## START: Set by rpmautospec ## (rpmautospec version 0.8.4) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: release_number = 2; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} ## END: Set by rpmautospec ## CEF README # This spec file is based on chromium.spec, as CEF is largely a Chromium # wrapper/distribution. To keep things maintainable, the CEF version # attempts to track the chromium version released in Fedora where possible, # and the changes in this file are bracketed in `## CEF` and `## END CEF` # comments. Updates to the underlying Chromium version can be achieved by # merging in the changes to chromium.spec, or by manually re-applying the # CEF changes to the new Chromium spec. ## END CEF # macro for el10 minor version %if 0%{?rhel} == 10 %global rhel_minor_version %(echo %{dist} | sed -n 's/.*el10_\\([0-9]\\+\\).*/\\1/p') %endif # Fix installation issue caused by the hard link in locales %define __os_install_post_hardlink %{nil} %define _lto_cflags %{nil} %global _default_patch_fuzz 2 # enable|disable system build flags %global system_build_flags 0 %global numjobs %{_smp_build_ncpus} # official builds have less debugging and go faster... but we have to shut some things off. %global official_build 1 # enable|disble use_custom_libcxx %global use_custom_libcxx 0 %if 0%{?rhel} # no libcxx in el %global use_custom_libcxx 1 %endif # enable|disble bootstrap %global bootstrap 0 # workaround for old gn on el9, it causes build error: unknown function filter_labels_include() %if 0%{?rhel} == 9 %global bootstrap 1 %endif # Fancy build status, so we at least know, where we are.. # %1 where # %2 what %global build_target() \ export NINJA_STATUS="[%2:%f/%t] " ; \ ninja -j %{numjobs} -C '%1' '%2' # enable|disable chrome_management_service %global build_chrome_management_service 1 %if 0%{?flatpak} %global build_chrome_management_service 0 %endif # enable|disable chromedriver %global build_chromedriver 1 %if 0%{?flatpak} %global build_chromedriver 0 %endif # enable|disable headless client build %global build_headless 1 %if 0%{?flatpak} %global build_headless 0 %endif # set nodejs_version %global nodejs_version v22.22.0 %global system_nodejs 1 # RHEL 9 needs newer nodejs %if 0%{?rhel} == 9 %global system_nodejs 0 %endif # enable gtk4 for fedora and el>9 %global gtk_version 4 %if 0%{?rhel} == 9 %global gtk_version 3 %endif %if 0%{?rhel} == 8 %global chromium_pybin /usr/bin/python3.9 %else %global chromium_pybin %{__python3} %endif # va-api only supported in rhel >= 9 and fedora %global use_vaapi 1 # v4l2_codec only enable for fedora aarch64 %global use_v4l2_codec 0 # libva is too old on el8 %if 0%{?rhel} == 8 %global use_vaapi 0 %endif # enable v4l2 and disable vaapi for aarch64 platform %ifarch aarch64 %if 0%{?fedora} >= 36 %global use_vaapi 0 %global use_v4l2_codec 1 %endif %endif %if 0%{?fedora} >= 40 || 0%{?rhel} >= 9 %global noopenh264 1 %endif # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2239523 # Disable BTI until this is fixed upstream. %global disable_bti 0 %ifarch aarch64 %if 0%{?fedora} %global optflags %(echo %{optflags} | sed 's/-mbranch-protection=standard /-mbranch-protection=pac-ret /') %global disable_bti 1 %endif %endif ## CEF: Configure CEF build arch & default output build dir %ifarch aarch64 %global chromium_arch arm64 %endif %ifarch ppc64le %global chromium_arch ppc64 %endif %ifarch x86_64 %global chromium_arch x64 %endif %global chromebuilddir out/Release_GN_%{chromium_arch} ## END CEF # enable|disable debuginfo ## CEF: Enable debug info to make it possible to debug CEF/consumer issues %global enable_debug 1 ## END CEF # disable debuginfo due to a bug in debugedit on el7 # error: canonicalization unexpectedly shrank by one character # https://bugzilla.redhat.com/show_bug.cgi?id=304121 %if ! %{enable_debug} %global debug_package %{nil} %global debug_level 0 %else %global debug_level 1 # workaround for the error empty file debugsource %undefine _debugsource_packages %endif ## CEF: Install directory for build %global chromium_path %{_libdir}/cef %global cef_wrapper_src_path %{_usrsrc}/%{name}-%{cef_version} ## END CEF # We don't want any libs in these directories to generate Provides # Requires is trickier. # To generate this list, go into %%{buildroot}%%{chromium_path} and run # for i in `find . -name "*.so" | sort`; do NAME=`basename -s .so $i`; printf "$NAME|"; done # for RHEL7, append libfontconfig to the end # make sure there is not a trailing | at the end of the list # We always filter provides. We only filter Requires when building shared. %global __provides_exclude_from ^(%{chromium_path}/.*\\.so|%{chromium_path}/.*\\.so.*)$ %global __requires_exclude ^(%{chromium_path}/.*\\.so|%{chromium_path}/.*\\.so.*)$ # enable|disable control flow integrity support %global cfi 0 %ifarch x86_64 aarch64 %global cfi 1 %endif ## CEF: QT builds are not relevant %global use_qt6 0 %global use_qt5 0 ## END CEF # bundle re2, jsoncpp, woff2 - build errors with use_custom_libcxx=true %global bundlere2 1 %global bundlejsoncpp 1 %global bundlewoff2 1 %global bundlelibaom 1 %global bundlelibavif 1 %global bundlesnappy 1 %global bundlezstd 1 %global bundleicu 1 %global bundledav1d 1 %global bundlebrotli 1 %global bundlelibwebp 1 %global bundlecrc32c 1 %global bundleharfbuzz 1 %global bundlelibpng 1 %global bundlelibjpeg 1 %global bundlefreetype 1 %global bundlelibdrm 1 %global bundlefontconfig 1 %global bundleffmpegfree 1 %global bundlehighway 1 # openjpeg2, need to update to 2.5.x %global bundlelibopenjpeg2 1 %global bundlelibtiff 1 # libxml2, need to update to 2.14.x for bz#2368923 %global bundlelibxml 1 %global bundlepylibs 0 %global bundlelibxslt 0 %global bundleflac 0 %global bundledoubleconversion 0 %global bundlelibXNVCtrl 0 %global bundlelibusbx 0 %global bundlelibsecret 0 %global bundleopus 0 %global bundlelcms2 0 %global bundlesimdutf 1 # workaround for build error # disable bundleminizip for Fedora > 39 due to switch to minizip-ng # disable bundleminizip for epel and Fedora39 due to old minizip version %global bundleminizip 1 %if 0%{?fedora} || 0%{?rhel} > 8 %global bundlezstd 0 %global bundlefontconfig 0 %global bundledav1d 0 %global bundlelibpng 0 %global bundlelibjpeg 0 %global bundlelibdrm 0 %global bundleffmpegfree 0 %global bundlefreetype 0 %if 0%{?fedora} > 41 || 0%{?rhel} > 10 # require libtiff-4.6.1 or newer, error: use of undeclared identifier 'TIFFOpenOptionsSetMaxCumulatedMemAlloc' %global bundlelibtiff 0 %endif %if 0%{?fedora} %global bundlecrc32c 0 %endif %if 0%{?fedora} || 0%{?rhel} > 9 %global bundlelibopenjpeg2 0 %global bundleharfbuzz 0 %global bundlebrotli 0 %global bundlelibwebp 0 %endif %endif ## CEF: Package version & metadata %global chromium_major 151 %global chromium_branch 7922 # Where possible, track Chromium versions already released in Fedora. %global chromium_minor 173 %global chromium_version %{chromium_major}.0.%{chromium_branch}.%{chromium_minor} %global cef_commit 2384915b7b1f0fe5ad1107e48d80c34e86b698d7 %global cef_branch %{chromium_branch} %global cef_minor 0 %global cef_patch 11 %global cef_version %{chromium_major}.%{cef_minor}.%{cef_patch} %global shortcommit %(c=%{cef_commit}; echo ${c:0:7}) Name: cef Version: %{cef_version}^chromium%{chromium_version} Release: %autorelease Summary: Chromium Embedded Framework Url: https://bitbucket.org/chromiumembedded/cef License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only) # For CEF API dynamic spec generation BuildRequires: jq # Tag experimental (unversioned) ABI as the CEF version # Versioned ABI/API tags are generated in mkspec.sh Provides: cef(abi) = %{cef_version} ## END CEF # Use /etc/chromium for initial_prefs Patch1: chromium-115-initial_prefs-etc-path.patch # Try to load widevine from other places Patch8: chromium-117-widevine-other-locations.patch # debian patches # disable font-test Patch20: chromium-disable-font-tests.patch # don't download binary blob Patch21: chromium-123-screen-ai-service.patch # Fix link error when building with system libcxx Patch22: chromium-131-fix-qt-ui.pach # Workaround for build error: ERROR Unresolved dependencies. #//chrome/test:captured_sites_interactive_tests(//build/toolchain/linux/unbundle:default) # needs //third_party/libpng:libpng_for_testonly(//build/toolchain/linux/unbundle:default) Patch23: chromium-143-revert-libpng_for_testonly.patch # patch from Melvin - melvin@pixilab.se Patch24: glibc-2.42-baud-rate-fix.patch # disable enterprise_companion_integration_tests due to Unresolved dependencies Patch31: chromium-145-disable-enterprise_companion_integration_tests.patch # patch for using system brotli Patch89: chromium-142-system-brotli.patch # patch for using system libxml Patch90: chromium-121-system-libxml.patch # patch for using system opus Patch91: chromium-108-system-opus.patch # patch for Failed NodeJS version check Patch92: chromium-138-checkversion-nodejs.patch # fix build error Patch93: chromium-141-csss_style_sheet.patch # revert the patch to fix the build error: "ld.lld: error: undefined symbol: __sanitizer_set_death_callback" Patch94: chromium-148-v8-sanitize-build-error.patch # FTBFS - error: cannot find attribute `sanitize` in this scope # --> ../../third_party/crabbyavif/src/src/capi/io.rs:210:41 # | # 210 | #[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))] Patch96: chromium-142-crabbyavif-ftbfs-old-rust.patch # system ffmpeg # need for old ffmpeg 5.x on epel9 Patch128: chromium-138-el9-ffmpeg-deprecated-apis.patch Patch129: chromium-el9-ffmpeg-AV_CODEC_FLAG_COPY_OPAQUE.patch Patch130: chromium-148-el9-ffmpeg-build-error.patch # disable the check Patch131: chromium-107-proprietary-codecs.patch # fix tab crash with SIGTRAP error when using system ffmpeg Patch132: chromium-118-sigtrap_system_ffmpeg.patch # need for old ffmpeg 6.0/5.x on epel9 and fedora < 40 Patch133: chromium-151-el9-ffmpeg-5.1.x.patch Patch134: chromium-151-el9-build-error-system-ffmpeg5.patch # revert, it causes build error: use of undeclared identifier 'AVFMT_FLAG_NOH264PARSE' Patch135: chromium-133-disable-H.264-video-parser-during-demuxing.patch # Workaround for youtube stop working Patch136: chromium-133-workaround-system-ffmpeg-whitelist.patch # fatal error: 'third_party/ffmpeg/libavutil/rational.h' file not found Patch137: chromium-147-system-ffmpeg.patch # Workaround for missing AVDynamicHDRSmpte2094App5 in system ffmpeg Patch138: chromium-150-ffmpeg-AVDynamicHDRSmpte2094App5.patch # file conflict with old kernel on el8/el9 Patch141: chromium-118-dma_buf_export_sync_file-conflict.patch # Fix FTBFS with rustc-1.88 on el9 and epel10.1 Patch142: chromium-149-rust-1.88-build-error.patch # fix ftbfs caused by old rustc-1.88 on el9 and 10.1 Patch143: chromium-148-rust-1.88-enable-unstable_features.patch Patch144: chromium-146-rust-1.88-undefined-symbol.patch # Fix FTBFS with python-3.9 on el9 Patch146: chromium-148-el9-python-3.9-build-error.patch # add correct path for Qt6Gui header and libs Patch150: chromium-124-qt6.patch # fix FTBFS caused by missing include file on aarch64/ppc64le Patch300: chromium-145-swiftshader-missing-include.patch # Fix error with llwm < 21 on el9/el10.1/f42: invalid application of 'sizeof' to an incomplete type 'gfx::Transform' Patch302: chromium-145-static_assert.patch # Fix error: invalid suffix 'o666' on integer constant on el9/el10.1/f42 with llvm20 Patch303: chromium-146-ftfs-llvm-octal-notation.patch # Workaround for clang++ crash with llvm-20 on el9/el10.1/f42, clang++: error: clang frontend command failed with exit code 139 Patch304: chromium-146-llvm-crash.patch # disable memory tagging (epel8 on aarch64) due to new feature IFUNC-Resolver # it is not supported in old glibc < 2.30, error: fatal error: 'sys/ifunc.h' file not found Patch305: chromium-124-el8-arm64-memory_tagging.patch Patch306: chromium-127-el8-ifunc-header.patch # workaround for build error due to old atk version on el8 Patch307: chromium-134-el8-atk-compiler-error.patch # Fix build errors due to old clang18 in el8 Patch308: chromium-136-unsupport-clang-flags.patch Patch309: chromium-132-el8-unsupport-rustc-flags.patch # Fix rhbz#2387446, FTBFS with rust-1.89.0 Patch310: chromium-139-rust-FTBFS-suppress-warnings.patch # enable fstack-protector-strong Patch311: chromium-123-fstack-protector-strong.patch # Fix FTBFS: undefined symbol: __rust_no_alloc_shim_is_unstable on EL9 # Error: unsafe attribute used without unsafe # --> ../../build/rust/allocator/lib.rs:107:7 Patch312: chromium-143-el9-rust-no-alloc-shim-is-unstable.patch # old rust version causes build error on el8: # error[E0599]: no method named `is_none_or` found for enum `Option` in the current scope Patch314: chromium-136-rust-skrifa-build-error.patch # error with old rustc Patch315: chromium-145-rustc-ftbfs.patch # llvm <= 22 # clang++: error: unknown argument: '-fno-lifetime-dse' # unknown warning option -Wno-nontrivial-memcall Patch316: chromium-151-clang++-unknown-argument.patch Patch318: memory-allocator-dcheck-assert-fix.patch # compile swiftshader against llvm-16.0 Patch319: chromium-143-swiftshader-llvm-16.0.patch # Fix build error on fedora aarch64 Patch320: chromium-149-aarch64-log-error.patch # Replace with system golang Patch321: chromium-151-system-golang.patch # Fix build error caused by Unresolved dependencies Patch322: chromium-151-histograms_xml-build-error.patch # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=2239523 # https://bugs.chromium.org/p/chromium/issues/detail?id=1145581#c60 # Disable BTI until this is fixed upstream. Patch352: chromium-117-workaround_for_crash_on_BTI_capable_system.patch # workaround for build error on aarch64 Patch353: chromium-127-aarch64-duplicate-case-value.patch # remove flag split-threshold-for-reg-with-hint, it's not supported in clang <= 17 Patch354: chromium-142-split-threshold-for-reg-with-hint.patch # fix build error: no member named 'hardware_destructive_interference_size' in namespace 'std' Patch355: chromium-130-hardware_destructive_interference_size.patch # fix build error: # ../../build/modules/linux-x64/module.modulemap:11:12: error: header '../../linux/debian_bullseye_amd64-sysroot/usr/include/alloca.h' not found Patch356: chromium-141-use_libcxx_modules.patch # error: no matching member function for call to 'Append' Patch357: chromium-134-type-mismatch-error.patch # set clang_lib path Patch358: chromium-144-rust-clanglib.patch # fix FTBFS with rustc 1.95 Patch359: chromium-148-rust-1.95-bytemuck-ftbfs.patch # PowerPC64 LE support # Timothy Pearson's patchset # https://gitlab.raptorengineering.com/raptor-engineering-public/chromium/openpower-patches Patch360: add-ppc64-architecture-string.patch Patch361: 0001-sandbox-Enable-seccomp_bpf-for-ppc64.patch Patch376: 0001-third_party-angle-Include-missing-header-cstddef-in-.patch Patch377: 0001-Add-PPC64-support-for-boringssl.patch Patch378: 0001-third_party-libvpx-Disable-vsx-on-ppc64.patch Patch379: 0001-third_party-libvpx-Properly-generate-gni-on-ppc64.patch Patch380: 0001-third_party-pffft-Include-altivec.h-on-ppc64-with-SI.patch Patch381: 0002-Add-PPC64-generated-files-for-boringssl.patch Patch382: 0002-third_party-lss-kernel-structs.patch # error: undefined symbol: llvm::MCAsmInfoXCOFF::MCAsmInfoXCOFF() Patch383: 0001-swiftshader-fix-build.patch Patch384: Rtc_base-system-arch.h-PPC.patch Patch386: 0004-third_party-crashpad-port-curl-transport-ppc64.patch Patch387: HACK-third_party-libvpx-use-generic-gnu.patch Patch389: HACK-debian-clang-disable-base-musttail.patch Patch390: HACK-debian-clang-disable-pa-musttail.patch Patch391: 0001-Add-ppc64-target-to-libaom.patch Patch392: 0001-Add-pregenerated-config-for-libaom-on-ppc64.patch Patch393: 0002-third_party-libvpx-Remove-bad-ppc64-config.patch Patch394: 0003-third_party-libvpx-Add-ppc64-generated-config.patch # Enabling VSX causes artifacts to appear in VP9 videos Patch395: 0004-third_party-libvpx-work-around-ambiguous-vsx.patch # Enable VSX acceleration in Skia. Requires POWER8 or higher. Patch396: skia-vsx-instructions.patch Patch397: 0001-Implement-support-for-ppc64-on-Linux.patch Patch398: 0001-Implement-support-for-PPC64-on-Linux.patch Patch399: 0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.patch Patch401: fix-rustc.patch Patch402: fix-rust-linking.patch Patch403: fix-breakpad-compile.patch Patch405: fix-study-crash.patch Patch407: fix-different-data-layouts.patch Patch408: 0002-Add-ppc64-trap-instructions.patch Patch409: fix-page-allocator-overflow.patch Patch410: 0001-Enable-ppc64-pointer-compression.patch Patch411: dawn-fix-ppc64le-detection.patch Patch412: add-ppc64-architecture-to-extensions.diff # Suppress harmless compiler warning messages that appear on ppc64 due to arch-specific warning flags being passed Patch413: fix-unknown-warning-option-messages.diff Patch415: add-ppc64-pthread-stack-size.patch Patch417: 0001-add-xnn-ppc64el-support.patch Patch418: 0002-regenerate-xnn-buildgn.patch Patch419: 0009-sandbox-ignore-byte-span-error.patch Patch420: 0005-blink-add-audio-vector-support.patch # Fix FTBSF with kernel-7.2.0 (fedora 45 and rhel-11) Patch450: chromium-150-pt_regs-kernel-7.2.0.patch # flatpak sandbox patches from # https://github.com/flathub/org.chromium.Chromium/tree/master/patches/chromium Patch500: flatpak-Add-initial-sandbox-support.patch Patch501: flatpak-Adjust-paths-for-the-sandbox.patch Patch502: flatpak-Expose-Widevine-into-the-sandbox.patch # nodejs patches %if ! %{system_nodejs} Patch510: 0001-Remove-unused-OpenSSL-config.patch Patch511: 0001-fips-disable-options.patch %endif # Patches from ungoogle chromium, https://github.com/ungoogled-software/ungoogled-chromium # remove rollup binary, build with wasm-rollup Patch520: build-with-wasm-rollup.patch Patch521: disable-ai.patch # Upstream patches # Darkmode Patch606: chromium-150-Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode.patch Patch607: chromium-150-Add-AutoDarkModeSVGSizeThreshold-kill-switch-flag.patch ## CEF: CEF-specific fix patches Patch900: cef-no-sysroot.patch Patch901: cef-no-libxml-visibility-patch.patch ## END CEF # Use chromium-latest.py to generate clean tarball from released build tarballs, found here: # http://build.chromium.org/buildbot/official/ # For Chromium Fedora use chromium-latest.py --stable --ffmpegclean --ffmpegarm # If you want to include the ffmpeg arm sources append the --ffmpegarm switch # https://commondatastorage.googleapis.com/chromium-browser-official/chromium-%%{version}.tar.xz ## CEF: Use %%{chromium_version} for tarball name Source0: chromium-%{chromium_version}-clean.tar.xz ## END CEF Source1: README.fedora ## CEF (remove): Config files # Also, only used if you want to reproduce the clean tarball. Source5: clean_ffmpeg.sh Source6: chromium-latest.py Source7: get_free_ffmpeg_source_files.py ## CEF (remove): Test/GNOME sources %if ! %{system_nodejs} # nodejs bundles openssl, but we use the system version in el9 # because openssl contains prohibited code, we remove openssl completely from # the tarball, using the script in Source13 # http://nodejs.org/dist/v${version}/node-${nodejs_version}.tar.gz Source12: node-%{nodejs_version}-stripped.tar.gz Source13: nodejs-sources.sh BuildRequires: openssl-devel %endif ## CEF: CEF-specific sources Source22: https://github.com/chromiumembedded/cef/archive/%{cef_commit}.tar.gz Source23: mkspec.sh Source24: FindCEF.cmake ## END CEF BuildRequires: golang BuildRequires: clang BuildRequires: clang-tools-extra BuildRequires: llvm BuildRequires: lld %if ! %{use_custom_libcxx} BuildRequires: libcxx-devel %endif %if 0%{?rhel} && 0%{?rhel} <= 9 BuildRequires: gcc-toolset-14-libatomic-devel %endif BuildRequires: rustc BuildRequires: rustfmt BuildRequires: bindgen-cli %if ! %{bundlezstd} BuildRequires: libzstd-devel %endif # build with system ffmpeg-free %if ! %{bundleffmpegfree} BuildRequires: pkgconfig(libavcodec) BuildRequires: pkgconfig(libavfilter) BuildRequires: pkgconfig(libavformat) BuildRequires: pkgconfig(libavutil) %endif %if 0%{?noopenh264} BuildRequires: pkgconfig(openh264) %endif # build with system libaom %if ! %{bundlelibaom} BuildRequires: libaom-devel %endif BuildRequires: alsa-lib-devel BuildRequires: atk-devel BuildRequires: bison BuildRequires: cups-devel BuildRequires: dbus-devel BuildRequires: desktop-file-utils BuildRequires: expat-devel BuildRequires: flex BuildRequires: fontconfig-devel BuildRequires: glib2-devel BuildRequires: glibc-devel BuildRequires: gperf %if %{use_qt5} BuildRequires: pkgconfig(Qt5Core) BuildRequires: pkgconfig(Qt5Widgets) %endif %if %{use_qt6} BuildRequires: pkgconfig(Qt6Core) BuildRequires: pkgconfig(Qt6Widgets) %endif BuildRequires: compiler-rt %if ! %{bundleharfbuzz} BuildRequires: harfbuzz-devel >= 2.4.0 %endif BuildRequires: libatomic BuildRequires: libcap-devel BuildRequires: libcurl-devel %if ! %{bundlelibdrm} BuildRequires: libdrm-devel %endif BuildRequires: libgcrypt-devel BuildRequires: libudev-devel BuildRequires: libuuid-devel %if 0%{?fedora} >= 37 || 0%{?rhel} > 9 BuildRequires: libusb-compat-0.1-devel %else BuildRequires: libusb-devel %endif BuildRequires: libutempter-devel BuildRequires: libXdamage-devel BuildRequires: libXtst-devel BuildRequires: xcb-proto BuildRequires: mesa-libgbm-devel # Old Fedora (before 30) uses the 1.2 minizip by default. # Newer Fedora needs to use the compat package # Fedora > 39 uses minizip-ng %if ! %{bundleminizip} %if 0%{?fedora} > 39 || 0%{?rhel} > 9 # BuildRequires: minizip-ng-devel BuildRequires: minizip-compat-devel %else BuildRequires: minizip-compat-devel %endif %endif %if %{system_nodejs} BuildRequires: nodejs, /usr/bin/node %endif %if ! %{bootstrap} BuildRequires: gn %endif BuildRequires: nss-devel >= 3.26 BuildRequires: pciutils-devel BuildRequires: pulseaudio-libs-devel # For screen sharing on Wayland # pipewire is old on el8, chromium needs new version, disable it temporary %if 0%{?fedora} || 0%{?rhel} > 8 BuildRequires: pipewire-devel %endif # for /usr/bin/appstream-util BuildRequires: libappstream-glib %if %{bootstrap} # gn needs these BuildRequires: libstdc++-static %endif # Fedora tries to use system libs whenever it can. BuildRequires: bzip2-devel BuildRequires: dbus-glib-devel # For eu-strip BuildRequires: elfutils BuildRequires: elfutils-libelf-devel %if ! %{bundleflac} BuildRequires: flac-devel %endif %if ! %{bundlefreetype} BuildRequires: freetype-devel %endif %if ! %{bundlecrc32c} BuildRequires: google-crc32c-devel %endif %if ! %{bundlewoff2} BuildRequires: woff2-devel %endif %if ! %{bundledav1d} BuildRequires: libdav1d-devel %endif %if ! %{bundlehighway} BuildRequires: highway-devel %endif %if ! %{bundlelibavif} BuildRequires: libavif-devel %endif %if ! %{bundlejsoncpp} BuildRequires: jsoncpp-devel %endif %if ! %{bundlelibsecret} BuildRequires: libsecret-devel %endif %if ! %{bundledoubleconversion} BuildRequires: double-conversion-devel %endif %if ! %{bundlesnappy} BuildRequires: snappy-devel %endif %if ! %{bundlelibXNVCtrl} BuildRequires: libXNVCtrl-devel %endif # One of the python scripts invokes git to look for a hash. So helpful. BuildRequires: git-core BuildRequires: hwdata BuildRequires: kernel-headers BuildRequires: libffi-devel %if ! %{bundleicu} # If this is true, we're using the bundled icu. # We'd like to use the system icu every time, but we cannot always do that. # Not newer than 54 (at least not right now) BuildRequires: libicu-devel >= 68 %endif %if ! %{bundlelibjpeg} # If this is true, we're using the bundled libjpeg # which we need to do because the RHEL 7 libjpeg doesn't work for chromium anymore BuildRequires: libjpeg-devel %endif %if ! %{bundlelibpng} # If this is true, we're using the bundled libpng # which we need to do because the RHEL 7 libpng doesn't work right anymore BuildRequires: libpng-devel %endif %if ! %{bundlelibopenjpeg2} BuildRequires: openjpeg2-devel %endif %if ! %{bundlelcms2} BuildRequires: lcms2-devel %endif %if ! %{bundlelibtiff} BuildRequires: libtiff-devel %endif BuildRequires: libudev-devel %if ! %{bundlelibusbx} Requires: libusbx >= 1.0.21-0.1.git448584a BuildRequires: libusbx-devel >= 1.0.21-0.1.git448584a %endif %if %{use_vaapi} BuildRequires: libva-devel %endif # We don't use libvpx anymore because Chromium loves to # use bleeding edge revisions here that break other things # ... so we just use the bundled libvpx. %if ! %{bundlelibwebp} BuildRequires: libwebp-devel %endif %if ! %{bundlelibxslt} BuildRequires: libxslt-devel %endif BuildRequires: libxshmfence-devel # Same here, it seems. # BuildRequires: libyuv-devel BuildRequires: mesa-libGL-devel %if ! %{bundleopus} BuildRequires: opus-devel %endif BuildRequires: %{chromium_pybin} ## CEF: GTK is not used for CEF %if 0 ## END CEF %if %{gtk_version} == 4 BuildRequires: pkgconfig(gtk4) BuildRequires: pkgconfig(xcursor) BuildRequires: pkgconfig(xi) BuildRequires: pkgconfig(xrender) BuildRequires: pkgconfig(xscrnsaver) BuildRequires: pkgconfig(xshmfence) BuildRequires: pkgconfig(xt) BuildRequires: pkgconfig(xtst) BuildRequires: pkgconfig(x11) BuildRequires: pkgconfig(xcb-dri3) BuildRequires: pkgconfig(xcb-proto) Requires: gtk4 %else BuildRequires: pkgconfig(gtk+-3.0) # GTK modules it expects to find for some reason. Requires: libcanberra-gtk3%{_isa} %endif ## CEF: GTK4 is not used for CEF %endif ## END CEF # Build deps of Chromium proper which are often transitively pulled in by toolkits (GTK, Qt), # but are still required without them. BuildRequires: pkgconfig(atspi-2) BuildRequires: pkgconfig(atk-bridge-2.0) BuildRequires: pkgconfig(pangocairo) BuildRequires: pkgconfig(xkbcommon) BuildRequires: pkgconfig(xcomposite) BuildRequires: pkgconfig(xrandr) BuildRequires: wayland-devel %if ! %{bundlepylibs} %if 0%{?fedora} || 0%{?rhel} >= 8 BuildRequires: python3-jinja2 %else BuildRequires: python-jinja2 %endif %endif %if ! %{bundlere2} Requires: re2 >= 20160401 BuildRequires: re2-devel >= 20160401 %endif %if ! %{bundlebrotli} BuildRequires: brotli-devel %endif BuildRequires: speech-dispatcher-devel BuildRequires: zlib-devel # remote desktop needs this BuildRequires: pam-devel BuildRequires: systemd # using the built from source version on aarch64 BuildRequires: ninja-build # Yes, java is needed as well.. %if %{build_headless} BuildRequires: java-openjdk-headless %endif BuildRequires: libevdev-devel %if ! %{bundlesimdutf} BuildRequires: simdutf-devel %endif # esbuild is needed BuildRequires: golang-github-evanw-esbuild # There is a hardcoded check for nss 3.26 in the chromium code (crypto/nss_util.cc) Requires: nss%{_isa} >= 3.26 Requires: nss-mdns%{_isa} %if 0%{?fedora} && %{undefined flatpak} # This enables support for u2f tokens Requires: u2f-hidraw-policy %endif ## CEF: Remove chromium-common dep, disable ppc64le ExclusiveArch: x86_64 aarch64 ## END CEF # Bundled bits (I'm sure I've missed some) Provides: bundled(bintrees) = 1.0.1 # This is a fork of openssl. Provides: bundled(boringssl) %if %{bundlebrotli} Provides: bundled(brotli) = 222564a95d9ab58865a096b8d9f7324ea5f2e03e %endif %if %{bundlesimdutf} Provides: bundled(simdutf) = 7.0.0 %endif Provides: bundled(bspatch) = 465265d0d473d107b76e74d969199eaf2cdc8750 Provides: bundled(colorama) = 0.4.6 Provides: bundled(crashpad) = 8f131016b21d986c38ca4a0f091403dbb822d636 Provides: bundled(expat) = 2.7.1 Provides: bundled(fdmlibm) = c512d6173f33c6b8301d3fba9384edc9fc1f9e45 # Don't get too excited. MPEG and other legally problematic stuff is stripped out. %if %{bundleffmpegfree} Provides: bundled(ffmpeg) = 7.1.git %endif %if %{bundlelibaom} Provides: bundled(libaom) = 3.12.1 %endif %if %{bundlefontconfig} Provides: bundled(fontconfig) = 8cf0ce700a8abe0d97ace4bf7efc7f9534b729ba %endif %if %{bundlefreetype} Provides: bundled(freetype) = VER-2-13-3-230-ge07e56c7f %endif %if %{bundleharfbuzz} Provides: bundled(harfbuzz) = 11.0.0-97 %endif Provides: bundled(hunspell) = 6d7d19f %if %{bundleicu} Provides: bundled(icu) = 74-2 %endif Provides: bundled(leveldb) = 1.23 Provides: bundled(libaddressinput) = 2610f7b104 %if %{bundlelibdrm} Provides: bundled(libdrm) = 2.4.122 %endif Provides: bundled(libjingle) = 5493b8a59deb16cf0481e24707a0ed72d19047dc %if %{bundlelibjpeg} Provides: bundled(libjpeg-turbo) = 3.1.0 %endif Provides: bundled(libphonenumber) = 140dfeb81b753388e8a672900fb7a971e9a0d362 %if %{bundlelibpng} Provides: bundled(libpng) = 1.6.43 %endif Provides: bundled(libsrtp) = fd08747fa6800b321d53e15feb34da12dc697dee %if %{bundlelibusbx} Provides: bundled(libusbx) = 1.0.17 %endif Provides: bundled(libvpx) = 1.6.0 %if %{bundlelibwebp} Provides: bundled(libwebp) = 0.6.0 %endif %if %{bundlelibxml} Provides: bundled(libxml) = 2.14.2 %endif %if %{bundlelibXNVCtrl} Provides: bundled(libXNVCtrl) = 302.17 %endif Provides: bundled(libyuv) = 1909 Provides: bundled(lzma) = 24.09 %if %{bundleopus} Provides: bundled(opus) = 55513e81 %endif Provides: bundled(ots) = 8d70cffebbfa58f67a5c3ed0e9bc84dccdbc5bc0 Provides: bundled(protobuf) = 3.0.0.beta.3 Provides: bundled(qcms) = 4 %if %{bundlere2} Provides: bundled(re2) %endif Provides: bundled(sfntly) = 04740d2600193b14aa3ef24cd9fbb3d5996b9f77 Provides: bundled(skia) Provides: bundled(SMHasher) = 0 Provides: bundled(snappy) = 1.1.4-head Provides: bundled(speech-dispatcher) = 0.7.1 Provides: bundled(sqlite) = 3.17patched Provides: bundled(superfasthash) = 0 Provides: bundled(talloc) = 2.0.1 Provides: bundled(usrsctp) = 0 Provides: bundled(v8) = 5.9.211.31 Provides: bundled(webrtc) = 90usrsctp Provides: bundled(woff2) = 445f541996fe8376f3976d35692fd2b9a6eedf2d Provides: bundled(xdg-mime) Provides: bundled(xdg-user-dirs) # Provides: bundled(zlib) = 1.2.11 %if %{undefined flatpak} # For selinux scriptlet Requires(post): /usr/sbin/semanage Requires(post): /usr/sbin/restorecon %endif ## CEF: Package description, rm subpackages, add devel package %description CEF is an embeddable build of Chromium, powered by WebKit (Blink). %package devel Summary: Header files for the Chromium Embedded Framework Requires: %{name}%{?_isa} = %{version}-%{release} %description devel Header files for the Chromium Embedded Framework. ## END CEF %prep ## CEF: Unpack and move CEF/chromium sources into the expected layout %setup -q -T -n cef-%{cef_commit} -b 22 %setup -q -n chromium-%{chromium_version} mv %{_builddir}/cef-%{cef_commit} ./cef ## END CEF ### Chromium Fedora Patches ### %patch -P1 -p1 -b .etc %patch -P8 -p1 -b .widevine-other-locations %patch -P20 -p1 -b .disable-font-test %patch -P21 -p1 -b .screen-ai-service %if ! %{use_custom_libcxx} %patch -P22 -p1 -b .fix-qt-ui %endif %patch -P23 -p1 -R -b .revert-libpng_for_testonly %if 0%{?fedora} || 0%{?rhel} && 0%{?rhel} > 10 %patch -P24 -p1 -b .glibc-2.42-baud-rate-fix %endif %patch -P31 -p1 -b .disable-enterprise_companion_integration_tests %if ! %{bundlebrotli} %patch -P89 -p1 -b .system-brotli %endif %if ! %{bundlelibxml} %if 0%{?fedora} && 0%{?fedora} < 40 || 0%{?rhel} && 0%{?rhel} < 10 %patch -P90 -p1 -b .system-libxml %endif %endif %if ! %{bundleopus} %patch -P91 -p1 -b .system-opus %endif %patch -P92 -p1 -b .nodejs-checkversion %patch -P93 -p1 -b .ftbfs-csss_style_sheet %patch -P94 -p1 -R -b .v8-sanitize-build-error %patch -P96 -p1 -b .crabbyavif-ftbfs-old-rust %if ! %{bundleffmpegfree} %if 0%{?rhel} == 9 %patch -P128 -p1 -b .el9-ffmpeg-deprecated-apis %patch -P129 -p1 -b .el9-ffmpeg-AV_CODEC_FLAG_COPY_OPAQUE %patch -P130 -p1 -b .el9-ffmpeg-build-error %patch -P133 -p1 -b .el9-ffmpeg-5.1.x %endif %patch -P134 -p1 -b .el9-ffmpeg-5.1.x %patch -P131 -p1 -b .prop-codecs %patch -P132 -p1 -b .sigtrap_system_ffmpeg %patch -P135 -p1 -b .disable-H.264-video-parser-during-demuxing %patch -P136 -p1 -b .workaround-system-ffmpeg-whitelist %patch -P137 -p1 -b .system-ffmpeg %patch -P138 -p1 -b .workaround-system-ffmpeg-AVDynamicHDRSmpte2094App5 %endif %if 0%{?rhel} == 8 || 0%{?rhel} == 9 %patch -P141 -p1 -b .dma_buf_export_sync_file-conflict %endif %if (0%{?rhel} && 0%{?rhel} < 10) || (0%{?rhel} == 10 && 0%{?rhel_minor_version} < 2) %patch -P142 -p1 -b .rust-1.88-build-error %patch -P143 -p1 -b .rust-1.88-enable-unstable_features %patch -P144 -p1 -b .rust-1.88-undefined-symbol %endif %if 0%{?rhel} == 9 %patch -P146 -p1 -b .el9-python-3.9-build-error %endif %patch -P150 -p1 -b .qt6 %patch -P300 -p1 -b .swiftshader-missing-include # llvm version < 21 on f42/el9/epel10.1 %if (0%{?fedora} && 0%{?fedora} < 43) || (0%{?rhel} && 0%{?rhel} < 10) || (0%{?rhel} == 10 && 0%{?rhel_minor_version} < 2) %patch -P302 -p1 -b .static_assert %patch -P303 -p1 -b .ftfs-llvm-octal-notation %patch -P304 -p1 -b .llvm-crash %endif %if 0%{?rhel} == 8 %ifarch aarch64 %patch -P305 -p1 -b .el8-memory_tagging %patch -P306 -p1 -b .el8-ifunc-header %endif %patch -P307 -p1 -b .el8-atk-compiler-error %patch -P308 -p1 -b .unsupport-clang-flags %patch -P309 -p1 -b .el8-unsupport-rustc-flags %patch -P314 -p1 -b .rust-skrifa-build-error %endif %patch -P315 -p1 -b .rustc-ftbfs %patch -P310 -p1 -b .rust-FTBFS-suppress-warnings %patch -P311 -p1 -b .fstack-protector-strong %if 0%{?rhel} && 0%{?rhel} < 10 %patch -P354 -p1 -b .split-threshold-for-reg-with-hint %endif %patch -P316 -p1 -b .clang++-unknown-argument %patch -P318 -p1 -b .memory-allocator-dcheck-assert-fix %patch -P319 -p1 -b .swiftshader-llvm-16.0 %ifarch aarch64 && 0%{?fedora} %patch -P320 -p1 -b .aarch64-log-error %endif %patch -P321 -p1 -b .system-golang %patch -P322 -p1 -b .histograms_xml-build-error %if %{disable_bti} %patch -P352 -p1 -b .workaround_for_crash_on_BTI_capable_system %endif %ifarch aarch64 && (0%{?fedora} > 40 || 0%{?rhel} > 10) %patch -P353 -p1 -b .duplicate-case-value %endif %patch -P355 -p1 -b .hardware_destructive_interference_size %patch -P356 -p1 -b .disable_use_libcxx_modules %patch -P357 -p1 -b .type-mismatch-error %patch -P358 -p1 -b .rust-clang_lib %if 0%{?fedora} > 41 || (0%{?rhel} == 10 && 0%{?rhel_minor_version} > 2) %patch -P359 -p1 -b .ftbfs-with-rustc-1.95 %endif %ifarch ppc64le %patch -P360 -p1 -b .add-ppc64-architecture-string %patch -P361 -p1 -b .0001-sandbox-Enable-seccomp_bpf-for-ppc64 %patch -P376 -p1 -b .0001-third_party-angle-Include-missing-header-cstddef-in- %patch -P377 -p1 -b .0001-Add-PPC64-support-for-boringssl %patch -P378 -p1 -b .0001-third_party-libvpx-Disable-vsx-on-ppc64 %patch -P379 -p1 -b .0001-third_party-libvpx-Properly-generate-gni-on-ppc64 %patch -P380 -p1 -b .0001-third_party-pffft-Include-altivec.h-on-ppc64-with-SI %patch -P381 -p1 -b .0002-Add-PPC64-generated-files-for-boringssl %patch -P382 -p1 -b .0002-third_party-lss-kernel-structs %patch -P383 -p1 -b .0001-swiftshader-fix-build %patch -P384 -p1 -b .Rtc_base-system-arch.h-PPC %patch -P386 -p1 -b .0004-third_party-crashpad-port-curl-transport-ppc64 %patch -P387 -p1 -b .HACK-third_party-libvpx-use-generic-gnu %patch -P389 -p1 -b .HACK-debian-clang-disable-base-musttail %patch -P390 -p1 -b .HACK-debian-clang-disable-pa-musttail %patch -P391 -p1 -b .0001-Add-ppc64-target-to-libaom %patch -P392 -p1 -b .0001-Add-pregenerated-config-for-libaom-on-ppc64 %patch -P393 -p1 -b .0002-third_party-libvpx-Remove-bad-ppc64-config %patch -P394 -p1 -b .0003-third_party-libvpx-Add-ppc64-generated-config %patch -P395 -p1 -b .0004-third_party-libvpx-work-around-ambiguous-vsx %patch -P396 -p1 -b .skia-vsx-instructions %patch -P397 -p1 -b .0001-Implement-support-for-ppc64-on-Linux %patch -P398 -p1 -b .0001-Implement-support-for-PPC64-on-Linux %patch -P399 -p1 -b .0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when- %patch -P401 -p1 -b .fix-rustc %patch -P402 -p1 -b .fix-rust-linking %patch -P403 -p1 -b .fix-breakpad-compile %patch -P405 -p1 -b .fix-study-crash %patch -P407 -p1 -b .fix-different-data-layouts %patch -P408 -p1 -b .0002-Add-ppc64-trap-instructions %patch -P409 -p1 -b .fix-page-allocator-overflow %patch -P410 -p1 -b .0001-Enable-ppc64-pointer-compression %patch -P411 -p1 -b .dawn-fix-ppc64le-detection %patch -P412 -p1 -b .add-ppc64-architecture-to-extensions %patch -P413 -p1 -b .fix-unknown-warning-option-messages %patch -P415 -p1 -b .add-ppc64-pthread-stack-size %patch -P417 -p1 -b .0001-add-xnn-ppc64el-support %patch -P418 -p1 -b .0002-regenerate-xnn-buildgn %patch -P419 -p1 -b .0009-sandbox-ignore-byte-span-error %patch -P420 -p1 -b .0005-blink-add-audio-vector-support %patch -P450 -p1 -b .pt_regs-kernel-7.2.0 %endif %if 0%{?flatpak} %patch -P500 -p1 -b .flatpak-initial-sandbox %patch -P501 -p1 -b .flatpak-sandbox-paths %patch -P502 -p1 -b .flatpak-widevine %endif %patch -P520 -p1 -b .build-with-wasm-rollup %patch -P521 -p1 -b .disable-ai # Upstream patches %patch -P606 -p1 -b .Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode %patch -P607 -p1 -b .Add-AutoDarkModeSVGSizeThreshold-kill-switch-flag ## CEF: CEF-specific fix patches & other fixup %patch -P900 -p1 -b .cef-no-sysroot %if ! %{bundlelibxml} %patch -P901 -p1 -b .cef-no-libxml-visibility-patch %endif # Redirect the git version stuff to use the version file contents instead cat >>cef/VERSION.in < cef/.git-version < .git-version <> cef/tools/clang_util.py # Mock the git functions cat <>cef/tools/git_util.py import subprocess def git_apply_patch_file(patch_path, patch_dir): try: subprocess.run(["patch", "-p0", "--ignore-whitespace", "-N", "-i", patch_path], cwd=patch_dir, check=True) except subprocess.CalledProcessError: return "fail" return "apply" def ver_info(path): info = {} for line in open(os.path.join(path, '.git-version')): key, val = line.strip().split("=") info[key] = val return info def is_checkout(path): return os.path.exists(os.path.join(path, '.git-version')) def get_hash(path='.', branch='HEAD'): return ver_info(path)["COMMIT_HASH"] def get_url(path): return ver_info(path)["URL"] def get_commit_number(path='.', branch='HEAD'): return 0 EOF ## END CEF # Change shebang in all relevant files in this directory and all subdirectories # See `man find` for how the `-exec command {} +` syntax works find -type f \( -iname "*.py" \) -exec sed -i '1s=^#! */usr/bin/\(python\|env python\)[23]\?=#!%{chromium_pybin}=' {} + # Add correct path for nodejs binary mkdir -p third_party/node/linux/node-linux-x64/bin %if ! %{system_nodejs} ln -s ../../../../../node-%{nodejs_version}/node third_party/node/linux/node-linux-x64/bin/node %else ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node %endif # Add correct path for esbuild binary mkdir -p third_party/devtools-frontend/src/third_party/esbuild ln -s $(which esbuild) third_party/devtools-frontend/src/third_party/esbuild/esbuild # Remove bundle gn and replace it with a system gn or bootstrap gn as it is x86_64 and causes # FTBFS on other arch like aarch64/ppc64le mkdir -p buildtools/linux64/ %if %{bootstrap} ln -sf ../../%{chromebuilddir}/gn buildtools/linux64/gn %else ln -sf $(which gn) buildtools/linux64/gn %endif # Remove bundle gperf and replace it with system gperf mkdir -p third_party/gperf/cipd/bin ln -fs $(which gperf) third_party/gperf/cipd/bin/gperf # Remove bundle rustc and replace it with system rustc mkdir -p third_party/rust-toolchain/bin/ ln -fs $(which rustc) third_party/rust-toolchain/bin/rustc %if %{bundlelibusbx} # no hackity hack hack %else # hackity hack hack rm -rf third_party/libusb/src/libusb/libusb.h # we _shouldn't need to do this, but it looks like we do. cp -a $(pkg-config --variable=includedir libusb-1.0)/libusb-1.0/libusb.h third_party/libusb/src/libusb/libusb.h %endif # Hard code extra version sed -i 's/getenv("CHROME_VERSION_EXTRA")/"Fedora Project"/' chrome/common/channel_info_posix.cc # Fix hardcoded path in remoting code sed -i 's|/opt/google/chrome-remote-desktop|%{crd_path}|g' remoting/host/setup/daemon_controller_delegate_linux_single_process.cc # bz#2265957, add correct platform sed -i "s/Linux x86_64/Linux %{_arch}/" components/embedder_support/user_agent_utils.cc %if ! %{bundlesimdutf} ln -sf %{_includedir}/simdutf.h third_party/simdutf/simdutf.h %endif %build %if ! %{system_nodejs} # Build nodejs and Replace bundle binary export CXX=c++ tar xf %{SOURCE12} pushd node-%{nodejs_version} patch -p1 < %{_sourcedir}/0001-Remove-unused-OpenSSL-config.patch patch -p1 < %{_sourcedir}/0001-fips-disable-options.patch ./configure --ninja --shared-openssl --openssl-is-fips --openssl-conf-name=openssl_conf --enable-static --prefix=node-%{nodejs_version}-linux-x64 ninja -j %{numjobs} -C %{chromebuilddir} make install popd %endif # reduce warnings FLAGS=' -Wno-deprecated-declarations -Wno-unknown-warning-option -Wno-unused-command-line-argument' FLAGS+=' -Wno-unused-but-set-variable -Wno-unused-result -Wno-unused-function -Wno-unused-variable' FLAGS+=' -Wno-unused-const-variable -Wno-unneeded-internal-declaration -Wno-unknown-attributes -Wno-unknown-pragmas' %if %{system_build_flags} CFLAGS=${CFLAGS/-fexceptions} CFLAGS=${CFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS} CFLAGS="$CFLAGS $FLAGS" CXXFLAGS="$CFLAGS" %else # override system build flags CFLAGS="$FLAGS" CXXFLAGS="$FLAGS" %endif %ifarch ppc64le CXXFLAGS+=' -faltivec-src-compat=mixed -Wno-deprecated-altivec-src-compat' %endif %if ! %{use_custom_libcxx} LDFLAGS="${LDFLAGS} -stdlib=libc++" CXXFLAGS="${CXXFLAGS} -stdlib=libc++" %endif export CC=clang export CXX=clang++ export AR=llvm-ar export NM=llvm-nm export READELF=llvm-readelf export CFLAGS export CXXFLAGS export LDFLAGS # Suppress linker_messages Warnings in Rust export RUSTFLAGS="-A linker_messages" # need for error: the option `Z` is only accepted on the nightly compiler export RUSTC_BOOTSTRAP=1 # set rustc version # Fix error: multiple input filenames provided, caused by rustc_wrapper rustc_version="$(rustc -V | cut -d' ' -f-2 | sed 's/ /-/')" # set rust bindgen root rust_bindgen_root="$(which bindgen | sed 's#/s\?bin/.*##')" rust_sysroot_absolute="$(rustc --print sysroot)" # set clang version clang_version="$(clang --version | sed -n 's/clang version //p' | cut -d. -f1)" %if 0%{?fedora} > 41 || 0%{?rhel} > 9 clang_base_path="$(PATH=/usr/bin:/usr/sbin which clang | sed 's#/bin/.