE-2019-5855: Integer overflow in PDFium. Reported by Zhen Zhou
    - CVE-2019-5856: Insufficient checks on filesystem: URI permissions.
      Reported by Yongke Wang
    - CVE-2019-5857: Comparison of -0 and null yields crash. Reported by
      cloudfuzzer
    - CVE-2019-5858: Insufficient filtering of Open URL service parameters.
      Reported by evi1m0
    - CVE-2019-5859: res: URIs can load alternative browsers. Reported by James
      Lee
    - CVE-2019-5860: Use-after-free in PDFium. Reported by Anonymous
    - CVE-2019-5861: Click location incorrectly checked. Reported by Robin Linus
    - CVE-2019-5862: AppCache not robust to compromised renderers. Reported by
      Jun Kokatsu
    - CVE-2019-5864: Insufficient port filtering in CORS for extensions.
      Reported by Devin Grindle
    - CVE-2019-5865: Site isolation bypass from compromised renderer. Reported
      by Ivan Fratric
  * Use legacy call to avoid error in icu 6.3 (closes: #932049).

 -- Michael Gilbert <mgilbert@debian.org>  Mon, 29 Jul 2019 23:22:44 +0000

chromium (76.0.3809.71-1) unstable; urgency=medium

  * New upstream beta release.
  * Recommend system-config-printer (closes: #929106).
  * Add -fno-delete-null-pointer-checks back into the build flags.

 -- Michael Gilbert <mgilbert@debian.org>  Wed, 24 Jul 2019 22:51:41 +0000

chromium (76.0.3809.62-1) unstable; urgency=medium

  * New upstream beta release.
    - Fixes error restoring multiple profiles on startup (closes: #930469).
  * Update standards version to 4.4.0.

 -- Michael Gilbert <mgilbert@debian.org>  Wed, 10 Jul 2019 23:52:45 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog chromium-driver`.