*##')" %else clang_base_path="$(clang --version | grep InstalledDir | cut -d' ' -f2 | sed 's#/bin##')" %endif # Core defines are flags that are true for both the browser and headless. CHROMIUM_CORE_GN_DEFINES="" # using system toolchain CHROMIUM_CORE_GN_DEFINES+=' custom_toolchain="//build/toolchain/linux/unbundle:default"' CHROMIUM_CORE_GN_DEFINES+=' host_toolchain="//build/toolchain/linux/unbundle:default"' %if ! %{use_custom_libcxx} CHROMIUM_BROWSER_GN_DEFINES+=' use_custom_libcxx=false' %endif CHROMIUM_CORE_GN_DEFINES+=' is_debug=false dcheck_always_on=false dcheck_is_configurable=false' CHROMIUM_CORE_GN_DEFINES+=' enable_enterprise_companion=false' CHROMIUM_CORE_GN_DEFINES+=' system_libdir="%{_lib}"' %if %{official_build} CHROMIUM_CORE_GN_DEFINES+=' is_official_build=true' sed -i 's|OFFICIAL_BUILD|GOOGLE_CHROME_BUILD|g' tools/generate_shim_headers/generate_shim_headers.py %endif CHROMIUM_CORE_GN_DEFINES+=' chrome_pgo_phase=0' %if ! %{cfi} CHROMIUM_CORE_GN_DEFINES+=' is_cfi=false use_thin_lto=false' %endif CHROMIUM_CORE_GN_DEFINES+=' is_clang=true' CHROMIUM_CORE_GN_DEFINES+=" clang_base_path=\"$clang_base_path\"" CHROMIUM_CORE_GN_DEFINES+=" clang_version=$clang_version" CHROMIUM_CORE_GN_DEFINES+=' clang_use_chrome_plugins=false' CHROMIUM_CORE_GN_DEFINES+=' use_lld=true' # enable system rust CHROMIUM_CORE_GN_DEFINES+=" rust_sysroot_absolute=\"$rust_sysroot_absolute\"" CHROMIUM_CORE_GN_DEFINES+=" rust_bindgen_root=\"$rust_bindgen_root\"" CHROMIUM_CORE_GN_DEFINES+=" rustc_version=\"$rustc_version\"" CHROMIUM_CORE_GN_DEFINES+=' use_sysroot=false' %ifarch aarch64 CHROMIUM_CORE_GN_DEFINES+=' target_cpu="arm64"' %endif %ifarch ppc64le CHROMIUM_CORE_GN_DEFINES+=' target_cpu="ppc64"' %endif CHROMIUM_CORE_GN_DEFINES+=' icu_use_data_file=true' CHROMIUM_CORE_GN_DEFINES+=' target_os="linux"' CHROMIUM_CORE_GN_DEFINES+=' current_os="linux"' CHROMIUM_CORE_GN_DEFINES+=' treat_warnings_as_errors=false' CHROMIUM_CORE_GN_DEFINES+=' enable_iterator_debugging=false' CHROMIUM_CORE_GN_DEFINES+=' enable_vr=false' CHROMIUM_CORE_GN_DEFINES+=' build_dawn_tests=false enable_perfetto_unittests=false' CHROMIUM_CORE_GN_DEFINES+=' disable_fieldtrial_testing_config=true' CHROMIUM_CORE_GN_DEFINES+=' symbol_level=0 blink_symbol_level=0' CHROMIUM_CORE_GN_DEFINES+=' angle_has_histograms=false' # drop unrar CHROMIUM_CORE_GN_DEFINES+=' safe_browsing_use_unrar=false' CHROMIUM_CORE_GN_DEFINES+=' v8_enable_backtrace=true' # disable devtools buildle CHROMIUM_CORE_GN_DEFINES+=' devtools_bundle=false' export CHROMIUM_CORE_GN_DEFINES # browser gn defines CHROMIUM_BROWSER_GN_DEFINES="" # if systemwide ffmpeg free is used, the proprietary codecs can be set to true to load the codecs from ffmpeg-free # the codecs computation is passed to ffmpeg-free in this case %if ! %{bundleffmpegfree} CHROMIUM_BROWSER_GN_DEFINES+=' ffmpeg_branding="Chrome" proprietary_codecs=true is_component_ffmpeg=true enable_ffmpeg_video_decoders=true media_use_ffmpeg=true' %else CHROMIUM_BROWSER_GN_DEFINES+=' ffmpeg_branding="Chromium" proprietary_codecs=false is_component_ffmpeg=false enable_ffmpeg_video_decoders=false media_use_ffmpeg=true' %endif # link against noopenh264 library %if 0%{?noopenh264} CHROMIUM_BROWSER_GN_DEFINES+=' media_use_openh264=true' CHROMIUM_BROWSER_GN_DEFINES+=' rtc_use_h264=true' %else CHROMIUM_BROWSER_GN_DEFINES+=' media_use_openh264=false' CHROMIUM_BROWSER_GN_DEFINES+=' rtc_use_h264=false' %endif CHROMIUM_BROWSER_GN_DEFINES+=' use_kerberos=true' # Workaround for FTBFS, error: no member named 'bPsnrY' in 'Source_Picture_s' CHROMIUM_BROWSER_GN_DEFINES+=' rtc_video_psnr=false' %if %{use_qt5} CHROMIUM_BROWSER_GN_DEFINES+=" use_qt5=true moc_qt5_path=\"$(%{_qt5_qmake} -query QT_HOST_BINS)\"" %else CHROMIUM_BROWSER_GN_DEFINES+=' use_qt5=false' %endif %if %{use_qt6} CHROMIUM_BROWSER_GN_DEFINES+=" use_qt6=true moc_qt6_path=\"$(%{_qt6_qmake} -query QT_HOST_LIBEXECS)\"" %else CHROMIUM_BROWSER_GN_DEFINES+=' use_qt6=false' %endif CHROMIUM_BROWSER_GN_DEFINES+=' use_gtk=true gtk_version=%{gtk_version}' CHROMIUM_BROWSER_GN_DEFINES+=' use_gio=true use_pulseaudio=true' CHROMIUM_BROWSER_GN_DEFINES+=' enable_hangout_services_extension=true' CHROMIUM_BROWSER_GN_DEFINES+=' enable_widevine=true' %if %{use_vaapi} CHROMIUM_BROWSER_GN_DEFINES+=' use_vaapi=true' %else CHROMIUM_BROWSER_GN_DEFINES+=' use_vaapi=false' %endif %if %{use_v4l2_codec} CHROMIUM_BROWSER_GN_DEFINES+=' use_v4l2_codec=true' %endif %if 0%{?fedora} || 0%{?rhel} > 8 CHROMIUM_BROWSER_GN_DEFINES+=' rtc_use_pipewire=true rtc_link_pipewire=true' %else CHROMIUM_BROWSER_GN_DEFINES+=' rtc_use_pipewire=false rtc_link_pipewire=false' %endif %if ! %{bundlelibjpeg} CHROMIUM_BROWSER_GN_DEFINES+=' use_system_libjpeg=true' %endif %if ! %{bundlelibpng} CHROMIUM_BROWSER_GN_DEFINES+=' use_system_libpng=true' %endif %if ! %{bundleharfbuzz} CHROMIUM_BROWSER_GN_DEFINES+=' use_system_harfbuzz=true' %endif %if ! %{bundlelibopenjpeg2} CHROMIUM_BROWSER_GN_DEFINES+=' use_system_libopenjpeg2=true' %endif %if ! %{bundlelcms2} CHROMIUM_BROWSER_GN_DEFINES+=' use_system_lcms2=true' %endif %if ! %{bundlelibtiff} CHROMIUM_BROWSER_GN_DEFINES+=' use_system_libtiff=true' %endif CHROMIUM_BROWSER_GN_DEFINES+=' use_system_libffi=true' export CHROMIUM_BROWSER_GN_DEFINES # headless gn defines CHROMIUM_HEADLESS_GN_DEFINES="" CHROMIUM_HEADLESS_GN_DEFINES+=' use_ozone=true ozone_auto_platforms=false ozone_platform="headless" ozone_platform_headless=true' CHROMIUM_HEADLESS_GN_DEFINES+=' angle_enable_vulkan=true angle_enable_swiftshader=true headless_use_embedded_resources=false' CHROMIUM_HEADLESS_GN_DEFINES+=' headless_use_prefs=false headless_use_policy=false' CHROMIUM_HEADLESS_GN_DEFINES+=' v8_use_external_startup_data=false enable_print_preview=false enable_remoting=false' CHROMIUM_HEADLESS_GN_DEFINES+=' use_alsa=false use_bluez=false use_cups=false use_dbus=false use_gio=false use_kerberos=false' CHROMIUM_HEADLESS_GN_DEFINES+=' use_libpci=false use_pulseaudio=false use_udev=false rtc_use_pipewire=false' CHROMIUM_HEADLESS_GN_DEFINES+=' v8_enable_lazy_source_positions=false use_glib=false use_gtk=false use_pangocairo=false' CHROMIUM_HEADLESS_GN_DEFINES+=' use_qt5=false use_qt6=false is_component_build=false enable_ffmpeg_video_decoders=false media_use_ffmpeg=false' CHROMIUM_HEADLESS_GN_DEFINES+=' media_use_libvpx=false proprietary_codecs=false' export CHROMIUM_HEADLESS_GN_DEFINES # use system libraries system_libs=() %if ! %{bundlelibaom} system_libs+=(libaom) %endif %if ! %{bundlelibavif} system_libs+=(libavif) %endif %if ! %{bundlebrotli} system_libs+=(brotli) %endif %if ! %{bundlecrc32c} system_libs+=(crc32c) %endif %if ! %{bundledav1d} system_libs+=(dav1d) %endif %if ! %{bundlehighway} system_libs+=(highway) %endif %if ! %{bundlefontconfig} system_libs+=(fontconfig) %endif %if ! %{bundleffmpegfree} system_libs+=(ffmpeg) %endif %if ! %{bundlefreetype} system_libs+=(freetype) %endif %if ! %{bundleharfbuzz} system_libs+=(harfbuzz) %endif %if ! %{bundleicu} system_libs+=(icu) %endif %if ! %{bundlelibdrm} system_libs+=(libdrm) %endif %if ! %{bundlelibjpeg} system_libs+=(libjpeg) %endif %if ! %{bundlelibpng} system_libs+=(libpng) %endif %if ! %{bundlelibusbx} system_libs+=(libusb) %endif %if ! %{bundlelibwebp} system_libs+=(libwebp) %endif %if ! %{bundlelibxml} system_libs+=(libxml) %endif %if ! %{bundlelibxslt} system_libs+=(libxslt) %endif %if ! %{bundleopus} system_libs+=(opus) %endif %if ! %{bundlere2} system_libs+=(re2) %endif %if ! %{bundlewoff2} system_libs+=(woff2) %endif %if ! %{bundleminizip} system_libs+=(zlib) %endif %if ! %{bundlejsoncpp} system_libs+=(jsoncpp) %endif %if ! %{bundledoubleconversion} system_libs+=(double-conversion) %endif %if ! %{bundlelibsecret} system_libs+=(libsecret) %endif %if ! %{bundlesnappy} system_libs+=(snappy) %endif %if ! %{bundlelibXNVCtrl} system_libs+=(libXNVCtrl) %endif %if ! %{bundleflac} system_libs+=(flac) %endif %if ! %{bundlezstd} system_libs+=(zstd) %endif %if 0%{?noopenh264} system_libs+=(openh264) %endif %if ! %{bundlesimdutf} system_libs+=(simdutf) %endif build/linux/unbundle/replace_gn_files.py --system-libraries ${system_libs[@]} # Check that there is no system 'google' module, shadowing bundled ones: if python3 -c 'import google ; print google.__path__' 2> /dev/null ; then \ echo "Python 3 'google' module is defined, this will shadow modules of this build"; \ exit 1 ; \ fi %if %{bootstrap} tools/gn/bootstrap/bootstrap.py --gn-gen-args="$CHROMIUM_CORE_GN_DEFINES $CHROMIUM_BROWSER_GN_DEFINES" %else mkdir -p %{chromebuilddir} && cp -a $(which gn) %{chromebuilddir}/ %endif ## CEF: CEF-specific configure/build process DEPOT_TOOLS=%{_builddir}/chromium-%{chromium_version}/third_party/depot_tools # Use system ninja, remove the wrapper which only supports x86_64 rm -f ${DEPOT_TOOLS}/ninja export PATH=$PATH:$DEPOT_TOOLS CEF_GN_DEFINES="" # Disable features inappropriate for CEF build CEF_GN_DEFINES+=' use_gtk=false use_qt5=false use_qt6=false enable_remoting=false' CEF_GN_DEFINES+=' use_cups=false use_gio=false use_kerberos=false' CEF_GN_DEFINES+=' use_libpci=false use_udev=false' CEF_GN_DEFINES+=' cef_use_gtk=false' GN_DEFINES="$CHROMIUM_CORE_GN_DEFINES $CHROMIUM_BROWSER_GN_DEFINES $CEF_GN_DEFINES" \ GN_ARGUMENTS="--script-executable=%{chromium_pybin}" \ %{chromium_pybin} cef/tools/gclient_hook.py %build_target %{chromebuilddir} libcef %build_target %{chromebuilddir} chrome_sandbox # Generate CEF API version subpackages sh %SOURCE23 cef/cef_api_versions.json > %{specpartsdir}/cef-api-versions.specpart # Build the CEF binary "distribution" python3 cef/tools/make_distrib.py --distrib-subdir=distrib --output-dir=.. --ninja-build --%{chromium_arch}-build --minimal --no-docs --no-archive ## END CEF %if %{build_chrome_management_service} %build_target %{chromebuilddir} chrome_management_service %endif %install rm -rf %{buildroot} ## CEF: CEF-specific install section mkdir -p %{buildroot}%{chromium_path} mkdir -p %{buildroot}%{_rpmmacrodir} mkdir -p %{buildroot}%{cef_wrapper_src_path} mkdir -p %{buildroot}%{_includedir}/cef mkdir -p %{buildroot}%{_datadir}/cmake/Modules pushd ../distrib_minimal/Resources cp -a *.pak locales %{buildroot}%{chromium_path} %if %{bundleicu} cp -a icudtl.dat %{buildroot}%{chromium_path} %endif popd pushd ../distrib_minimal/Release cp -a libvk_swiftshader.so* %{buildroot}%{chromium_path} cp -a libvulkan.so* %{buildroot}%{chromium_path} cp -a vk_swiftshader_icd.json %{buildroot}%{chromium_path} cp -a libcef.so %{buildroot}%{chromium_path} cp -a chrome-sandbox %{buildroot}%{chromium_path}/chrome-sandbox # V8 initial snapshots # https://code.google.com/p/chromium/issues/detail?id=421063 cp -a v8_context_snapshot.bin %{buildroot}%{chromium_path} # This is ANGLE, not to be confused with the similarly named files under swiftshader/ cp -a libEGL.so* libGLESv2.so* %{buildroot}%{chromium_path} popd cp -a ../distrib_minimal/include %{buildroot}%{_includedir}/cef/include cp -a ../distrib_minimal/libcef_dll %{buildroot}%{cef_wrapper_src_path}/libcef_dll # Remove include file targets, since includes are in a different path sed -i -e '/\.\.\/include/d' %{buildroot}%{cef_wrapper_src_path}/libcef_dll/CMakeLists.txt sed \ -e "s,__CEF_INCLUDE__,%{_includedir}/cef," \ -e "s,__CEF_LIB__,%{chromium_path}," \ -e "s,__CEF_SRC__,%{cef_wrapper_src_path}," \ %{SOURCE24} >%{buildroot}%{_datadir}/cmake/Modules/FindCEF.cmake echo '%%_cef_api_requires() Requires: cef%%{?1:(api) = %%1}%%{!?1:(abi) = %{cef_version}}' > %{buildroot}%{_rpmmacrodir}/macros.cef mkdir -p .fedora-rpm/docs/ cp AUTHORS .fedora-rpm/docs/AUTHORS-CHROMIUM cp cef/AUTHORS.txt .fedora-rpm/docs/AUTHORS-CEF mkdir -p .fedora-rpm/license/ cp LICENSE .fedora-rpm/license/LICENSE-CHROMIUM cp cef/LICENSE.txt .fedora-rpm/license/LICENSE-CEF # README.fedora cp %{SOURCE1} . %if %{undefined flatpak} %post # Set SELinux labels - semanage itself will adjust the lib directory naming # But only do it when selinux is enabled, otherwise, it gets noisy. if selinuxenabled; then semanage fcontext -a -t bin_t %{chromium_path} &>/dev/null || : semanage fcontext -a -t chrome_sandbox_exec_t %{chromium_path}/chrome-sandbox &>/dev/null || : restorecon -R -v %{chromium_path} &>/dev/null || : fi %endif ## END CEF %files ## CEF: CEF-specific file list %doc README.fedora %doc .fedora-rpm/docs/AUTHORS* %license .fedora-rpm/license/LICENSE* %{chromium_path}/chrome_*.pak %{chromium_path}/resources.pak %attr(4755, root, root) %{chromium_path}/chrome-sandbox %{chromium_path}/libcef.so ## END CEF (rest of files are verbatim from chromium-common) %{chromium_path}/libvk_swiftshader.so* %{chromium_path}/libvulkan.so* %{chromium_path}/vk_swiftshader_icd.json %{chromium_path}/libEGL.so* %{chromium_path}/libGLESv2.so* %{chromium_path}/*.bin %if %{bundleicu} %{chromium_path}/icudtl.dat %endif %dir %{chromium_path}/ %dir %{chromium_path}/locales/ %lang(af) %{chromium_path}/locales/af*.pak %lang(am) %{chromium_path}/locales/am*.pak %lang(ar) %{chromium_path}/locales/ar*.pak %lang(bg) %{chromium_path}/locales/bg*.pak %lang(bn) %{chromium_path}/locales/bn*.pak %lang(ca) %{chromium_path}/locales/ca*.pak %lang(cs) %{chromium_path}/locales/cs*.pak %lang(da) %{chromium_path}/locales/da*.pak %lang(de) %{chromium_path}/locales/de*.pak %lang(el) %{chromium_path}/locales/el*.pak %lang(en_GB) %{chromium_path}/locales/en-GB*.pak # Chromium _ALWAYS_ needs en-US.pak as a fallback # This means we cannot apply the lang code here. # Otherwise, it is filtered out on install. %{chromium_path}/locales/en-US*.pak %lang(es) %{chromium_path}/locales/es*.pak %lang(et) %{chromium_path}/locales/et*.pak %lang(fa) %{chromium_path}/locales/fa*.pak %lang(fi) %{chromium_path}/locales/fi{.pak,_*.pak} %lang(fil) %{chromium_path}/locales/fil*.pak %lang(fr) %{chromium_path}/locales/fr*.pak %lang(gu) %{chromium_path}/locales/gu*.pak %lang(he) %{chromium_path}/locales/he*.pak %lang(hi) %{chromium_path}/locales/hi*.pak %lang(hr) %{chromium_path}/locales/hr*.pak %lang(hu) %{chromium_path}/locales/hu*.pak %lang(id) %{chromium_path}/locales/id*.pak %lang(it) %{chromium_path}/locales/it*.pak %lang(ja) %{chromium_path}/locales/ja*.pak %lang(kn) %{chromium_path}/locales/kn*.pak %lang(ko) %{chromium_path}/locales/ko*.pak %lang(lt) %{chromium_path}/locales/lt*.pak %lang(lv) %{chromium_path}/locales/lv*.pak %lang(ml) %{chromium_path}/locales/ml*.pak %lang(mr) %{chromium_path}/locales/mr*.pak %lang(ms) %{chromium_path}/locales/ms*.pak %lang(nb) %{chromium_path}/locales/nb*.pak %lang(nl) %{chromium_path}/locales/nl*.pak %lang(pl) %{chromium_path}/locales/pl*.pak %lang(pt_BR) %{chromium_path}/locales/pt-BR*.pak %lang(pt_PT) %{chromium_path}/locales/pt-PT*.pak %lang(ro) %{chromium_path}/locales/ro*.pak %lang(ru) %{chromium_path}/locales/ru*.pak %lang(sk) %{chromium_path}/locales/sk*.pak %lang(sl) %{chromium_path}/locales/sl*.pak %lang(sr) %{chromium_path}/locales/sr*.pak %lang(sv) %{chromium_path}/locales/sv*.pak %lang(sw) %{chromium_path}/locales/sw*.pak %lang(ta) %{chromium_path}/locales/ta*.pak %lang(te) %{chromium_path}/locales/te*.pak %lang(th) %{chromium_path}/locales/th*.pak %lang(tr) %{chromium_path}/locales/tr*.pak %lang(uk) %{chromium_path}/locales/uk*.pak %lang(ur) %{chromium_path}/locales/ur*.pak %lang(vi) %{chromium_path}/locales/vi*.pak %lang(zh_CN) %{chromium_path}/locales/zh-CN*.pak %lang(zh_TW) %{chromium_path}/locales/zh-TW*.pak # These are psuedolocales, not real ones. # They only get generated when is_official_build=false %if ! %{official_build} %{chromium_path}/locales/ar-XB.pak %{chromium_path}/locales/en-XA.pak %endif ## CEF: rm headless/chromedriver subpackages, add devel subpackage %files devel %{_includedir}/cef/ %{_rpmmacrodir}/macros.cef %{cef_wrapper_src_path} %{_datadir}/cmake/Modules/FindCEF.cmake ## END CEF %changelog ## START: Generated by rpmautospec * Fri Sep 04 2026 Diego Herrera - 151.0.11^chromium151.0.7922.173-2 - Update cef sources to 7922 branch * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.173-1 - Update to 151.0.7922.173 * CVE-2026-76017: Use after free in Chromoting * CVE-2026-76018: Privilege elevation in Import * CVE-2026-76019: Incorrect authorization in Workers * CVE-2026-76020: Race condition in V8 * CVE-2026-76021: Use after free in DOM * CVE-2026-76022: Buffer overflow in Network * CVE-2026-76023: Improper resource control in Linux Toolkit Theming * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.169-1 - chromium security release 151.0.7922.169 * CVE-2026-76034: Buffer overflow in WebGL * CVE-2026-76036: Buffer overflow in Dawn * CVE-2026-76033: Inappropriate implementation in CORS * CVE-2026-76037: Link following in CredentialProvider * CVE-2026-76044: Race condition in USB * CVE-2026-76039: Incorrect reference resolution in Core * CVE-2026-76040: Use after free in Browser * CVE-2026-76035: Inappropriate implementation in Media * CVE-2026-76042: Use of uninitialized resource in GPU * CVE-2026-76046: Buffer overflow in ANGLE * CVE-2026-76043: Incorrect calculation in V8 * CVE-2026-76041: Information leak in Skia * CVE-2026-76047: Type confusion in V8 * CVE-2026-76038: Type confusion in V8 * CVE-2026-76045: Use after free in WebGL * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.137-2 - Suppress linker_messages Warnings in Rust and other warnings * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.137-1 - Update to 151.0.7922.137 * CVE-2026-19556: Use after free in V8 * CVE-2026-19557: Use after free in TabStrip * CVE-2026-19558: Use after free in Extensions * CVE-2026-19559: Use after free in HTML * CVE-2026-19560: Use after free in Blink * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.108-2 - Add condition for baud-rate-fix * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.108-1 - Update to 151.0.7922.108 * CVE-2026-19137: Use after free in WebGL * CVE-2026-19138: Heap buffer overflow in CrashReporting * CVE-2026-19139: Race in CredentialProvider * CVE-2026-19140: Use after free in GPU * CVE-2026-19141: Use after free in Resources * CVE-2026-19142: Use after free in Views * CVE-2026-19143: Insufficient validation of untrusted input in WebAPKs * CVE-2026-19144: Use after free in HTML * CVE-2026-19145: Use after free in Translate * CVE-2026-19146: Uninitialized Use in GPU * CVE-2026-19147: Use after free in Aura * CVE-2026-19148: Out of bounds write in GPU * CVE-2026-19149: Use after free in Aura * CVE-2026-19150: Inappropriate implementation in V8 * CVE-2026-19151: Use after free in V8 * CVE-2026-19152: Inappropriate implementation in Navigation * CVE-2026-19153: Insufficient validation of untrusted input in Workers * CVE-2026-19154: Use after free in Skia * CVE-2026-19155: Use after free in Payments * CVE-2026-19156: Heap buffer overflow in Base * CVE-2026-19157: Out of bounds write in ANGLE * CVE-2026-19158: Use after free in Views * CVE-2026-19159: Use after free in Views * CVE-2026-19160: Uninitialized Use in Skia * CVE-2026-19161: Uninitialized Use in Skia * CVE-2026-19162: Out of bounds write in V8 * CVE-2026-19163: Use after free in Media * CVE-2026-19164: Insufficient validation of untrusted input in Codecs * CVE-2026-19165: Use after free in Extensions * CVE-2026-19166: Use after free in Web Authentication * CVE-2026-19167: Integer overflow in GPU * CVE-2026-19168: Inappropriate implementation in V8 * CVE-2026-19169: Insufficient validation of untrusted input in Contextual Tasks * CVE-2026-19170: Use after free in WebGL * CVE-2026-19171: Use after free in Media * CVE-2026-19172: Use after free in Views * CVE-2026-19173: Out of bounds write in Skia * CVE-2026-19174: Integer overflow in V8 * CVE-2026-19175: Use after free in Payments * CVE-2026-19176: Use after free in Skia * CVE-2026-19177: Insufficient validation of untrusted input in UI * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.71-2 - Fix FTBFS with old system ffmpeg-5.x on el9 * Fri Sep 04 2026 Than Ngo - 151.0.11^chromium151.0.7922.71-1 - security release 151.0.7922.71 includes 370 security fixes * CVE-2026-17650: Use after free in Compositing * CVE-2026-17651: Insufficient validation of untrusted input in Dawn * CVE-2026-17652: Use after free in Views * CVE-2026-17653: Use after free in Skia * CVE-2026-17654: Race in Updater * CVE-2026-17655: Insufficient validation of untrusted input in ANGLE * CVE-2026-17656: Use after free in Ozone * CVE-2026-17657: Use after free in Navigation * CVE-2026-17658: Use after free in V8 * CVE-2026-17659: Inappropriate implementation in SiteIsolation * CVE-2026-17660: Insufficient validation of untrusted input in Network * CVE-2026-17661: Use after free in Loader * CVE-2026-17662: Insufficient policy enforcement in Prefetch * CVE-2026-17663: Insufficient validation of untrusted input in GPU * CVE-2026-17664: Insufficient validation of untrusted input in Loader * CVE-2026-17665: Use after free in V8 * CVE-2026-17666: Cryptographic Flaw in Enterprise * CVE-2026-17667: Uninitialized Use in ANGLE * CVE-2026-17668: Uninitialized Use in ANGLE * CVE-2026-17669: Inappropriate implementation in Chrome for iOS * CVE-2026-17670: Use after free in Views * CVE-2026-17671: Insufficient validation of untrusted input in ANGLE * CVE-2026-17672: Insufficient validation of untrusted input in Chromecast * CVE-2026-17673: Integer overflow in QUIC * CVE-2026-17674: Inappropriate implementation in HTML * CVE-2026-17675: Out of bounds write in ANGLE * CVE-2026-17676: Inappropriate implementation in ANGLE * CVE-2026-17677: Inappropriate implementation in ANGLE * CVE-2026-17678: Out of bounds read in ANGLE * CVE-2026-17679: Insufficient validation of untrusted input in Print Preview * CVE-2026-17680: Heap buffer overflow in Color * CVE-2026-17681: Insufficient validation of untrusted input in Web Authentication * CVE-2026-17682: Integer overflow in ANGLE * CVE-2026-17683: Inappropriate implementation in ANGLE * CVE-2026-17684: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-17685: Use after free in Autofill * CVE-2026-17686: Insufficient validation of untrusted input in Passwords * CVE-2026-17687: Type Confusion in ANGLE * CVE-2026-17688: Use after free in Input * CVE-2026-17689: Uninitialized Use in ANGLE * CVE-2026-17690: Insufficient validation of untrusted input in PDF * CVE-2026-17691: Out of bounds write in ANGLE * CVE-2026-17692: Use after free in DataTransfer * CVE-2026-17693: Inappropriate implementation in FileSystem * CVE-2026-17694: Use after free in DOM * CVE-2026-17695: Inappropriate implementation in ANGLE * CVE-2026-17696: Side-channel information leakage in Media * CVE-2026-17697: Type Confusion in ANGLE * CVE-2026-17698: Insufficient validation of untrusted input in UI * CVE-2026-17699: Use after free in Views * CVE-2026-17700: Insufficient validation of untrusted input in Actor * CVE-2026-17701: Out of bounds read in ANGLE * CVE-2026-17702: Inappropriate implementation in Skia * CVE-2026-17703: Policy bypass in Chrome for iOS * CVE-2026-17704: Use after free in ANGLE * CVE-2026-17705: Integer overflow in libxml * CVE-2026-17706: Insufficient validation of untrusted input in Media * CVE-2026-17707: Uninitialized Use in Media * CVE-2026-17708: Use after free in Audio * CVE-2026-17709: Race in Downloads * CVE-2026-17710: Inappropriate implementation in MHTML * CVE-2026-17711: Race in Downloads * CVE-2026-17712: Race in Skia * CVE-2026-17713: Insufficient validation of untrusted input in Accessibility * CVE-2026-17714: Uninitialized Use in ANGLE * CVE-2026-17715: Inappropriate implementation in Passwords * CVE-2026-17716: Use after free in Updater * CVE-2026-17717: Integer overflow in ANGLE * CVE-2026-17718: Use after free in ANGLE * CVE-2026-17719: Use after free in Input * CVE-2026-17720: Insufficient policy enforcement in Passwords * CVE-2026-17721: Out of bounds write in ANGLE * CVE-2026-17722: Object lifecycle issue in WebView * CVE-2026-17723: Use after free in Media * CVE-2026-17724: Race in Chrome for iOS * CVE-2026-17725: Type Confusion in V8 * CVE-2026-17726: Integer overflow in WebGL * CVE-2026-17727: Out of bounds write in WebGL * CVE-2026-17728: Inappropriate implementation in Extensions * CVE-2026-17758: Heap buffer overflow in Dawn * CVE-2026-17732: Inappropriate implementation in SVG * CVE-2026-17729: Use after free in V8 * CVE-2026-17730: Side-channel information leakage in Autofill * CVE-2026-17731: Inappropriate implementation in Autofill * CVE-2026-17733: Inappropriate implementation in QUIC * CVE-2026-17734: Inappropriate implementation in Autofill * CVE-2026-17735: Insufficient validation of untrusted input in BFCache * CVE-2026-17736: Insufficient validation of untrusted input in WebView * CVE-2026-17737: Use after free in Bluetooth * CVE-2026-17738: Insufficient validation of untrusted input in Payments * CVE-2026-17739: Insufficient policy enforcement in Extensions * CVE-2026-17740: Uninitialized Use in ANGLE * CVE-2026-17741: Insufficient validation of untrusted input in WebView * CVE-2026-17742: Insufficient policy enforcement in Payments * CVE-2026-17743: Insufficient policy enforcement in ControlledFrame * CVE-2026-17744: Inappropriate implementation in File Input * CVE-2026-17745: Out of bounds read in Skia * CVE-2026-17746: Use after free in GPU * CVE-2026-17747: Insufficient validation of untrusted input in Payments * CVE-2026-17748: Inappropriate implementation in Extensions * CVE-2026-17749: Insufficient validation of untrusted input in Extensions * CVE-2026-17750: Use after free in ANGLE * CVE-2026-17751: Inappropriate implementation in AdFilter * CVE-2026-17752: Use after free in Views * CVE-2026-17753: Inappropriate implementation in Autofill * CVE-2026-17754: Inappropriate implementation in Blink * CVE-2026-17755: Incorrect security UI in Extensions * CVE-2026-17756: Insufficient policy enforcement in Presentation * CVE-2026-17757: Uninitialized Use in Skia * CVE-2026-17759: Uninitialized Use in Codecs * CVE-2026-17760: Side- channel information leakage in NoStatePrefetch * CVE-2026-17761: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-17762: Inappropriate implementation in Chrome for iOS * CVE-2026-17763: Inappropriate implementation in GPU * CVE-2026-17764: Inappropriate implementation in FedCM * CVE-2026-17765: Inappropriate implementation in WebProtect * CVE-2026-17766: Insufficient validation of untrusted input in Clipboard * CVE-2026-17767: Insufficient validation of untrusted input in WebView * CVE-2026-17768: Insufficient validation of untrusted input in WebSockets * CVE-2026-17769: Insufficient validation of untrusted input in Cast * CVE-2026-17770: Out of bounds read in Media * CVE-2026-17771: Uninitialized Use in Skia * CVE-2026-17772: Out of bounds read in WebGL * CVE-2026-17773: Insufficient validation of untrusted input in Cast * CVE-2026-17774: Insufficient validation of untrusted input in Variations * CVE-2026-17775: Inappropriate implementation in PresentationAPI * CVE-2026-17776: Policy bypass in Receiver * CVE-2026-17777: Inappropriate implementation in Autofill * CVE-2026-17778: Use after free in Extensions * CVE-2026-17779: Inappropriate implementation in Site Isolation * CVE-2026-17780: Inappropriate implementation in Isolated Web Apps * CVE-2026-17781: Inappropriate implementation in Extensions * CVE-2026-17782: Incorrect security UI in Chrome for iOS * CVE-2026-17783: Inappropriate implementation in Loader * CVE-2026-17784: Use after free in Audio * CVE-2026-17785: Uninitialized Use in ANGLE * CVE-2026-17786: Insufficient validation of untrusted input in DevTools * CVE-2026-17787: Inappropriate implementation in DevTools * CVE-2026-17788: Inappropriate implementation in Blink * CVE-2026-17789: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-17790: Uninitialized Use in ANGLE * CVE-2026-17791: Insufficient validation of untrusted input in Payments * CVE-2026-17792: Inappropriate implementation in Credential Management * CVE-2026-17793: Inappropriate implementation in Messages * CVE-2026-17794: Insufficient validation of untrusted input in Mobile * CVE-2026-17795: Insufficient validation of untrusted input in GetUserMedia * CVE-2026-17796: Side-channel information leakage in WebXR * CVE-2026-17797: Inappropriate implementation in CSS * CVE-2026-17798: Inappropriate implementation in Cast * CVE-2026-17799: Insufficient validation of untrusted input in Safe Browsing * CVE-2026-17800: Side- channel information leakage in MediaRecording * CVE-2026-17801: Out of bounds memory access in ANGLE * CVE-2026-17802: Side-channel information leakage in GPU * CVE-2026-17803: Insufficient validation of untrusted input in Save to Drive * CVE-2026-17804: Use after free in Media * CVE-2026-17805: Insufficient policy enforcement in Glic * CVE-2026-17806: Insufficient validation of untrusted input in Extensions * CVE-2026-17807: Use after free in V8 * CVE-2026-17808: Uninitialized Use in WebGL * CVE-2026-17809: Insufficient validation of untrusted input in Extensions * CVE-2026-17810: Uninitialized Use in Dawn * CVE-2026-17811: Use after free in ANGLE * CVE-2026-17812: Inappropriate implementation in DigitalCredentials * CVE-2026-17813: Insufficient policy enforcement in Chrome for iOS * CVE-2026-17814: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-17815: Insufficient policy enforcement in GuestView * CVE-2026-17816: Inappropriate implementation in Speech * CVE-2026-17817: Inappropriate implementation in ReportingAndNEL * CVE-2026-17818: Inappropriate implementation in Network * CVE-2026-17819: Inappropriate implementation in WebAppInstalls * CVE-2026-17820: Insufficient policy enforcement in Autofill * CVE-2026-17821: Insufficient policy enforcement in Extensions * CVE-2026-17822: Inappropriate implementation in Chrome for iOS * CVE-2026-17823: Insufficient policy enforcement in WebXR * CVE-2026-17824: Insufficient policy enforcement in ServiceWorker * CVE-2026-17825: Insufficient policy enforcement in Passwords * CVE-2026-17826: Inappropriate implementation in Chrome for iOS * CVE-2026-17827: Inappropriate implementation in CSS * CVE-2026-17828: Inappropriate implementation in Chrome for iOS * CVE-2026-17829: Insufficient policy enforcement in Passwords * CVE-2026-17830: Inappropriate implementation in Chrome for iOS * CVE-2026-17831: Insufficient validation of untrusted input in Passwords * CVE-2026-17832: Use after free in ANGLE * CVE-2026-17833: Inappropriate implementation in Passwords * CVE-2026-17834: Inappropriate implementation in Passwords * CVE-2026-17835: Inappropriate implementation in Chrome for iOS * CVE-2026-17836: Use after free in V8 * CVE-2026-17837: Insufficient validation of untrusted input in DevTools * CVE-2026-17838: Incorrect security UI in Chrome for iOS * CVE-2026-17839: Inappropriate implementation in Chrome for iOS * CVE-2026-17840: Incorrect security UI in Passwords * CVE-2026-17841: Race in Chrome for iOS * CVE-2026-17842: Inappropriate implementation in Chrome for iOS * CVE-2026-17843: Inappropriate implementation in CSS * CVE-2026-17844: Insufficient validation of untrusted input in Cast * CVE-2026-17845: Inappropriate implementation in CSS * CVE-2026-17846: Inappropriate implementation in Media * CVE-2026-17847: Insufficient validation of untrusted input in ANGLE * CVE-2026-17848: Insufficient validation of untrusted input in Codecs * CVE-2026-17849: Inappropriate implementation in Chrome for iOS * CVE-2026-17850: Inappropriate implementation in Permissions * CVE-2026-17851: Side-channel information leakage in Autofill * CVE-2026-17852: Inappropriate implementation in Media Router * CVE-2026-17853: Inappropriate implementation in DevTools * CVE-2026-17854: Insufficient policy enforcement in WebMCP * CVE-2026-17855: Race in DevTools * CVE-2026-17856: Inappropriate implementation in Network * CVE-2026-17857: Inappropriate implementation in Network * CVE-2026-17858: Uninitialized Use in WebNN * CVE-2026-17859: Side-channel information leakage in Favicons * CVE-2026-17860: Insufficient validation of untrusted input in Mobile * CVE-2026-17861: Insufficient validation of untrusted input in Updater * CVE-2026-17862: Use after free in Tracing * CVE-2026-17863: Inappropriate implementation in Browser * CVE-2026-17864: Inappropriate implementation in Updater * CVE-2026-17865: Inappropriate implementation in Crypto * CVE-2026-17866: Type Confusion in Tab * CVE-2026-17867: Insufficient validation of untrusted input in Dawn * CVE-2026-17868: Insufficient policy enforcement in USB * CVE-2026-17869: Out of bounds read in WebXR * CVE-2026-17870: Insufficient validation of untrusted input in Cast * CVE-2026-17871: Inappropriate implementation in Passwords * CVE-2026-17872: Cryptographic Flaw in WebAppInstalls * CVE-2026-17873: Insufficient policy enforcement in Chrome for iOS * CVE-2026-17874: Inappropriate implementation in Chrome for iOS * CVE-2026-17875: Use after free in PDFium * CVE-2026-17876: Inappropriate implementation in Payments * CVE-2026-17877: Inappropriate implementation in Chromoting * CVE-2026-17878: Inappropriate implementation in CSS * CVE-2026-17879: Inappropriate implementation in Autofill * CVE-2026-17880: Inappropriate implementation in Autofill * CVE-2026-17881: Use after free in WebXR * CVE-2026-17882: Policy bypass in Extensions * CVE-2026-17883: Inappropriate implementation in Headless * CVE-2026-17884: Object lifecycle issue in WebRTC * CVE-2026-17885: Inappropriate implementation in Paint * CVE-2026-17886: Use after free in Enterprise * CVE-2026-17887: Use after free in TabStrip * CVE-2026-17888: Insufficient validation of untrusted input in WebUI * CVE-2026-17889: Uninitialized Use in WebXR * CVE-2026-17890: Insufficient validation of untrusted input in DevTools * CVE-2026-17891: Use after free in ANGLE * CVE-2026-17892: Inappropriate implementation in WebXR * CVE-2026-17893: Insufficient validation of untrusted input in Updater * CVE-2026-17894: Use after free in Views * CVE-2026-17895: Inappropriate implementation in DataTransfer * CVE-2026-17896: Use after free in DevTools * CVE-2026-17897: Inappropriate implementation in ORB * CVE-2026-17898: Use after free in DevTools * CVE-2026-17899: Insufficient policy enforcement in DevTools * CVE-2026-17900: Inappropriate implementation in Enterprise * CVE-2026-17901: Inappropriate implementation in Sharing * CVE-2026-17902: Inappropriate implementation in Editing * CVE-2026-17903: Insufficient policy enforcement in Chromecast * CVE-2026-17904: Insufficient policy enforcement in NFC * CVE-2026-17905: Inappropriate implementation in SurfaceCapture * CVE-2026-17906: Insufficient validation of untrusted input in Bluetooth * CVE-2026-17907: Side-channel information leakage in Network * CVE-2026-17908: Insufficient validation of untrusted input in Printing * CVE-2026-17909: Insufficient validation of untrusted input in Isolated Web Apps * CVE-2026-17910: Insufficient policy enforcement in NFC * CVE-2026-17911: Insufficient policy enforcement in SVG * CVE-2026-17912: Inappropriate implementation in Chrome for iOS * CVE-2026-17913: Inappropriate implementation in Chrome for iOS * CVE-2026-17914: Side-channel information leakage in Skia * CVE-2026-17915: Inappropriate implementation in WebView * CVE-2026-17916: Insufficient policy enforcement in Settings * CVE-2026-17917: Policy bypass in Chrome for iOS * CVE-2026-17918: Use after free in Sync * CVE-2026-17919: Insufficient policy enforcement in Enterprise * CVE-2026-17920: Use after free in V8 * CVE-2026-17921: Insufficient validation of untrusted input in Navigation * CVE-2026-17922: Inappropriate implementation in Enterprise * CVE-2026-17923: Policy bypass in Enterprise * CVE-2026-17924: Use after free in DNS * CVE-2026-17925: Inappropriate implementation in Cast * CVE-2026-17926: Insufficient validation of untrusted input in DevTools * CVE-2026-17927: Insufficient policy enforcement in DevTools * CVE-2026-17928: Inappropriate implementation in DataTransfer * CVE-2026-17929: Insufficient validation of untrusted input in DevTools * CVE-2026-17930: Insufficient validation of untrusted input in Extensions * CVE-2026-17931: Inappropriate implementation in DevTools * CVE-2026-17932: Use after free in DataTransfer * CVE-2026-17933: Inappropriate implementation in DOMStorage * CVE-2026-17934: Insufficient validation of untrusted input in DevTools * CVE-2026-17935: Heap buffer overflow in Codecs * CVE-2026-17936: Inappropriate implementation in DevTools * CVE-2026-17937: Inappropriate implementation in DevTools * CVE-2026-17938: Inappropriate implementation in FullScreen * CVE-2026-17939: Inappropriate implementation in Passwords * CVE-2026-17940: Insufficient validation of untrusted input in Picture-in- Picture * CVE-2026-17941: Inappropriate implementation in Chrome for iOS * CVE-2026-17942: Side-channel information leakage in SVG * CVE-2026-17943: Inappropriate implementation in Parser * CVE-2026-17944: Inappropriate implementation in Chrome for iOS * CVE-2026-17945: Inappropriate implementation in Navigation * CVE-2026-17946: Uninitialized Use in Dawn * CVE-2026-17947: Use after free in WebSockets * CVE-2026-17948: Type Confusion in V8 * CVE-2026-17949: Uninitialized Use in GPU * CVE-2026-17950: Policy bypass in Safebrowsing * CVE-2026-17951: Heap buffer overflow in WebRTC * CVE-2026-17952: Inappropriate implementation in V8 * CVE-2026-17953: Insufficient policy enforcement in WebView * CVE-2026-17954: Policy bypass in MHTML * CVE-2026-17955: Insufficient validation of untrusted input in Payments * CVE-2026-17956: Inappropriate implementation in Scheduling * CVE-2026-17957: Inappropriate implementation in CORS * CVE-2026-17958: Inappropriate implementation in Views * CVE-2026-17959: Inappropriate implementation in Network * CVE-2026-17960: Inappropriate implementation in Chrome for iOS * CVE-2026-17961: Inappropriate implementation in Session * CVE-2026-17962: Inappropriate implementation in Blink * CVE-2026-17963: Inappropriate implementation in SVG * CVE-2026-17964: Incorrect security UI in UI * CVE-2026-17965: Incorrect security UI in Chrome for iOS * CVE-2026-17966: Inappropriate implementation in Views * CVE-2026-17967: Use after free in Chrome for iOS * CVE-2026-17968: Uninitialized Use in WebXR * CVE-2026-17969: Inappropriate implementation in Passwords * CVE-2026-17970: Insufficient validation of untrusted input in Passwords * CVE-2026-17971: Inappropriate implementation in Frame * CVE-2026-17972: Inappropriate implementation in Chrome for iOS * CVE-2026-17973: Inappropriate implementation in Views * CVE-2026-17974: Insufficient policy enforcement in DevTools * CVE-2026-17975: Inappropriate implementation in IME * CVE-2026-17976: Policy bypass in Extensions * CVE-2026-17977: Policy bypass in CSS * CVE-2026-17978: Side- channel information leakage in WebCodecs * CVE-2026-17979: Race in V8 * CVE-2026-17980: Inappropriate implementation in UI * CVE-2026-17981: Inappropriate implementation in Blink * CVE-2026-17982: Insufficient validation of untrusted input in Cast * CVE-2026-17983: Incorrect security UI in Global Media Controls * CVE-2026-17984: Inappropriate implementation in Browser * CVE-2026-17985: Insufficient policy enforcement in Speech * CVE-2026-17986: Insufficient policy enforcement in Bluetooth * CVE-2026-17987: Insufficient validation of untrusted input in Notifications * CVE-2026-17988: Insufficient validation of untrusted input in Navigation * CVE-2026-17989: Type Confusion in V8 * CVE-2026-17990: Insufficient validation of untrusted input in WebAuthn * CVE-2026-17991: Insufficient validation of untrusted input in AI * CVE-2026-17992: Uninitialized Use in Skia * CVE-2026-17993: Race in Updater * CVE-2026-17994: Inappropriate implementation in Media * CVE-2026-17995: Out of bounds read in Dawn * CVE-2026-17996: Inappropriate implementation in Browser * CVE-2026-17997: Inappropriate implementation in Passwords * CVE-2026-17998: Incorrect security UI in Extensions * CVE-2026-17999: Incorrect security UI in PictureInPicture * CVE-2026-18000: Insufficient policy enforcement in USB * CVE-2026-18001: Inappropriate implementation in WebGL * CVE-2026-18002: Insufficient validation of untrusted input in Google Lens * CVE-2026-18003: Inappropriate implementation in Chrome for iOS * CVE-2026-18004: Insufficient policy enforcement in Speech * CVE-2026-18005: Inappropriate implementation in WebXR * CVE-2026-18006: Inappropriate implementation in Google Lens * CVE-2026-18007: Inappropriate implementation in Input * CVE-2026-18008: Inappropriate implementation in Settings * CVE-2026-18009: Insufficient validation of untrusted input in Passwords * CVE-2026-18010: Inappropriate implementation in Passwords * CVE-2026-18011: Inappropriate implementation in Chrome for iOS * CVE-2026-18012: Use after free in PDFium * CVE-2026-18013: Inappropriate implementation in Chrome for iOS * CVE-2026-18014: Insufficient validation of untrusted input in DevTools * CVE-2026-18015: Inappropriate implementation in Tint * CVE-2026-18016: Insufficient policy enforcement in Chrome for iOS * CVE-2026-18017: Use after free in Dawn * CVE-2026-18018: Inappropriate implementation in Updater * CVE-2026-18019: Side-channel information leakage in Media - Refresh patches - Remove bundle golang and replace it with system golang - Fix build error caused by unresolve dependency histogram_xml - Fix unknown warning options which are not supported in old clang version - Drop patches which are merged in upstream * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.186-1 - Update to 150.0.7871.186 * CVE-2026-16807: Out of bounds write in Codecs * CVE-2026-16806: Use after free in WebMCP * CVE-2026-16805: Use after free in Blink * CVE-2026-16804: Use after free in Input * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.181-1 - Update to 150.0.7871.181 * CVE-2026-16413: Out of bounds write in ANGLE * CVE-2026-16414: Insufficient validation of untrusted input in Chromecast * CVE-2026-16415: Insufficient validation of untrusted input in Extensions * CVE-2026-16416: Integer overflow in Chromecast * CVE-2026-16417: Uninitialized Use in Skia * CVE-2026-16418: Stack buffer overflow in V8 * CVE-2026-16419: Out of bounds read and write in ANGLE * CVE-2026-16420: Type Confusion in WebAudio * CVE-2026-16421: Inappropriate implementation in WebAudio * CVE-2026-16422: Insufficient validation of untrusted input in Certificate * CVE-2026-16423: Use after free in UI * CVE-2026-16424: Use after free in GPU * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.128-3 - Improve auto darkmode * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.128-2 - Update chromium-150-pt_regs-kernel-7.2.0.patch, thanks to dhorak - Fix install error * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.128-1 - Update to 150.0.7871.128 * CVE-2026-15899: Use after free in CameraCapture * CVE-2026-15900: Use after free in GPU * CVE-2026-15901: Use after free in Network * CVE-2026-15902: Use after free in Cast * CVE-2026-15903: Out of bounds read and write in V8 * CVE-2026-15904: Use after free in Ozone * CVE-2026-15905: Use after free in Aura - Fix rhbz#2501811, Drop AI policy which breaks DoH settings * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.124-1 - Update to 150.0.7871.124 * CVE-2026-15764: Use after free in Ozone * CVE-2026-15765: Use after free in Ozone * CVE-2026-15766: Uninitialized Use in Skia * CVE-2026-15767: Heap buffer overflow in libyuv * CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas * CVE-2026-15769: Insufficient validation of untrusted input in Linux Toolkit Theming * CVE-2026-15770: Uninitialized Use in V8 * CVE-2026-15771: Insufficient validation of untrusted input in Media * CVE-2026-15772: Use after free in GPU * CVE-2026-15773: Use after free in Core * CVE-2026-15774: Use after free in Skia * CVE-2026-15775: Insufficient policy enforcement in V8 * CVE-2026-15776: Type Confusion in V8 * CVE-2026-15777: Use after free in UI * CVE-2026-15778: Insufficient validation of untrusted input in Navigation - Backport patches to improve auto darkmode * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.114-1 - Update to 150.0.7871.114 * CVE-2026-15112: Use after free in Ozone * CVE-2026-15129: Use after free in Views * CVE-2026-15132: Uninitialized Use in V8 * CVE-2026-15133: Use after free in InterestGroups * CVE-2026-15108: Integer overflow in Extensions API * CVE-2026-15109: Uninitialized Use in ANGLE * CVE-2026-15110: Use after free in Extensions * CVE-2026-15111: Use after free in Views * CVE-2026-15113: Use after free in Autofill * CVE-2026-15114: Out of bounds read and write in Codecs * CVE-2026-15115: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-15116: Use after free in Actor * CVE-2026-15117: Use after free in Payments * CVE-2026-15118: Use after free in Input * CVE-2026-15119: Inappropriate implementation in GetUserMedia * CVE-2026-15120: Use after free in Core * CVE-2026-15121: Use after free in WebRTC * CVE-2026-15122: Insufficient validation of untrusted input in Codecs * CVE-2026-15123: Insufficient data validation in DOM * CVE-2026-15124: Insufficient policy enforcement in Passwords * CVE-2026-15125: Inappropriate implementation in Forms * CVE-2026-15126: Use after free in Forms * CVE-2026-15127: Inappropriate implementation in WebGL * CVE-2026-15128: Inappropriate implementation in Forms * CVE-2026-15130: Insufficient policy enforcement in Navigation * CVE-2026-15107: Use after free in IndexedDB * CVE-2026-15131: Insufficient data validation in Navigation * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.100-1 - Update to 150.0.7871.100 - Fix installation issue caused by the hard link in locales * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.46-2 - Fix FTBSF with kernel-7.2.0 (fedora 45 and rhel-11) * Fri Sep 04 2026 Than Ngo - 150.0.11^chromium150.0.7871.46-1 - Update to 150.0.7871.46 * CVE-2026-13774: Use after free in Extensions * CVE-2026-13775: Use after free in GPU * CVE-2026-13776: Type Confusion in Dawn * CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb * CVE-2026-13778: Use after free in WebUSB * CVE-2026-13779: Use after free in Chromoting * CVE-2026-13780: Insufficient validation of untrusted input in ANGLE * CVE-2026-13781: Insufficient validation of untrusted input in Skia * CVE-2026-13782: Use after free in Browser * CVE-2026-13783: Use after free in Views * CVE-2026-13784: Use after free in Views * CVE-2026-13785: Use after free in Bluetooth * CVE-2026-13786: Use after free in Ozone * CVE-2026-13787: Use after free in Chromoting * CVE-2026-13788: Use after free in Fullscreen * CVE-2026-13789: Use after free in GPU * CVE-2026-13790: Side-channel information leakage in Scroll * CVE-2026-13791: Insufficient validation of untrusted input in Downloads * CVE-2026-13792: Use after free in Touchbar * CVE-2026-13793: Insufficient policy enforcement in SVG * CVE-2026-13794: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-13795: Insufficient policy enforcement in Chrome for iOS * CVE-2026-13796: Integer overflow in Chromecast * CVE-2026-13797: Insufficient validation of untrusted input in Chromecast * CVE-2026-13798: Heap buffer overflow in Chromecast * CVE-2026-13799: Use after free in QUIC * CVE-2026-13800: Inappropriate implementation in Updater * CVE-2026-13801: Integer overflow in Chromecast * CVE-2026-13802: Use after free in Views * CVE-2026-13803: Type Confusion in Chrome Tabs * CVE-2026-13804: Use after free in Chromecast * CVE-2026-13805: Use after free in GFX * CVE-2026-13806: Insufficient validation of untrusted input in Accessibility * CVE-2026-13807: Use after free in Import * CVE-2026-13808: Insufficient data validation in Chrome for iOS * CVE-2026-13809: Side-channel information leakage in Safe Browsing * CVE-2026-13810: Inappropriate implementation in Input * CVE-2026-13811: Use after free in IME * CVE-2026-13812: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13813: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13814: Use after free in Views * CVE-2026-13815: Use after free in Blink * CVE-2026-13816: Insufficient validation of untrusted input in File Input * CVE-2026-13817: Insufficient validation of untrusted input in Glic * CVE-2026-13818: Inappropriate implementation in Passwords * CVE-2026-13819: Out of bounds read in ANGLE * CVE-2026-13820: Out of bounds read in Skia * CVE-2026-13821: Use after free in Canvas * CVE-2026-13822: Inappropriate implementation in Extensions * CVE-2026-13823: Use after free in Glic * CVE-2026-13824: Insufficient validation of untrusted input in Extensions * CVE-2026-13825: Uninitialized Use in Dawn * CVE-2026-13826: Inappropriate implementation in Autofill * CVE-2026-13827: Use after free in Updater * CVE-2026-13828: Inappropriate implementation in Enterprise * CVE-2026-13829: Insufficient validation of untrusted input in Settings * CVE-2026-13830: Use after free in Chromoting * CVE-2026-13831: Use after free in GPU * CVE-2026-13832: Use after free in Headless * CVE-2026-13833: Uninitialized Use in ANGLE * CVE-2026-13834: Insufficient validation of untrusted input in ANGLE * CVE-2026-13835: Inappropriate implementation in XML * CVE-2026-13836: Inappropriate implementation in CSS * CVE-2026-13837: Inappropriate implementation in CSS * CVE-2026-13838: Inappropriate implementation in CSS * CVE-2026-13839: Inappropriate implementation in CSS * CVE-2026-13840: Insufficient policy enforcement in Canvas * CVE-2026-13841: Integer overflow in Skia * CVE-2026-13842: Incorrect security UI in Chrome for iOS * CVE-2026-13843: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13844: Use after free in Updater * CVE-2026-13845: Use after free in DOM * CVE-2026-13846: Use after free in USB * CVE-2026-13847: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13848: Use after free in Forms * CVE-2026-13849: Insufficient validation of untrusted input in Chromoting * CVE-2026-13850: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13851: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-13852: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-13853: Use after free in Journeys * CVE-2026-13854: Use after free in Ozone * CVE-2026-13855: Use after free in Ozone * CVE-2026-13856: Insufficient validation of untrusted input in Speech * CVE-2026-13857: Inappropriate implementation in Geometry * CVE-2026-13858: Out of bounds read in FFmpeg * CVE-2026-13859: Inappropriate implementation in ANGLE * CVE-2026-13860: Incorrect security UI in Autofill * CVE-2026-13861: Use after free in Core * CVE-2026-13862: Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) * CVE-2026-13863: Insufficient validation of untrusted input in CustomTabs * CVE-2026-13864: Insufficient policy enforcement in WebHID * CVE-2026-13865: Insufficient validation of untrusted input in Enterprise * CVE-2026-13866: Insufficient validation of untrusted input in Input * CVE-2026-13867: Inappropriate implementation in Geolocation * CVE-2026-13868: Inappropriate implementation in Network * CVE-2026-13869: Use after free in Device * CVE-2026-13870: Use after free in WebView * CVE-2026-13871: Insufficient data validation in GuestView * CVE-2026-13872: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-13873: Out of bounds memory access in Layout * CVE-2026-13874: Inappropriate implementation in DataTransfer * CVE-2026-13875: Insufficient validation of untrusted input in GPU * CVE-2026-13876: Inappropriate implementation in Network * CVE-2026-13877: Insufficient validation of untrusted input in ANGLE * CVE-2026-13878: Use after free in Bluetooth * CVE-2026-13879: Use after free in Bluetooth * CVE-2026-13880: Use after free in USB * CVE-2026-13881: Insufficient data validation in WebAppInstalls * CVE-2026-13882: Inappropriate implementation in USB * CVE-2026-13883: Type Confusion in ANGLE * CVE-2026-13884: Heap buffer overflow in Chromecast * CVE-2026-13885: Use after free in Skia * CVE-2026-13886: Policy bypass in Isolated Web Apps * CVE-2026-13887: Insufficient policy enforcement in NFC * CVE-2026-13888: Use after free in Extensions * CVE-2026-13889: Insufficient validation of untrusted input in WebAuthentication * CVE-2026-13890: Out of bounds read in Chromecast * CVE-2026-13891: Insufficient validation of untrusted input in Extensions * CVE-2026-13892: Inappropriate implementation in Chrome for iOS * CVE-2026-13893: Insufficient validation of untrusted input in WebUI * CVE-2026-13894: Insufficient policy enforcement in Network * CVE-2026-13895: Inappropriate implementation in Autofill * CVE-2026-13896: Insufficient policy enforcement in Glic * CVE-2026-13897: Insufficient policy enforcement in Chromecast * CVE-2026-13898: Use after free in Cast Receiver * CVE-2026-13899: Use after free in HTML * CVE-2026-13900: Insufficient validation of untrusted input in Chromecast * CVE-2026-13901: Insufficient validation of untrusted input in Serial * CVE-2026-13902: Inappropriate implementation in Chrome for iOS * CVE-2026-13903: Insufficient policy enforcement in Bluetooth * CVE-2026-13904: Incorrect security UI in Safe Browsing * CVE-2026-13905: Incorrect security UI in Chrome for iOS * CVE-2026-13906: Out of bounds read in Codecs * CVE-2026-13907: Inappropriate implementation in iOSWeb * CVE-2026-13908: Insufficient validation of untrusted input in Omnibox * CVE-2026-13909: Insufficient policy enforcement in DevTools * CVE-2026-13910: Insufficient policy enforcement in WebXR * CVE-2026-13911: Insufficient data validation in Spellcheck * CVE-2026-13912: Incorrect security UI in Safe Browsing * CVE-2026-13913: Insufficient policy enforcement in Autofill * CVE-2026-13914: Inappropriate implementation in Passwords * CVE-2026-13915: Use after free in Chrome for iOS * CVE-2026-13916: Inappropriate implementation in Chrome for iOS * CVE-2026-13917: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13918: Use after free in Chrome for iOS * CVE-2026-13919: Insufficient data validation in Extensions * CVE-2026-13920: Insufficient validation of untrusted input in Media * CVE-2026-13921: Insufficient validation of untrusted input in DeviceBoundSessionCredentials * CVE-2026-13922: Side-channel information leakage in Paint * CVE-2026-13923: Uninitialized Use in GPU * CVE-2026-13924: Insufficient validation of untrusted input in WebView * CVE-2026-13925: Inappropriate implementation in Downloads * CVE-2026-13926: Insufficient validation of untrusted input in Network * CVE-2026-13927: Insufficient validation of untrusted input in UI * CVE-2026-13928: Insufficient validation of untrusted input in Enterprise * CVE-2026-13929: Insufficient validation of untrusted input in DevTools * CVE-2026-13930: Insufficient policy enforcement in Actor * CVE-2026-13931: Inappropriate implementation in Media * CVE-2026-13932: Inappropriate implementation in Sharing * CVE-2026-13933: Insufficient policy enforcement in Passwords * CVE-2026-13934: Insufficient validation of untrusted input in Dawn * CVE-2026-13935: Side-channel information leakage in ComputePressure * CVE-2026-13936: Inappropriate implementation in Passwords * CVE-2026-13937: Insufficient policy enforcement in Passwords * CVE-2026-13938: Integer overflow in Fonts * CVE-2026-13939: Insufficient validation of untrusted input in WebShare * CVE-2026-13940: Uninitialized Use in Cast * CVE-2026-13941: Inappropriate implementation in SiteSettings * CVE-2026-13942: Insufficient validation of untrusted input in Video Capture * CVE-2026-13943: Uninitialized Use in CSS * CVE-2026-13944: Inappropriate implementation in DataTransfer * CVE-2026-13945: Insufficient policy enforcement in Extensions * CVE-2026-13946: Inappropriate implementation in ScriptInjections * CVE-2026-13947: Uninitialized Use in XR * CVE-2026-13948: Insufficient policy enforcement in Extensions * CVE-2026-13949: Insufficient policy enforcement in Payments * CVE-2026-13950: Uninitialized Use in GPU * CVE-2026-13951: Policy bypass in USB * CVE-2026-13952: Inappropriate implementation in PerformanceAPIs * CVE-2026-13953: Inappropriate implementation in SplitView * CVE-2026-13954: Insufficient policy enforcement in XML * CVE-2026-13955: Insufficient validation of untrusted input in CustomTabs * CVE-2026-13956: Incorrect security UI in PageInfo * CVE-2026-13957: Incorrect security UI in Extensions * CVE-2026-13958: Uninitialized Use in Codecs * CVE-2026-13959: Insufficient validation of untrusted input in Blink * CVE-2026-13960: Inappropriate implementation in Passwords * CVE-2026-13961: Insufficient validation of untrusted input in DevTools * CVE-2026-13962: Insufficient data validation in PDF * CVE-2026-13963: Inappropriate implementation in DevTools * CVE-2026-13964: Insufficient policy enforcement in WebView * CVE-2026-13965: Use after free in Oilpan * CVE-2026-13966: Inappropriate implementation in History * CVE-2026-13967: Type Confusion in V8 * CVE-2026-13968: Insufficient validation of untrusted input in DevTools * CVE-2026-13969: Uninitialized Use in UI * CVE-2026-13970: Uninitialized Use in Media * CVE-2026-13971: Uninitialized Use in Skia * CVE-2026-13972: Inappropriate implementation in Paint * CVE-2026-13973: Inappropriate implementation in UI * CVE-2026-13974: Integer overflow in Safe Browsing * CVE-2026-13975: Out of bounds read in ANGLE * CVE-2026-13976: Heap buffer overflow in Storage * CVE-2026-13977: Inappropriate implementation in HTMLParser * CVE-2026-13978: Insufficient policy enforcement in PageInfo * CVE-2026-13979: Inappropriate implementation in Paint * CVE-2026-13980: Incorrect security UI in Chrome for iOS * CVE-2026-13981: Inappropriate implementation in Chrome for iOS * CVE-2026-13982: Incorrect security UI in Passwords * CVE-2026-13983: Incorrect security UI in Chrome for iOS * CVE-2026-13984: Incorrect security UI in TabStrip * CVE-2026-13985: Inappropriate implementation in MediaCapture * CVE-2026-13986: Inappropriate implementation in Media UI * CVE-2026-13987: Incorrect security UI in Mobile * CVE-2026-13988: Inappropriate implementation in Paint * CVE-2026-13989: Insufficient policy enforcement in PageInfo * CVE-2026-13990: Insufficient validation of untrusted input in DataTransfer * CVE-2026-13991: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-13992: Inappropriate implementation in UI * CVE-2026-13993: Incorrect security UI in WebAppInstalls * CVE-2026-13994: Inappropriate implementation in Credential Management * CVE-2026-13995: Insufficient validation of untrusted input in Autofill * CVE-2026-13996: Incorrect security UI in Permissions * CVE-2026-13997: Incorrect security UI in Extensions * CVE-2026-13998: Incorrect security UI in File Input * CVE-2026-13999: Inappropriate implementation in Extensions * CVE-2026-14000: Inappropriate implementation in XML * CVE-2026-14001: Inappropriate implementation in Network * CVE-2026-14002: Inappropriate implementation in Geolocation * CVE-2026-14003: Insufficient policy enforcement in Extensions * CVE-2026-14004: Inappropriate implementation in CSS * CVE-2026-14005: Use after free in Omnibox * CVE-2026-14006: Use after free in Navigation * CVE-2026-14007: Insufficient policy enforcement in PermissionsPolicy * CVE-2026-14008: Uninitialized Use in WebXR * CVE-2026-14009: Insufficient data validation in Passwords * CVE-2026-14010: Uninitialized Use in Codecs * CVE-2026-14011: Out of bounds read in SurfaceCapture * CVE-2026-14012: Side-channel information leakage in CSS * CVE-2026-14013: Inappropriate implementation in SVG * CVE-2026-14014: Inappropriate implementation in Paint * CVE-2026-14015: Inappropriate implementation in WebRTC * CVE-2026-14016: Insufficient policy enforcement in SVG * CVE-2026-14017: Inappropriate implementation in Navigation * CVE-2026-14018: Use after free in Updater * CVE-2026-14019: Inappropriate implementation in Passwords * CVE-2026-14020: Insufficient validation of untrusted input in WebXR * CVE-2026-14021: Insufficient validation of untrusted input in StorageAccessAPI * CVE-2026-14022: Insufficient validation of untrusted input in Network * CVE-2026-14023: Insufficient validation of untrusted input in SanitizerAPI * CVE-2026-14024: Use after free in Ozone * CVE-2026-14025: Use after free in Views * CVE-2026-14026: Incorrect security UI in SplitView * CVE-2026-14027: Use after free in SignIn * CVE-2026-14028: Incorrect security UI in Chrome for iOS * CVE-2026-14030: Incorrect security UI in SplitView * CVE-2026-14031: Incorrect security UI in File Input * CVE-2026-14032: Use after free in Bluetooth * CVE-2026-14033: Insufficient policy enforcement in Media * CVE-2026-14034: Inappropriate implementation in WebXR * CVE-2026-14035: Insufficient policy enforcement in Bluetooth * CVE-2026-14036: Insufficient policy enforcement in Bluetooth * CVE-2026-14037: Insufficient policy enforcement in GPU * CVE-2026-14038: Insufficient validation of untrusted input in New Tab Page * CVE-2026-14039: Insufficient policy enforcement in GetUserMedia * CVE-2026-14040: Use after free in BrowserTag * CVE-2026-14041: Insufficient policy enforcement in Serial * CVE-2026-14042: Inappropriate implementation in Isolated Web Apps * CVE-2026-14043: Use after free in GetUserMedia * CVE-2026-14044: Use after free in ANGLE * CVE-2026-14045: Insufficient validation of untrusted input in Network * CVE-2026-14046: Inappropriate implementation in CustomTabs * CVE-2026-14047: Insufficient policy enforcement in Extensions * CVE-2026-14048: Use after free in Chromecast * CVE-2026-14049: Inappropriate implementation in GPU * CVE-2026-14050: Insufficient policy enforcement in Passwords * CVE-2026-14051: Uninitialized Use in GamepadAPI * CVE-2026-14052: Insufficient policy enforcement in FileSystem * CVE-2026-14053: Insufficient policy enforcement in Extensions * CVE-2026-14054: Insufficient policy enforcement in Network * CVE-2026-14055: Insufficient validation of untrusted input in Device Trust * CVE-2026-14056: Insufficient validation of untrusted input in Media * CVE-2026-14057: Insufficient policy enforcement in FedCM * CVE-2026-14058: Policy bypass in Parser * CVE-2026-14059: Insufficient policy enforcement in Related-Website-Sets * CVE-2026-14060: Insufficient validation of untrusted input in Chromoting * CVE-2026-14061: Inappropriate implementation in Dawn * CVE-2026-14062: Inappropriate implementation in Views * CVE-2026-14063: Out of bounds memory access in Chromecast * CVE-2026-14064: Use after free in PageInfo * CVE-2026-14065: Insufficient validation of untrusted input in PageInfo * CVE-2026-14066: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-14067: Use after free in Chrome for iOS * CVE-2026-14068: Inappropriate implementation in Omnibox * CVE-2026-14069: Integer overflow in WebNN * CVE-2026-14070: Uninitialized Use in WebNN * CVE-2026-14071: Side-channel information leakage in WebAudio * CVE-2026-14072: Incorrect security UI in SplitView * CVE-2026-14073: Insufficient policy enforcement in WebXR * CVE-2026-14074: Side-channel information leakage in WebAuthentication * CVE-2026-14075: Policy bypass in Chrome for iOS * CVE-2026-14076: Policy bypass in Network * CVE-2026-14077: Incorrect security UI in Select * CVE-2026-14078: Policy bypass in WebRTC * CVE-2026-14079: Policy bypass in Network * CVE-2026-14080: Insufficient validation of untrusted input in TabSwitcher * CVE-2026-14081: Insufficient policy enforcement in DevTools * CVE-2026-14082: Race in Storage * CVE-2026-14083: Insufficient validation of untrusted input in HTML * CVE-2026-14084: Insufficient validation of untrusted input in Chromoting * CVE-2026-14085: Side-channel information leakage in CSS * CVE-2026-14086: Insufficient policy enforcement in HID * CVE-2026-14087: Insufficient validation of untrusted input in WebNN * CVE-2026-14088: Uninitialized Use in Canvas * CVE-2026-14089: Insufficient validation of untrusted input in PopupBlocker * CVE-2026-14090: Out of bounds read in CameraCapture * CVE-2026-14091: Use after free in DevTools * CVE-2026-14092: Insufficient policy enforcement in Privacy * CVE-2026-14093: Use after free in Cast * CVE-2026-14094: Use after free in Installer * CVE-2026-14095: Insufficient validation of untrusted input in Browser * CVE-2026-14096: Object lifecycle issue in Input * CVE-2026-14097: Inappropriate implementation in WebAppInstalls * CVE-2026-14098: Inappropriate implementation in CSS * CVE-2026-14099: Use after free in Chrome for iOS * CVE-2026-14100: Insufficient data validation in NetworkCache * CVE-2026-14101: Insufficient policy enforcement in Sandbox * CVE-2026-14102: Use after free in Passwords * CVE-2026-14103: Use after free in SSL * CVE-2026-14104: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-14105: Insufficient policy enforcement in Speech * CVE-2026-14106: Insufficient validation of untrusted input in Text * CVE-2026-14107: Use after free in Scheduling * CVE-2026-14108: Use after free in PDFium * CVE-2026-14109: Insufficient policy enforcement in Mojo * CVE-2026-14110: Inappropriate implementation in DarkMode * CVE-2026-14111: Use after free in WebProtect * CVE-2026-14112: Inappropriate implementation in Enterprise * CVE-2026-14113: Use after free in Updater * CVE-2026-14114: Inappropriate implementation in WebAppInstalls * CVE-2026-14115: Insufficient validation of untrusted input in Cast * CVE-2026-14116: Insufficient validation of untrusted input in DevTools * CVE-2026-14117: Insufficient validation of untrusted input in DevTools * CVE-2026-14118: Insufficient data validation in DevTools * CVE-2026-14119: Type Confusion in Bluetooth * CVE-2026-14120: Inappropriate implementation in DevTools * CVE-2026-14121: Use after free in Chromoting * CVE-2026-14122: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-14123: Incorrect security UI in Chrome for iOS * CVE-2026-14124: Inappropriate implementation in CredentialProvider * CVE-2026-14125: Uninitialized Use in ANGLE * CVE-2026-14126: Incorrect security UI in UI * CVE-2026-14127: Inappropriate implementation in Printing * CVE-2026-14128: Insufficient data validation in Chrome for iOS * CVE-2026-14129: Incorrect security UI in PreviewTab * CVE-2026-14130: Incorrect security UI in Omnibox * CVE-2026-14131: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-14132: Inappropriate implementation in WebXR * CVE-2026-14133: Race in History Embeddings * CVE-2026-14134: Inappropriate implementation in Autofill * CVE-2026-14135: Insufficient validation of untrusted input in Network * CVE-2026-14136: Incorrect security UI in Chrome for iOS * CVE-2026-14137: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-14138: Inappropriate implementation in WebAppInstalls * CVE-2026-14139: Inappropriate implementation in TabStrip * CVE-2026-14140: Insufficient validation of untrusted input in Input * CVE-2026-14141: Incorrect security UI in Document Picture-in-Picture * CVE-2026-14142: Inappropriate implementation in Extensions * CVE-2026-14143: Incorrect security UI in Passwords * CVE-2026-14144: Incorrect security UI in Views * CVE-2026-14145: Inappropriate implementation in CSS * CVE-2026-14146: Inappropriate implementation in CSS * CVE-2026-14147: Inappropriate implementation in CSS * CVE-2026-14148: Type Confusion in CSS * CVE-2026-14149: Use after free in Audio * CVE-2026-14150: Insufficient validation of untrusted input in Speech * CVE-2026-14151: Inappropriate implementation in AI * CVE-2026-14152: Out of bounds write in ANGLE * CVE-2026-14153: Inappropriate implementation in Glic * CVE-2026-14154: Inappropriate implementation in DevTools * CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI * CVE-2026-14156: Policy bypass in StorageAccessAPI - Remove Darkmode patches, which are already included in v150 - Refresh patches for v150 - Fix FTBFS with system ffmpeg - Backport upstream patches to fix FTBFS * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.200-1 - Update to 149.0.7827.200 CVE-2026-13281: Integer overflow in Mojo CVE-2026-13282: Use after free in Payments CVE-2026-13283: Use after free in AdFilter * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.196-2 - 149.0.7827.196 security release * CVE-2026-13028: Use after free in WebGL * CVE-2026-13032: Use after free in WebGL * CVE-2026-13033: Out of bounds read in Blink>InterestGroups * CVE-2026-13038: Use after free in Autofill * CVE-2026-13021: Inappropriate implementation in DeviceBoundSessionCredentials * CVE-2026-13022: Inappropriate implementation in Autofill * CVE-2026-13023: Uninitialized Use in GPU * CVE-2026-13024: Insufficient validation of untrusted input in Navigation * CVE-2026-13025: Insufficient validation of untrusted input in DevTools * CVE-2026-13026: Use after free in Digital Credentials * CVE-2026-13027: Use after free in FileSystem * CVE-2026-13029: Use after free in Web Authentication * CVE-2026-13030: Uninitialized Use in GPU * CVE-2026-13031: Use after free in Blink * CVE-2026-13034: Inappropriate implementation in Passwords * CVE-2026-13035: Use after free in Bluetooth * CVE-2026-13036: Use after free in Blink * CVE-2026-13037: Use after free in WebView * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.196-1 - Update to 149.0.7827.196 - Upstream patch, Make dark mode apply filter to images irrespective of layout zoom * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.155-1 - Update to 149.0.7827.155 * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.114-3 - Remove old rust_alloc_error_handler_should_panic patch * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.114-2 - Add missing disable-ai.json * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.114-1 - Update to 149.0.7827.114 * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.102-1 - Update to 149.0.7827.102 * CVE-2026-11628: Use after free in Ozone * CVE-2026-11629: Use after free in Ozone * CVE-2026-11630: Use after free in File Input * CVE-2026-11631: Use after free in Aura * CVE-2026-11632: Use after free in TabStrip * CVE-2026-11633: Use after free in Bluetooth * CVE-2026-11634: Use after free in Gamepad * CVE-2026-11635: Use after free in Bluetooth * CVE-2026-11636: Use after free in Autofill * CVE-2026-11637: Use after free in Views * CVE-2026-11638: Use after free in Printing * CVE-2026-11639: Use after free in Compositing * CVE-2026-11640: Integer overflow in libyuv * CVE-2026-11641: Use after free in Bluetooth * CVE-2026-11642: Use after free in Web Apps * CVE-2026-11643: Use after free in Proxy * CVE-2026-11644: Use after free in Views * CVE-2026-11645: Out of bounds memory access in V8 * CVE-2026-11646: Use after free in ViewTransitions * CVE-2026-11647: Use after free in Printing * CVE-2026-11648: Use after free in FullScreen * CVE-2026-11649: Use after free in V8 * CVE-2026-11650: Use after free in V8 * CVE-2026-11651: Use after free in Network * CVE-2026-11652: Use after free in Extensions * CVE-2026-11653: Insufficient validation of untrusted input in Extensions * CVE-2026-11654: Use after free in CameraCapture * CVE-2026-11655: Integer overflow in Media * CVE-2026-11656: Use after free in ServiceWorker * CVE-2026-11657: Use after free in Payments * CVE-2026-11658: Insufficient validation of untrusted input in Extensions * CVE-2026-11659: Insufficient validation of untrusted input in UI * CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page * CVE-2026-11661: Use after free in Views * CVE-2026-11662: Type Confusion in Bindings * CVE-2026-11663: Use after free in Skia * CVE-2026-11664: Use after free in Payments * CVE-2026-11665: Out of bounds read in Dawn * CVE-2026-11666: Insufficient validation of untrusted input in Input * CVE-2026-11667: Out of bounds read in WebRTC * CVE-2026-11668: Uninitialized Use in Codecs * CVE-2026-11669: Integer overflow in Media * CVE-2026-11670: Use after free in PDF * CVE-2026-11671: Use after free in Navigation * CVE-2026-11672: Out of bounds write in GPU * CVE-2026-11673: Use after free in InterestGroups * CVE-2026-11674: Use after free in Guest View * CVE-2026-11675: Insufficient validation of untrusted input in Skia * CVE-2026-11676: Insufficient validation of untrusted input in Dawn * CVE-2026-11677: Race in Network * CVE-2026-11678: Integer overflow in libyuv * CVE-2026-11679: Use after free in Codecs * CVE-2026-11680: Use after free in Media * CVE-2026-11681: Use after free in Ozone * CVE-2026-11682: Insufficient validation of untrusted input in Views * CVE-2026-11683: Use after free in WebCodecs * CVE-2026-11684: Insufficient policy enforcement in Network * CVE-2026-11685: Insufficient data validation in MediaCapture * CVE-2026-11686: Insufficient validation of untrusted input in Dawn * CVE-2026-11687: Use after free in Dawn * CVE-2026-11688: Object lifecycle issue in SVG * CVE-2026-11689: Insufficient validation of untrusted input in Passwords * CVE-2026-11690: Out of bounds read and write in Media * CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page * CVE-2026-11692: Use after free in Read Anything * CVE-2026-11693: Inappropriate implementation in Plugins * CVE-2026-11694: Use after free in ServiceWorker * CVE-2026-11695: Inappropriate implementation in Passwords * CVE-2026-11696: Uninitialized Use in Video * CVE-2026-11697: Insufficient validation of untrusted input in UI * CVE-2026-11698: Use after free in Bluetooth * CVE-2026-11699: Use after free in Bluetooth * CVE-2026-11700: Use after free in Tracing * CVE-2026-11701: Insufficient validation of untrusted input in Guest View - Refresh ppc64le patches * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.53-3 - Fix build error on aarch64 and ppc64le * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.53-2 - Fix comment * Fri Sep 04 2026 Than Ngo - 149.0.11^chromium149.0.7827.53-1 - Update to 149.0.7827.53 * CVE-2026-10881: Out of bounds read and write in ANGLE * CVE-2026-10882: Use after free in Network * CVE-2026-10883: Out of bounds write in ANGLE * CVE-2026-10884: Use after free in Chromecast * CVE-2026-10885: Use after free in Chrome for iOS * CVE-2026-10886: Use after free in FileSystem * CVE-2026-10887: Use after free in Chromoting * CVE-2026-10888: Use after free in Cast Streaming * CVE-2026-10889: Out of bounds read in ANGLE * CVE-2026-10890: Use after free in Cast * CVE-2026-10891: Use after free in GFX * CVE-2026-10892: Out of bounds write in GPU * CVE-2026-10893: Use after free in Chromoting * CVE-2026-10894: Use after free in Printing * CVE-2026-10895: Use after free in Ozone * CVE-2026-10896: Use after free in Chrome for iOS * CVE-2026-10897: Out of bounds write in GPU * CVE-2026-10898: Stack buffer overflow in GPU * CVE-2026-10899: Use after free in Ozone * CVE-2026-10900: Use after free in Passwords * CVE-2026-10901: Use after free in Passwords * CVE-2026-10902: Use after free in Ozone * CVE-2026-10903: Use after free in WebRTC * CVE-2026-10904: Inappropriate implementation in V8 * CVE-2026-10905: Use after free in Network * CVE-2026-10906: Use after free in WebAuthentication * CVE-2026-10907: Out of bounds write in ANGLE * CVE-2026-10908: Use after free in FullScreen * CVE-2026-10909: Use after free in Dawn * CVE-2026-10910: Type Confusion in V8 * CVE-2026-10911: Insufficient validation of untrusted input in Media * CVE-2026-10912: Insufficient validation of untrusted input in Extensions * CVE-2026-10913: Use after free in ANGLE * CVE-2026-10914: Use after free in ANGLE * CVE-2026-10915: Use after free in Core * CVE-2026-10916: Insufficient validation of untrusted input in DevTools * CVE-2026-10917: Insufficient validation of untrusted input in Media * CVE-2026-10918: Use after free in Viz * CVE-2026-10919: Use after free in ANGLE * CVE-2026-10920: Insufficient validation of untrusted input in WebShare * CVE-2026-10921: Integer overflow in Dawn * CVE-2026-10922: Insufficient validation of untrusted input in DevTools * CVE-2026-10923: Use after free in WebAppInstalls * CVE-2026-10924: Integer overflow in Chromecast * CVE-2026-10925: Out of bounds write in Skia * CVE-2026-10926: Use after free in Cast * CVE-2026-10927: Out of bounds read in Dawn * CVE-2026-10928: Script injection in Headless * CVE-2026-10929: Heap buffer overflow in ANGLE * CVE-2026-10930: Out of bounds read in ANGLE * CVE-2026-10931: Use after free in FileSystem * CVE-2026-10932: Use after free in UI * CVE-2026-10933: Use after free in Audio * CVE-2026-10934: Use after free in Autofill * CVE-2026-10935: Inappropriate implementation in V8 * CVE-2026-10936: Type Confusion in V8 * CVE-2026-10937: Inappropriate implementation in Passwords * CVE-2026-10938: Insufficient validation of untrusted input in Input * CVE-2026-10939: Use after free in WebRTC * CVE-2026-10940: Race in Codecs * CVE-2026-10941: Out of bounds memory access in Skia * CVE-2026-10942: Insufficient validation of untrusted input in UI * CVE-2026-10943: Use after free in WebRTC * CVE-2026-10944: Insufficient policy enforcement in Autofill * CVE-2026-10945: Use after free in PDF * CVE-2026-10946: Heap buffer overflow in Media * CVE-2026-10947: Use after free in WebRTC * CVE-2026-10948: Use after free in WebRTC * CVE-2026-10949: Heap buffer overflow in Video * CVE-2026-10950: Insufficient policy enforcement in Autofill * CVE-2026-10951: Use after free in Autofill * CVE-2026-10952: Use after free in Chrome for iOS * CVE-2026-10953: Use after free in Core * CVE-2026-10954: Use after free in Actor * CVE-2026-10955: Type Confusion in ANGLE * CVE-2026-10956: Use after free in MimeHandlerView * CVE-2026-10957: Use after free in Glic * CVE-2026-10958: Use after free in Chrome for iOS * CVE-2026-10959: Use after free in Input * CVE-2026-10960: Uninitialized Use in Codecs * CVE-2026-10961: Use after free in Chrome for iOS * CVE-2026-10962: Type Confusion in Media * CVE-2026-10963: Integer overflow in V8 * CVE-2026-10964: Integer overflow in V8 * CVE-2026-10965: Integer overflow in DevTools * CVE-2026-10966: Insufficient validation of untrusted input in Codecs * CVE-2026-10967: Use after free in SurfaceCapture * CVE-2026-10968: Insufficient validation of untrusted input in Dawn * CVE-2026-10969: Insufficient validation of untrusted input in Extensions * CVE-2026-10970: Insufficient validation of untrusted input in InterestGroups * CVE-2026-10971: Insufficient validation of untrusted input in Printing * CVE-2026-10972: Use after free in Ozone * CVE-2026-10973: Uninitialized Use in Dawn * CVE-2026-10974: Insufficient validation of untrusted input in ANGLE * CVE-2026-10975: Use after free in WebRTC * CVE-2026-10976: Uninitialized Use in Dawn * CVE-2026-10977: Uninitialized Use in Skia * CVE-2026-10978: Use after free in Chromoting * CVE-2026-10979: Out of bounds read in ANGLE * CVE-2026-10980: Insufficient validation of untrusted input in DevTools * CVE-2026-10981: Insufficient validation of untrusted input in Codecs * CVE-2026-10982: Use after free in WebXR * CVE-2026-10983: Insufficient validation of untrusted input in Dawn * CVE-2026-10984: Inappropriate implementation in Accessibility * CVE-2026-10985: Out of bounds read in Skia * CVE-2026-10986: Integer overflow in Media * CVE-2026-10987: Integer overflow in V8 * CVE-2026-10988: Use after free in Views * CVE-2026-10989: Inappropriate implementation in V8 * CVE-2026-10990: Use after free in Glic * CVE-2026-10991: Use after free in V8 * CVE-2026-10992: Insufficient data validation in Animation * CVE-2026-10993: Heap buffer overflow in Skia * CVE-2026-10994: Uninitialized Use in ANGLE * CVE-2026-10995: Heap buffer overflow in TabStrip * CVE-2026-10996: Inappropriate implementation in Workers * CVE-2026-10997: Insufficient policy enforcement in Extensions * CVE-2026-10998: Out of bounds read in Media * CVE-2026-10999: Out of bounds memory access in ANGLE * CVE-2026-11000: Use after free in Fonts * CVE-2026-11001: Incorrect security UI in Payments * CVE-2026-11002: Use after free in Autofill * CVE-2026-11003: Use after free in WebRTC * CVE-2026-11004: Out of bounds read in ANGLE * CVE-2026-11005: Out of bounds read in ANGLE * CVE-2026-11006: Out of bounds read in Dawn * CVE-2026-11007: Insufficient validation of untrusted input in WebView * CVE-2026-11008: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-11009: Use after free in USB * CVE-2026-11010: Use after free in WebShare * CVE-2026-11011: Insufficient policy enforcement in Password Manager * CVE-2026-11012: Use after free in Serial * CVE-2026-11013: Insufficient validation of untrusted input in Network * CVE-2026-11014: Insufficient policy enforcement in Extensions * CVE-2026-11015: Out of bounds read in WebGPU * CVE-2026-11016: Insufficient validation of untrusted input in Network * CVE-2026-11017: Inappropriate implementation in Link Preview * CVE-2026-11018: Insufficient policy enforcement in Actor * CVE-2026-11019: Inappropriate implementation in Payments * CVE-2026-11020: Inappropriate implementation in Extensions * CVE-2026-11021: Insufficient validation of untrusted input in GPU * CVE-2026-11022: Insufficient validation of untrusted input in DevTools * CVE-2026-11023: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-11024: Stack buffer overflow in Skia * CVE-2026-11025: Insufficient policy enforcement in Navigation * CVE-2026-11026: Insufficient policy enforcement in Extensions * CVE-2026-11027: Insufficient validation of untrusted input in Glic * CVE-2026-11028: Use after free in Media * CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop * CVE-2026-11030: Use after free in Network * CVE-2026-11031: Insufficient validation of untrusted input in Password Manager * CVE-2026-11032: Insufficient data validation in Password Manager * CVE-2026-11033: Uninitialized Use in WebML * CVE-2026-11034: Insufficient validation of untrusted input in Tab Group Sync * CVE-2026-11035: Insufficient validation of untrusted input in Custom Tabs * CVE-2026-11036: Inappropriate implementation in DOM * CVE-2026-11037: Out of bounds write in Codecs * CVE-2026-11038: Insufficient validation of untrusted input in Subresource Integrity * CVE-2026-11039: Uninitialized Use in Skia * CVE-2026-11040: Use after free in ANGLE * CVE-2026-11041: Insufficient validation of untrusted input in Media * CVE-2026-11042: Use after free in Views * CVE-2026-11043: Out of bounds write in ANGLE * CVE-2026-11044: Integer overflow in ANGLE * CVE-2026-11045: Insufficient validation of untrusted input in GPU * CVE-2026-11046: Insufficient validation of untrusted input in Media * CVE-2026-11047: Insufficient validation of untrusted input in Base * CVE-2026-11048: Inappropriate implementation in Extensions * CVE-2026-11049: Use after free in Password Manager * CVE-2026-11050: Use after free in V8 * CVE-2026-11051: Out of bounds read in ANGLE * CVE-2026-11052: Type Confusion in GPU * CVE-2026-11053: VULNERABILITY in WebRTC * CVE-2026-11054: Use after free in WebRTC * CVE-2026-11055: Use after free in ANGLE * CVE-2026-11056: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-11057: Uninitialized Use in Skia * CVE-2026-11058: Integer overflow in CredentialProvider * CVE-2026-11059: Use after free in Blink * CVE-2026-11060: Use after free in Media * CVE-2026-11061: Out of bounds read in ANGLE * CVE-2026-11062: Insufficient policy enforcement in Extensions * CVE-2026-11063: Insufficient validation of untrusted input in WebNN * CVE-2026-11064: Uninitialized Use in GPU * CVE-2026-11065: Use after free in ANGLE * CVE-2026-11066: Insufficient validation of untrusted input in ANGLE * CVE-2026-11067: Uninitialized Use in Dawn * CVE-2026-11068: Use after free in WebSockets * CVE-2026-11069: Insufficient validation of untrusted input in Cast * CVE-2026-11070: Insufficient validation of untrusted input in Chromoting * CVE-2026-11071: Use after free in Base * CVE-2026-11072: Use after free in WebView * CVE-2026-11073: Use after free in WebGL * CVE-2026-11074: Use after free in WebRTC * CVE-2026-11075: Out of bounds read in V8 * CVE-2026-11076: Type Confusion in CSS * CVE-2026-11077: Out of bounds read in Dawn * CVE-2026-11078: Insufficient validation of untrusted input in FileSystem * CVE-2026-11079: Insufficient validation of untrusted input in Codecs * CVE-2026-11080: Use after free in WebView * CVE-2026-11081: Policy bypass in Canvas * CVE-2026-11082: Use after free in GPU * CVE-2026-11083: Inappropriate implementation in Password Manager * CVE-2026-11084: Inappropriate implementation in Password Manager * CVE-2026-11085: Integer overflow in GPU * CVE-2026-11086: Insufficient validation of untrusted input in Dawn * CVE-2026-11087: Uninitialized Use in ANGLE * CVE-2026-11088: Integer overflow in ANGLE * CVE-2026-11089: Uninitialized Use in Media * CVE-2026-11090: Uninitialized Use in ANGLE * CVE-2026-11091: Inappropriate implementation in Dawn * CVE-2026-11092: Insufficient policy enforcement in DevTools * CVE-2026-11093: Insufficient validation of untrusted input in Printing * CVE-2026-11094: Use after free in Codecs * CVE-2026-11095: Insufficient validation of untrusted input in Codecs * CVE-2026-11096: Out of bounds read in WebRTC * CVE-2026-11097: Inappropriate implementation in WebView * CVE-2026-11098: Insufficient validation of untrusted input in GPU * CVE-2026-11099: Vulnerability in Skia * CVE-2026-11100: Use after free in File Input * CVE-2026-11101: Uninitialized Use in Dawn * CVE-2026-11102: Inappropriate implementation in Isolated Web Apps * CVE-2026-11103: Inappropriate implementation in Installer * CVE-2026-11104: Uninitialized Use in ANGLE * CVE-2026-11105: Insufficient validation of untrusted input in WebUI * CVE-2026-11106: Inappropriate implementation in Media * CVE-2026-11107: Inappropriate implementation in Downloads * CVE-2026-11108: Inappropriate implementation in NFC * CVE-2026-11109: Uninitialized Use in ANGLE * CVE-2026-11110: Uninitialized Use in ANGLE * CVE-2026-11111: Out of bounds read in ANGLE * CVE-2026-11112: Insufficient validation of untrusted input in Chromoting * CVE-2026-11113: Insufficient validation of untrusted input in ANGLE * CVE-2026-11114: Use after free in Device Trust * CVE-2026-11115: Use after free in Updater * CVE-2026-11116: Use after free in Chromoting * CVE-2026-11117: Use after free in Views * CVE-2026-11118: Use after free in WebRTC * CVE-2026-11119: Insufficient validation of untrusted input in GPU * CVE-2026-11120: Insufficient validation of untrusted input in Enterprise Reporting * CVE-2026-11121: Insufficient validation of untrusted input in Skia * CVE-2026-11122: Inappropriate implementation in Keyboard * CVE-2026-11123: Uninitialized Use in ANGLE * CVE-2026-11124: Heap buffer overflow in Skia * CVE-2026-11125: Use after free in Compositing * CVE-2026-11126: Insufficient validation of untrusted input in DevTools * CVE-2026-11127: Inappropriate implementation in WebAPKs * CVE-2026-11128: Insufficient validation of untrusted input in Web Share * CVE-2026-11129: Inappropriate implementation in Extensions * CVE-2026-11130: Use after free in Media * CVE-2026-11131: Use after free in Autofill * CVE-2026-11132: Policy bypass in Paint * CVE-2026-11133: Insufficient policy enforcement in Paint * CVE-2026-11134: Insufficient data validation in Media * CVE-2026-11135: Insufficient policy enforcement in Autofill * CVE-2026-11136: Use after free in Canvas * CVE-2026-11137: Uninitialized Use in ANGLE * CVE-2026-11138: Uninitialized Use in ANGLE * CVE-2026-11139: Policy bypass in Paint * CVE-2026-11140: Insufficient validation of untrusted input in Chromecast * CVE-2026-11141: Uninitialized Use in Audio * CVE-2026-11142: Policy bypass in Paint * CVE-2026-11143: Heap buffer overflow in Extensions * CVE-2026-11144: Use after free in Media * CVE-2026-11145: Race in Geolocation * CVE-2026-11146: Insufficient validation of untrusted input in Chromoting * CVE-2026-11147: Use after free in WebML * CVE-2026-11148: Inappropriate implementation in Payments * CVE-2026-11149: Insufficient validation of untrusted input in Extensions * CVE-2026-11150: Inappropriate implementation in XML * CVE-2026-11151: Insufficient validation of untrusted input in Password Manager * CVE-2026-11152: Object lifecycle issue in Dawn * CVE-2026-11153: Side-channel information leakage in Forms * CVE-2026-11154: Use after free in Dawn * CVE-2026-11155: Insufficient policy enforcement in CSS * CVE-2026-11156: Inappropriate implementation in CSS * CVE-2026-11157: Script injection in Accessibility * CVE-2026-11158: Insufficient validation of untrusted input in Downloads * CVE-2026-11159: Uninitialized Use in Skia * CVE-2026-11160: Out of bounds read in Input * CVE-2026-11161: Insufficient data validation in DataTransfer * CVE-2026-11162: Insufficient policy enforcement in CSS * CVE-2026-11163: Use after free in Messages * CVE-2026-11164: Use after free in Blink * CVE-2026-11165: Use after free in WebMIDI * CVE-2026-11166: Inappropriate implementation in SVG * CVE-2026-11167: Inappropriate implementation in WebView * CVE-2026-11168: Insufficient policy enforcement in Extensions * CVE-2026-11169: Inappropriate implementation in XML * CVE-2026-11170: Inappropriate implementation in Chromoting * CVE-2026-11171: Integer overflow in Blink * CVE-2026-11172: Incorrect security UI in Contact Picker * CVE-2026-11173: Out of bounds write in V8 * CVE-2026-11174: Insufficient policy enforcement in Site Isolation * CVE-2026-11175: Incorrect security UI in Messages * CVE-2026-11176: Inappropriate implementation in Media * CVE-2026-11177: Use after free in Omnibox * CVE-2026-11178: Policy bypass in WebView * CVE-2026-11179: Inappropriate implementation in ORB * CVE-2026-11180: Policy bypass in SVG * CVE-2026-11181: Inappropriate implementation in Media Session * CVE-2026-11182: Inappropriate implementation in SVG * CVE-2026-11183: Out of bounds read in GWP-ASan * CVE-2026-11184: Insufficient policy enforcement in Actor * CVE-2026-11185: Use after free in V8 * CVE-2026-11186: Inappropriate implementation in CSS * CVE-2026-11187: Insufficient policy enforcement in Glic * CVE-2026-11188: Use after free in USB * CVE-2026-11189: Insufficient validation of untrusted input in DevTools * CVE-2026-11190: Insufficient policy enforcement in Extensions * CVE-2026-11191: Out of bounds memory access in ANGLE * CVE-2026-11192: Insufficient validation of untrusted input in Password Manager * CVE-2026-11193: Insufficient policy enforcement in Password Manager * CVE-2026-11194: Inappropriate implementation in Network * CVE-2026-11195: Inappropriate implementation in MHTML * CVE-2026-11196: Type Confusion in XML * CVE-2026-11197: Insufficient policy enforcement in Workers * CVE-2026-11198: Insufficient validation of untrusted input in Codecs * CVE-2026-11199: Insufficient validation of untrusted input in WebRTC * CVE-2026-11200: Inappropriate implementation in WebRTC * CVE-2026-11201: Use after free in ServiceWorker * CVE-2026-11202: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-11203: Policy bypass in GPU * CVE-2026-11204: Inappropriate implementation in Signin * CVE-2026-11205: Insufficient validation of untrusted input in Chrome for iOS * CVE-2026-11206: Policy bypass in ServiceWorker * CVE-2026-11207: Insufficient validation of untrusted input in Autofill * CVE-2026-11208: Use after free in Codecs * CVE-2026-11209: Insufficient policy enforcement in Passwords * CVE-2026-11210: Insufficient policy enforcement in Safe Browsing * CVE-2026-11211: Integer overflow in V8 * CVE-2026-11212: Insufficient policy enforcement in DevTools * CVE-2026-11213: Insufficient validation of untrusted input in Reading Mode * CVE-2026-11214: Inappropriate implementation in Chrome for iOS * CVE-2026-11215: Inappropriate implementation in Cronet * CVE-2026-11216: Incorrect security UI in File Input * CVE-2026-11217: Insufficient policy enforcement in Fenced Frames * CVE-2026-11218: Inappropriate implementation in PlatformIntegration * CVE-2026-11219: Insufficient data validation in Navigation * CVE-2026-11220: Insufficient validation of untrusted input in Navigation * CVE-2026-11221: Insufficient validation of untrusted input in PointerLock * CVE-2026-11222: Incorrect security UI in Tab Strip * CVE-2026-11223: Insufficient validation of untrusted input in Network * CVE-2026-11224: Use after free in Chromoting * CVE-2026-11225: Incorrect security UI in WebUI * CVE-2026-11226: Insufficient policy enforcement in PreviewTab * CVE-2026-11227: Incorrect security UI in Tab Hover Cards * CVE-2026-11228: Incorrect security UI in File Input * CVE-2026-11229: Insufficient policy enforcement in Enterprise * CVE-2026-11230: Use after free in Extensions * CVE-2026-11231: Inappropriate implementation in Safe Browsing * CVE-2026-11232: Inappropriate implementation in TabGroups * CVE-2026-11233: Insufficient validation of untrusted input in FoldableAPIs * CVE-2026-11234: Insufficient policy enforcement in FoldableAPIs * CVE-2026-11235: Insufficient validation of untrusted input in Compositing * CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth * CVE-2026-11237: Insufficient validation of untrusted input in Media * CVE-2026-11238: Inappropriate implementation in DevTools * CVE-2026-11239: Insufficient validation of untrusted input in Extensions * CVE-2026-11240: Insufficient validation of untrusted input in Loader * CVE-2026-11241: Insufficient validation of untrusted input in Cast * CVE-2026-11242: Insufficient validation of untrusted input in Plugins * CVE-2026-11243: Incorrect security UI in Downloads * CVE-2026-11244: Insufficient validation of untrusted input in WebAuthentication * CVE-2026-11245: Inappropriate implementation in Payments * CVE-2026-11246: Insufficient validation of untrusted input in IndexedDB * CVE-2026-11247: Insufficient policy enforcement in CustomTabs * CVE-2026-11248: Policy bypass in Google Lens * CVE-2026-11249: Use after free in Network * CVE-2026-11250: Inappropriate implementation in DevTools * CVE-2026-11251: Insufficient validation of untrusted input in Password Manager * CVE-2026-11252: Policy bypass in Content Settings * CVE-2026-11253: Race in Permissions * CVE-2026-11254: Inappropriate implementation in Permissions * CVE-2026-11255: Insufficient validation of untrusted input in Storage Access API * CVE-2026-11256: Out of bounds read in GPU * CVE-2026-11257: Inappropriate implementation in Browser * CVE-2026-11258: Inappropriate implementation in File System Access * CVE-2026-11259: Insufficient validation of untrusted input in Cast * CVE-2026-11260: Policy bypass in Permissions * CVE-2026-11261: Insufficient validation of untrusted input in PDF * CVE-2026-11262: Use after free in TabStrip * CVE-2026-11263: Insufficient policy enforcement in WebAuthentication * CVE-2026-11264: Policy bypass in Content Security Policy * CVE-2026-11265: Insufficient data validation in Autofill * CVE-2026-11266: Policy bypass in SafeBrowsing * CVE-2026-11267: Insufficient policy enforcement in Extensions * CVE-2026-11268: Uninitialized Use in ANGLE * CVE-2026-11269: Inappropriate implementation in Extensions * CVE-2026-11270: Inappropriate implementation in UI * CVE-2026-11271: Incorrect security UI in Passwords * CVE-2026-11272: Insufficient validation of untrusted input in Reading List * CVE-2026-11273: Insufficient validation of untrusted input in Omnibox * CVE-2026-11274: Inappropriate implementation in DOM Distiller * CVE-2026-11275: Insufficient policy enforcement in Page Info * CVE-2026-11276: Inappropriate implementation in Cast * CVE-2026-11277: Insufficient policy enforcement in Chrome for iOS * CVE-2026-11278: Inappropriate implementation in CustomTabs * CVE-2026-11279: Out of bounds read in DevTools * CVE-2026-11280: Insufficient validation of untrusted input in Signin * CVE-2026-11281: Integer overflow in Chromoting * CVE-2026-11282: Policy bypass in Sandbox * CVE-2026-11283: Policy bypass in Shortcuts * CVE-2026-11284: Side-channel information leakage in PerformanceAPIs * CVE-2026-11285: Insufficient policy enforcement in Chrome for iOS * CVE-2026-11286: Insufficient validation of untrusted input in Wallet * CVE-2026-11287: Insufficient validation of untrusted input in Navigation * CVE-2026-11288: Policy bypass in CSS * CVE-2026-11289: Side-channel information leakage in Paint * CVE-2026-11290: Integer overflow in WebView * CVE-2026-11291: Policy bypass in Android Autofill * CVE-2026-11292: Policy bypass in Blink * CVE-2026-11293: Use after free in Input * CVE-2026-11294: Inappropriate implementation in Passwords * CVE-2026-11295: Inappropriate implementation in WebView * CVE-2026-11296: Inappropriate implementation in ImageCapture * CVE-2026-11297: Insufficient validation of untrusted input in Reader Mode * CVE-2026-11298: Insufficient policy enforcement in Chrome for iOS * CVE-2026-11299: Out of bounds read in Fonts * CVE-2026-11300: Inappropriate implementation in Permissions * CVE-2026-11301: Out of bounds read in LiveCaption * CVE-2026-11302: Insufficient policy enforcement in Chrome for iOS * CVE-2026-11303: Use after free in PDFium * CVE-2026-11304: Use after free in PDFium * CVE-2026-11305: Use after free in PDFium * CVE-2026-11306: Use after free in PDFium * CVE-2026-11307: Use after free in PDFium * CVE-2026-11308: Inappropriate implementation in Extensions * CVE-2026-11309: Insufficient policy enforcement in History - Refresh ppc64le patches - Refresh rustc and clang patches - Include chrome-management-service - Remove obsoletes SYS_SECCOMP patch - Remove widevine-on-arm64 patch, it's merged in upstream - Fix hardcoded path in remoting code * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.215-1 - Update to 148.0.7778.215 * CVE-2026-9872: Out of bounds write in GPU * CVE-2026-9873: Use after free in Network * CVE-2026-9874: Use after free in Dawn * CVE-2026-9875: Out of bounds read in WebGL * CVE-2026-9876: Use after free in WebGL * CVE-2026-9877: Use after free in ANGLE * CVE-2026-9878: Use after free in ANGLE * CVE-2026-9879: Out of bounds write in ANGLE * CVE-2026-9880: Insufficient validation of untrusted input in WebGL * CVE-2026-9881: Use after free in Bluetooth * CVE-2026-9882: Integer overflow in ANGLE * CVE-2026-9883: Use after free in Base * CVE-2026-9884: Use after free in Browser * CVE-2026-9885: Insufficient validation of untrusted input in UI * CVE-2026-9886: Use after free in Base * CVE-2026-9887: Use after free in Proxy * CVE-2026-9888: Use after free in WebView * CVE-2026-9889: Out of bounds read and write in Dawn * CVE-2026-9890: Use after free in XR * CVE-2026-9891: Use after free in Extensions * CVE-2026-9892: Inappropriate implementation in Skia * CVE-2026-9893: Use after free in Skia * CVE-2026-9894: Use after free in GPU * CVE-2026-9895: Out of bounds read in GPU * CVE-2026-9896: Out of bounds write in V8 * CVE-2026-9897: Use after free in DOM * CVE-2026-9898: Insufficient validation of untrusted input in GPU * CVE-2026-9899: Use after free in ANGLE * CVE-2026-9900: Out of bounds write in ANGLE * CVE-2026-9901: Use after free in ANGLE * CVE-2026-9902: Use after free in Accessibility * CVE-2026-9903: Insufficient validation of untrusted input in Site Isolation * CVE-2026-9904: Use after free in ANGLE * CVE-2026-9905: Use after free in Accessibility * CVE-2026-9906: Out of bounds write in GPU * CVE-2026-9907: Out of bounds read in Dawn * CVE-2026-9908: Out of bounds read in ANGLE * CVE-2026-9909: Integer overflow in Skia * CVE-2026-9910: Out of bounds memory access in ANGLE * CVE-2026-9911: Integer overflow in ANGLE * CVE-2026-9912: Inappropriate implementation in GPU * CVE-2026-9913: Inappropriate implementation in ANGLE * CVE-2026-9914: Insufficient validation of untrusted input in ANGLE * CVE-2026-9915: Heap buffer overflow in ANGLE * CVE-2026-9916: Out of bounds write in ANGLE * CVE-2026-9917: Uninitialized Use in WebGL * CVE-2026-9918: Inappropriate implementation in Tint * CVE-2026-9919: Out of bounds read in WebGL * CVE-2026-9920: Uninitialized Use in GPU * CVE-2026-9921: Uninitialized Use in WebGL * CVE-2026-9922: Use after free in GPU * CVE-2026-9923: Use after free in Skia * CVE-2026-9924: Heap buffer overflow in ANGLE * CVE-2026-9925: Use after free in ANGLE * CVE-2026-9926: Heap buffer overflow in ANGLE * CVE-2026-9927: Use after free in ANGLE * CVE-2026-9928: Out of bounds read in ANGLE * CVE-2026-9929: Inappropriate implementation in WebGL * CVE-2026-9930: Out of bounds write in Dawn * CVE-2026-9931: Use after free in GPU * CVE-2026-9932: Use after free in ANGLE * CVE-2026-9933: Use after free in Input * CVE-2026-9934: Use after free in Aura * CVE-2026-9935: Uninitialized Use in ANGLE * CVE-2026-9936: Use after free in GFX * CVE-2026-9937: Use after free in UI * CVE-2026-9938: Inappropriate implementation in V8 * CVE-2026-9939: Heap buffer overflow in WebCodecs * CVE-2026-9940: Heap buffer overflow in ANGLE * CVE-2026-9941: Use after free in ANGLE * CVE-2026-9942: Uninitialized Use in ANGLE * CVE-2026-9943: Out of bounds read in WebGL * CVE-2026-9944: Uninitialized Use in ANGLE * CVE-2026-9945: Use after free in Media * CVE-2026-9946: Use after free in ANGLE * CVE-2026-9947: Use after free in XML * CVE-2026-9948: Use after free in Views * CVE-2026-9949: Use after free in Core * CVE-2026-9950: Insufficient validation of untrusted input in iOS * CVE-2026-9951: Use after free in UI * CVE-2026-9952: Use after free in WebAudio * CVE-2026-9953: Out of bounds read in ANGLE * CVE-2026-9954: Use after free in TabStrip * CVE-2026-9955: Inappropriate implementation in iOS * CVE-2026-9956: Use after free in iOS * CVE-2026-9957: Use after free in PDF * CVE-2026-9958: Use after free in PDFium * CVE-2026-9959: Race in WebRTC * CVE-2026-9960: Integer overflow in PDFium * CVE-2026-9961: Use after free in SurfaceCapture * CVE-2026-9962: Use after free in WebRTC * CVE-2026-9963: Uninitialized Use in iOS * CVE-2026-9964: Use after free in Bluetooth * CVE-2026-9965: Out of bounds write in ANGLE * CVE-2026-9966: Integer overflow in XML * CVE-2026-9967: Out of bounds write in GPU * CVE-2026-9968: Integer overflow in V8 * CVE-2026-9969: Insufficient validation of untrusted input in ANGLE * CVE-2026-9970: Use after free in WebGL * CVE-2026-9971: Inappropriate implementation in iOS * CVE-2026-9972: Uninitialized Use in Gamepad * CVE-2026-9973: Out of bounds write in V8 * CVE-2026-9974: Out of bounds write in GPU * CVE-2026-9975: Out of bounds read and write in ANGLE * CVE-2026-9976: Inappropriate implementation in USB * CVE-2026-9977: Insufficient validation of untrusted input in WebShare * CVE-2026-9978: Use after free in Glic * CVE-2026-9979: Insufficient validation of untrusted input in Input * CVE-2026-9980: Insufficient validation of untrusted input in Printing * CVE-2026-9981: Inappropriate implementation in Skia * CVE-2026-9982: Insufficient validation of untrusted input in ANGLE * CVE-2026-9983: Type Confusion in Skia * CVE-2026-9984: Use after free in UI * CVE-2026-9985: Insufficient validation of untrusted input in Media * CVE-2026-9986: Insufficient validation of untrusted input in OptimizationGuide * CVE-2026-9987: Insufficient validation of untrusted input in WebAppInstalls * CVE-2026-9988: Use after free in WebRTC * CVE-2026-9989: Inappropriate implementation in Media * CVE-2026-9990: Use after free in WebAppInstalls * CVE-2026-9991: Inappropriate implementation in Media * CVE-2026-9992: Use after free in Network * CVE-2026-9993: Use after free in Views * CVE-2026-9994: Use after free in Core * CVE-2026-9995: Use after free in WebXR * CVE-2026-9996: Out of bounds read in WebRTC * CVE-2026-9997: Use after free in Input * CVE-2026-9998: Integer overflow in Skia * CVE-2026-9999: Inappropriate implementation in ANGLE * CVE-2026-10000: Use after free in Passwords * CVE-2026-10001: Use after free in PerformanceManager * CVE-2026-10002: Use after free in PDFium * CVE-2026-10003: Use after free in Views * CVE-2026-10004: Insufficient validation of untrusted input in Passwords * CVE-2026-10005: Use after free in WebAppInstalls * CVE-2026-10006: Race in WebAudio * CVE-2026-10007: Use after free in SVG * CVE-2026-10008: Uninitialized Use in GPU * CVE-2026-10009: Integer overflow in Skia * CVE-2026-10010: Inappropriate implementation in Input * CVE-2026-10011: Inappropriate implementation in Skia * CVE-2026-10012: Use after free in Skia * CVE-2026-10013: Use after free in WebCodecs * CVE-2026-10014: Use after free in WebMIDI * CVE-2026-10015: Integer overflow in WTF * CVE-2026-10016: Use after free in DOM * CVE-2026-10017: Out of bounds read in Headless * CVE-2026-10018: Integer overflow in ANGLE * CVE-2026-10019: Integer overflow in ANGLE * CVE-2026-10020: Insufficient validation of untrusted input in Skia * CVE-2026-10021: Insufficient validation of untrusted input in USB * CVE-2026-10022: Type Confusion in V8 * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.178-2 - Add CVEs in changelog * CVE-2026-9111: Use after free in WebRTC * CVE-2026-9110: Inappropriate implementation in UI * CVE-2026-9112: Use after free in GPU * CVE-2026-9113: Out of bounds read in GPU * CVE-2026-9114: Use after free in QUIC * CVE-2026-9115: Insufficient policy enforcement in Service Worker * CVE-2026-9116: Insufficient policy enforcement in ServiceWorker * CVE-2026-9117: Type Confusion in GFX * CVE-2026-9118: Use after free in XR * CVE-2026-9119: Heap buffer overflow in WebRTC * CVE-2026-9120: Use after free in WebRTC * CVE-2026-9126: Use after free in DOM * CVE-2026-9121: Out of bounds read in GPU * CVE-2026-9122: Out of bounds read in GPU * CVE-2026-9123: Heap buffer overflow in Chromecast * CVE-2026-9124: Insufficient validation of untrusted input in Input * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.178-1 - Update to 148.0.7778.178 - Backport upstream patches to improve auto dark image inversion logic - Update default chromium browser config * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.167-3 - Fix el10 minor version * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.167-2 - Upstream security release - 148.0.7778.167 * CVE-2026-8509: Heap buffer overflow in WebML * CVE-2026-8510: Integer overflow in Skia * CVE-2026-8511: Use after free in UI * CVE-2026-8512: Use after free in FileSystem * CVE-2026-8513: Use after free in Input * CVE-2026-8514: Use after free in Aura * CVE-2026-8515: Use after free in HID * CVE-2026-8516: Insufficient validation of untrusted input in DataTransfer * CVE-2026-8517: Object lifecycle issue in WebShare * CVE-2026-8518: Use after free in Blink * CVE-2026-8519: Integer overflow in ANGLE * CVE-2026-8520: Race in Payments * CVE-2026-8521: Use after free in Tab Groups * CVE-2026-8522: Use after free in Downloads * CVE-2026-8523: Use after free in Mojo * CVE-2026-8558: Out of bounds write in Fonts * CVE-2026-8524: Out of bounds write in WebAudio * CVE-2026-8525: Heap buffer overflow in ANGLE * CVE-2026-8526: Out of bounds write in WebRTC * CVE-2026-8527: Insufficient validation of untrusted input in Downloads * CVE-2026-8528: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-8529: Heap buffer overflow in Codecs * CVE-2026-8530: Use after free in Network * CVE-2026-8531: Heap buffer overflow in WebML * CVE-2026-8532: Integer overflow in XML * CVE-2026-8533: Use after free in Accessibility * CVE-2026-8534: Integer overflow in GPU * CVE-2026-8535: Out of bounds read in Media * CVE-2026-8536: Insufficient validation of untrusted input in ReadingMode * CVE-2026-8537: Insufficient policy enforcement in ViewTransitions * CVE-2026-8538: Insufficient validation of untrusted input in GPU * CVE-2026-8539: Script injection in SanitizerAPI * CVE-2026-8540: Type Confusion in V8 * CVE-2026-8541: Out of bounds read in UI * CVE-2026-8542: Use after free in Core * CVE-2026-8543: Out of bounds read in FileSystem * CVE-2026-8544: Use after free in Media * CVE-2026-8545: Object corruption in Compositing * CVE-2026-8546: Out of bounds read in GPU * CVE-2026-8547: Insufficient policy enforcement in Passwords * CVE-2026-8548: Out of bounds write in Media * CVE-2026-8549: Use after free in Media * CVE-2026-8550: Use after free in Google Lens * CVE-2026-8551: Use after free in Downloads * CVE-2026-8552: Heap buffer overflow in GPU * CVE-2026-8553: Use after free in GPU * CVE-2026-8554: Type Confusion in ANGLE * CVE-2026-8555: Use after free in GTK * CVE-2026-8556: Inappropriate implementation in ANGLE * CVE-2026-8557: Use after free in Accessibility * CVE-2026-8559: Integer overflow in Internationalization * CVE-2026-8560: Heap buffer overflow in SwiftShader * CVE-2026-8561: Incorrect security UI in Fullscreen * CVE-2026-8562: Side-channel information leakage in Navigation * CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox * CVE-2026-8564: Incorrect security UI in Downloads * CVE-2026-8565: Inappropriate implementation in Downloads * CVE-2026-8566: Insufficient policy enforcement in Payments * CVE-2026-8567: Integer overflow in ANGLE * CVE-2026-8568: Insufficient policy enforcement in AI * CVE-2026-8569: Out of bounds write in Codecs * CVE-2026-8570: Type Confusion in V8 * CVE-2026-8571: Insufficient policy enforcement in GPU * CVE-2026-8572: Insufficient policy enforcement in Network * CVE-2026-8573: Integer overflow in Codecs * CVE-2026-8574: Use after free in Core * CVE-2026-8575: Use after free in UI * CVE-2026-8576: Inappropriate implementation in CORS * CVE-2026-8577: Integer overflow in Fonts * CVE-2026-8578: Out of bounds read in GPU * CVE-2026-8579: Insufficient validation of untrusted input in Skia * CVE-2026-8580: Use after free in Mojo * CVE-2026-8581: Use after free in GPU * CVE-2026-8582: Object lifecycle issue in Dawn * CVE-2026-8583: Insufficient policy enforcement in WebXR * CVE-2026-8584: Inappropriate implementation in Views * CVE-2026-8585: Inappropriate implementation in Media * CVE-2026-8586: Inappropriate implementation in Chromoting * CVE-2026-8587: Use after free in Extensions * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.167-1 - Update to 148.0.7778.167 * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-7 - Fix FTBFS on epel-10.1 and epel-10.3 * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-6 - Disable AI (patch from ungoogle chromium) * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-5 - Refactor Python script to automate the removal of bundled binaries - Build with wasm rollup (patch from ungoogle chromium) - Disable chromium's AI model * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-4 - Fix FTBFS with old system ffmpeg 5.1.4 on el9 - Fix FTBFS with old python-3.9 on el9 - Fix FTBFS with old rust compiler 1.88 on el9 - Update download python script to remove bundle binary - Fix FTBFS caused by gperf on ppc64le and aarch64 * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-3 - Update to 148.0.7778.96 * CVE-2026-7896: Integer overflow in Blink * CVE-2026-7897: Use after free in Mobile * CVE-2026-7898: Use after free in Chromoting * CVE-2026-7899: Out of bounds read and write in V8 * CVE-2026-7900: Heap buffer overflow in ANGLE * CVE-2026-7901: Use after free in ANGLE * CVE-2026-7902: Out of bounds memory access in V8 * CVE-2026-7903: Integer overflow in ANGLE * CVE-2026-7904: Out of bounds read in Fonts * CVE-2026-7905: Insufficient validation of untrusted input in Media * CVE-2026-7906: Use after free in SVG * CVE-2026-7907: Use after free in DOM * CVE-2026-7908: Use after free in Fullscreen * CVE-2026-7909: Inappropriate implementation in ServiceWorker * CVE-2026-7910: Use after free in Views * CVE-2026-7911: Use after free in Aura * CVE-2026-7912: Integer overflow in GPU * CVE-2026-7913: Insufficient policy enforcement in DevTools * CVE-2026-7914: Type Confusion in Accessibility * CVE-2026-7915: Insufficient data validation in DevTools * CVE-2026-7916: Insufficient data validation in InterestGroups * CVE-2026-7917: Use after free in Fullscreen * CVE-2026-7918: Use after free in GPU * CVE-2026-7919: Use after free in Aura * CVE-2026-7920: Use after free in Skia * CVE-2026-7921: Use after free in Passwords * CVE-2026-7922: Use after free in ServiceWorker * CVE-2026-7923: Out of bounds write in Skia * CVE-2026-7924: Uninitialized Use in Dawn * CVE-2026-7925: Use after free in Chromoting * CVE-2026-7926: Use after free in PresentationAPI * CVE-2026-7927: Type Confusion in Runtime * CVE-2026-7928: Use after free in WebRTC * CVE-2026-7929: Use after free in MediaRecording * CVE-2026-7930: Insufficient validation of untrusted input in Cookies * CVE-2026-7931: Insufficient validation of untrusted input in iOS * CVE-2026-7932: Insufficient policy enforcement in Downloads * CVE-2026-7933: Out of bounds read in WebCodecs * CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker * CVE-2026-7935: Inappropriate implementation in Speech * CVE-2026-7936: Object lifecycle issue in V8 * CVE-2026-7937: Insufficient policy enforcement in DevTools * CVE-2026-7938: Use after free in CSS * CVE-2026-7939: Inappropriate implementation in SanitizerAPI * CVE-2026-7940: Use after free in V8 * CVE-2026-7941: Insufficient validation of untrusted input in Mobile * CVE-2026-7942: Integer overflow in ANGLE * CVE-2026-7943: Insufficient validation of untrusted input in ANGLE * CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache * CVE-2026-7945: Insufficient validation of untrusted input in COOP * CVE-2026-7946: Insufficient policy enforcement in WebUI * CVE-2026-7947: Insufficient validation of untrusted input in Network * CVE-2026-7948: Race in Chromoting * CVE-2026-7949: Out of bounds read in Skia * CVE-2026-7950: Out of bounds read and write in GFX * CVE-2026-7951: Out of bounds write in WebRTC * CVE-2026-7952: Insufficient policy enforcement in Extensions * CVE-2026-7953: Insufficient validation of untrusted input in Omnibox * CVE-2026-7954: Race in Shared Storage * CVE-2026-7955: Uninitialized Use in GPU * CVE-2026-7956: Use after free in Navigation * CVE-2026-7957: Out of bounds write in Media * CVE-2026-7958: Inappropriate implementation in ServiceWorker * CVE-2026-7959: Inappropriate implementation in Navigation * CVE-2026-7960: Race in Speech * CVE-2026-7961: Insufficient validation of untrusted input in Permissions * CVE-2026-7962: Insufficient policy enforcement in DirectSockets * CVE-2026-7963: Inappropriate implementation in ServiceWorker * CVE-2026-7964: Insufficient validation of untrusted input in FileSystem * CVE-2026-7965: Insufficient validation of untrusted input in DevTools * CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-7967: Insufficient validation of untrusted input in Navigation * CVE-2026-7968: Insufficient validation of untrusted input in CORS * CVE-2026-7969: Integer overflow in Network * CVE-2026-7970: Use after free in TopChrome * CVE-2026-7971: Inappropriate implementation in ORB * CVE-2026-7972: Uninitialized Use in GPU * CVE-2026-7973: Integer overflow in Dawn * CVE-2026-7974: Use after free in Blink * CVE-2026-7975: Use after free in DevTools * CVE-2026-7976: Use after free in Views * CVE-2026-7977: Inappropriate implementation in Canvas * CVE-2026-7978: Inappropriate implementation in Companion * CVE-2026-7979: Inappropriate implementation in Media * CVE-2026-7980: Use after free in WebAudio * CVE-2026-7981: Out of bounds read in Codecs * CVE-2026-7982: Uninitialized Use in WebCodecs * CVE-2026-7983: Out of bounds read in Dawn * CVE-2026-7984: Use after free in ReadingMode * CVE-2026-7985: Use after free in GPU * CVE-2026-7986: Insufficient policy enforcement in Autofill * CVE-2026-7987: Use after free in WebRTC * CVE-2026-7988: Type Confusion in WebRTC * CVE-2026-7989: Insufficient data validation in DataTransfer * CVE-2026-7990: Insufficient validation of untrusted input in Updater * CVE-2026-7991: Use after free in UI * CVE-2026-7992: Insufficient validation of untrusted input in UI * CVE-2026-7993: Insufficient validation of untrusted input in Payments * CVE-2026-7994: Inappropriate implementation in Chromoting * CVE-2026-7995: Out of bounds read in AdFilter * CVE-2026-7996: Insufficient validation of untrusted input in SSL * CVE-2026-7997: Insufficient validation of untrusted input in Updater * CVE-2026-7998: Insufficient validation of untrusted input in Dialog * CVE-2026-7999: Inappropriate implementation in V8 * CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver * CVE-2026-8001: Use after free in Printing * CVE-2026-8002: Use after free in Audio * CVE-2026-8003: Insufficient validation of untrusted input in TabGroups * CVE-2026-8004: Insufficient policy enforcement in DevTools * CVE-2026-8005: Insufficient validation of untrusted input in Cast * CVE-2026-8006: Insufficient policy enforcement in DevTools * CVE-2026-8007: Insufficient validation of untrusted input in Cast * CVE-2026-8008: Inappropriate implementation in DevTools * CVE-2026-8009: Inappropriate implementation in Cast * CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation * CVE-2026-8011: Insufficient policy enforcement in Search * CVE-2026-8012: Inappropriate implementation in MHTML * CVE-2026-8013: Insufficient validation of untrusted input in FedCM * CVE-2026-8014: Inappropriate implementation in Preload * CVE-2026-8015: Inappropriate implementation in Media * CVE-2026-8016: Use after free in WebRTC * CVE-2026-8017: Side-channel information leakage in Media * CVE-2026-8018: Insufficient policy enforcement in DevTools * CVE-2026-8019: Insufficient policy enforcement in WebApp * CVE-2026-8020: Uninitialized Use in GPU * CVE-2026-8021: Script injection in UI * CVE-2026-8022: Inappropriate implementation in MHTML * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-2 - Refresh utodarkmode workaround patch * Fri Sep 04 2026 Than Ngo - 148.0.11^chromium148.0.7778.96-1 - Update to 148.0.7778.96 - Remove old remoting-no-tests patch - Remove fix_GL_native_pixmap_import_support_reset_in_GpuInit patch - Fix build error causing by sanitizer defines in GN - Refresh rust-enable- unstable_feature patch - Fix build error with system rust compiler - Fix build error causing by new clang++ options which are not supported yet - Fix build error causing by harfbuzz library rename * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.137-3 - Fix typo * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.137-2 - Enable Widevine on Arm64 * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.137-1 - Update to 147.0.7727.137 * Critical CVE-2026-7363: Use after free in Canvas * Critical CVE-2026-7361: Use after free in iOS * Critical CVE-2026-7344: Use after free in Accessibility * Critical CVE-2026-7343: Use after free in Views * High CVE-2026-7333: Use after free in GPU * High CVE-2026-7360: Insufficient validation of untrusted input in Compositing * High CVE-2026-7359: Use after free in ANGLE * High CVE-2026-7358: Use after free in Animation * High CVE-2026-7334: Use after free in Views * High CVE-2026-7357: Use after free in GPU * High CVE-2026-7356: Use after free in Navigation * High CVE-2026-7354: Out of bounds read and write in Angle * High CVE-2026-7353: Heap buffer overflow in Skia * High CVE-2026-7352: Use after free in Media * High CVE-2026-7351: Race in MHTML * High CVE-2026-7350: Use after free in WebMIDI * High CVE-2026-7349: Use after free in Cast * High CVE-2026-7348: Use after free in Codecs * High CVE-2026-7335: Use after free in media * High CVE-2026-7336: Use after free in WebRTC * High CVE-2026-7337: Type Confusion in V8 * High CVE-2026-7347: Use after free in Chromoting * High CVE-2026-7346: Inappropriate implementation in Tint * High CVE-2026-7345: Insufficient validation of untrusted input in Feedback * High CVE-2026-7338: Use after free in Cast * High CVE-2026-7342: Use after free in WebView * High CVE-2026-7341: Use after free in WebRTC * Medium CVE-2026-7339: Heap buffer overflow in WebRTC * Medium CVE-2026-7340: Integer overflow in ANGLE * Medium CVE-2026-7355: Use after free in Media * Fri Sep 04 2026 Yaakov Selkowitz - 147.0.11^chromium147.0.7727.116-4 - Update OS conditionals * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.116-3 - Fix FTBFS with rust 1.95 - Backport the upstream fix GL native pixmap import support reset in GpuInit * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.116-2 - Add CVEs * High CVE-2026-6919: Use after free in DevTools * High CVE-2026-6920: Out of bounds read in GPU * Medium CVE-2026-6921: Race in GPU * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.116-1 - Update to 147.0.7727.116 * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.101-1 - Update to 147.0.7727.101 * Critical CVE-2026-6296: Heap buffer overflow in ANGLE * Critical CVE-2026-6297: Use after free in Proxy * Critical CVE-2026-6298: Heap buffer overflow in Skia * Critical CVE-2026-6299: Use after free in Prerender * Critical CVE-2026-6358: Use after free in XR * High CVE-2026-6359: Use after free in Video * High CVE-2026-6300: Use after free in CSS * High CVE-2026-6301: Type Confusion in Turbofan * High CVE-2026-6302: Use after free in Video * High CVE-2026-6303: Use after free in Codecs * High CVE-2026-6304: Use after free in Graphite * High CVE-2026-6305: Heap buffer overflow in PDFium * High CVE-2026-6306: Heap buffer overflow in PDFium * High CVE-2026-6307: Type Confusion in Turbofan * High CVE-2026-6308: Out of bounds read in Media * High CVE-2026-6309: Use after free in Viz * High CVE-2026-6360: Use after free in FileSystem * High CVE-2026-6310: Use after free in Dawn * High CVE-2026-6311: Uninitialized Use in Accessibility * High CVE-2026-6312: Insufficient policy enforcement in Passwords * High CVE-2026-6313: Insufficient policy enforcement in CORS * High CVE-2026-6314: Out of bounds write in GPU * High CVE-2026-6315: Use after free in Permissions * High CVE-2026-6316: Use after free in Forms * High CVE-2026-6361: Heap buffer overflow in PDFium * High CVE-2026-6362: Use after free in Codecs * High CVE-2026-6317: Use after free in Cast * Medium CVE-2026-6363: Type Confusion in V8 * Medium CVE-2026-6318: Use after free in Codecs * Medium CVE-2026-6319: Use after free in Payments * Medium CVE-2026-6364: Out of bounds read in Skia * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.55-2 - Fix clang++: error: unknown argument: '-fno-lifetime-dse' * Fri Sep 04 2026 Than Ngo - 147.0.11^chromium147.0.7727.55-1 - Update to 147.0.7727.55 - Remove unused old ffmpeg-5.x-duration patch - Fix build error with system ffmpeg library - Remove ftbfs-rust-bytemuck patch that was merged in upstream - Fix build error with clang compiler <= 21 - Refresh ppc64le patches * Thu Sep 03 2026 Dominik 'Rathann' Mierzejewski - 146.0.11^chromium146.0.7680.177-6 - Rebuilt for FFmpeg 9 * Thu Aug 20 2026 Leigh Scott - 146.0.11^chromium146.0.7680.177-5 - Fix build error with rustc 1.95 * Wed Jul 15 2026 Fedora Release Engineering - 146.0.11^chromium146.0.7680.177-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Wed Apr 15 2026 Hoshino Lina - 146.0.11^chromium146.0.7680.177-3 - Remove orphan patch line * Wed Apr 15 2026 Hoshino Lina - 146.0.11^chromium146.0.7680.177-1 - Update to cef-146.0.11+g8e1262b * Wed Apr 15 2026 Than Ngo - 146.0.9^chromium146.0.7680.177-1 - Update to 146.0.7680.177 - * High CVE-2026-5273: Use after free in CSS - * High CVE-2026-5272: Heap buffer overflow in GPU - * High CVE-2026-5274: Integer overflow in Codecs - * High CVE-2026-5275: Heap buffer overflow in ANGLE - * High CVE-2026-5276: Insufficient policy enforcement in WebUSB - * High CVE-2026-5277: Integer overflow in ANGLE - * High CVE-2026-5278: Use after free in Web MIDI - * High CVE-2026-5279: Object corruption in V8 - * High CVE-2026-5280: Use after free in WebCodecs - * High CVE-2026-5281: Use after free in Dawn - * High CVE-2026-5282: Out of bounds read in WebCodecs - * High CVE-2026-5283: Inappropriate implementation in ANGLE - * High CVE-2026-5284: Use after free in Dawn - * High CVE-2026-5285: Use after free in WebGL - * High CVE-2026-5286: Use after free in Dawn - * High CVE-2026-5287: Use after free in PDF - * High CVE-2026-5288: Use after free in WebView - * High CVE-2026-5289: Use after free in Navigation - * High CVE-2026-5290: Use after free in Compositing - * Medium CVE-2026-5291: Inappropriate implementation in WebGL - * Medium CVE-2026-5292: Out of bounds read in WebCodecs - removed ppc64le-build-error patch that is merged in upstream * Tue Apr 14 2026 Hoshino Lina - 146.0.9^chromium146.0.7680.164-2 - Fix 136 ABI backwards compat breakage * Tue Mar 31 2026 Hoshino Lina - 146.0.9^chromium146.0.7680.164-1 - Update to cef-146.0.9+g3ca6a87 * Wed Mar 25 2026 Than Ngo - 146.0.6^chromium146.0.7680.164-1 - Update to 146.0.7680.164 - * High CVE-2026-4673: Heap buffer overflow in WebAudio - * High CVE-2026-4674: Out of bounds read in CSS - * High CVE-2026-4675: Heap buffer overflow in WebGL - * High CVE-2026-4676: Use after free in Dawn - * High CVE-2026-4677: Out of bounds read in WebAudio - * High CVE-2026-4678: Use after free in WebGPU - * High CVE-2026-4679: Integer overflow in Fonts - * High CVE-2026-4680: Use after free in FedCM * Wed Mar 25 2026 Than Ngo - 146.0.6^chromium146.0.7680.153-1 - Update to 146.0.7680.153 - * CVE-2026-4439: Out of bounds memory access in WebGL - * CVE-2026-4440: Out of bounds read and write in WebGL - * CVE-2026-4441: Use after free in Base - * CVE-2026-4442: Heap buffer overflow in CSS - * CVE-2026-4443: Heap buffer overflow in WebAudio - * CVE-2026-4444: Stack buffer overflow in WebRTC - * CVE-2026-4445: Use after free in WebRTC - * CVE-2026-4446: Use after free in WebRTC - * CVE-2026-4447: Inappropriate implementation in V8 - * CVE-2026-4448: Heap buffer overflow in ANGLE - * CVE-2026-4449: Use after free in Blink - * CVE-2026-4450: Out of bounds write in V8 - * CVE-2026-4451: Insufficient validation of untrusted input in Navigation - * CVE-2026-4452: Integer overflow in ANGLE - * CVE-2026-4453: Integer overflow in Dawn - * CVE-2026-4454: Use after free in Network - * CVE-2026-4455: Heap buffer overflow in PDFium - * CVE-2026-4456: Use after free in Digital Credentials API - * CVE-2026-4457: Type Confusion in V8 - * CVE-2026-4458: Use after free in Extensions - * CVE-2026-4459: Out of bounds read and write in WebAudio - * CVE-2026-4460: Out of bounds read in Skia - * CVE-2026-4461: Inappropriate implementation in V8 - * CVE-2026-4462: Out of bounds read in Blink - * CVE-2026-4463: Heap buffer overflow in WebRTC - * CVE-2026-4464: Integer overflow in ANGLE * Wed Mar 25 2026 Than Ngo - 146.0.6^chromium146.0.7680.80-1 - Update to 146.0.7680.80 - * CVE-2026-3909: Out of bounds write in Ski * Wed Mar 25 2026 Than Ngo - 146.0.6^chromium146.0.7680.75-1 - Update to 146.0.7680.75 - * CVE-2026-3909: Out of bounds write in Skia - * CVE-2026-3910: Inappropriate implementation in V8 * Wed Mar 25 2026 Than Ngo - 146.0.6^chromium146.0.7680.71-1 - Update to 146.0.7680.71 - * CVE-2026-3913: Heap buffer overflow in WebML - * CVE-2026-3914: Integer overflow in WebML - * CVE-2026-3915: Heap buffer overflow in WebML - * CVE-2026-3916: Out of bounds read in Web Speech - * CVE-2026-3917: Use after free in Agents - * CVE-2026-3918: Use after free in WebMCP - * CVE-2026-3919: Use after free in Extensions - * CVE-2026-3920: Out of bounds memory access in WebML - * CVE-2026-3921: Use after free in TextEncoding - * CVE-2026-3922: Use after free in MediaStream - * CVE-2026-3923: Use after free in WebMIDI - * CVE-2026-3924: Use after free in WindowDialog - * CVE-2026-3925: Incorrect security UI in LookalikeChecks - * CVE-2026-3926: Out of bounds read in V8 - * CVE-2026-3927: Incorrect security UI in PictureInPicture - * CVE-2026-3928: Insufficient policy enforcement in Extensions - * CVE-2026-3929: Side-channel information leakage in ResourceTiming - * CVE-2026-3930: Unsafe navigation in Navigation - * CVE-2026-3931: Heap buffer overflow in Skia - * CVE-2026-3932: Insufficient policy enforcement in PDF - * CVE-2026-3934: Insufficient policy enforcement in ChromeDriver - * CVE-2026-3935: Incorrect security UI in WebAppInstalls - * CVE-2026-3936: Use after free in WebView - * CVE-2026-3937: Incorrect security UI in Downloads - * CVE-2026-3938: Insufficient policy enforcement in Clipboard - * CVE-2026-3939: Insufficient policy enforcement in PDF - * CVE-2026-3940: Insufficient policy enforcement in DevTools - * CVE-2026-3941: Insufficient policy enforcement in DevTools - * CVE-2026-3942: Incorrect security UI in PictureInPicture - Fix build errors - Refresh patches for new upstream changes - Remove patches merged by upstream - Hoshino Lina: Update to cef-146.0.6+g68649e2 (rhbz#2450085) * Sat Mar 07 2026 Hoshino Lina - 145.0.28^chromium145.0.7632.159-1 - Bump to cef-145.0.28+g51162e8 (rhbz#2437035) * Sat Mar 07 2026 Than Ngo - 145.0.25^chromium145.0.7632.159-1 - Update to 145.0.7632.159 - * CVE-2026-3536: Integer overflow in ANGLE - * CVE-2026-3537: Object lifecycle issue in PowerVR - * CVE-2026-3538: Integer overflow in Skia - * CVE-2026-3539: Object lifecycle issue in DevTools - * CVE-2026-3540: Inappropriate implementation in WebAudio - * CVE-2026-3541: Inappropriate implementation in CSS - * CVE-2026-3542: Inappropriate implementation in WebAssembly - * CVE-2026-3543: Inappropriate implementation in V8 - * CVE-2026-3544: Heap buffer overflow in WebCodecs - * CVE-2026-3545: Insufficient data validation in Navigation * Sat Mar 07 2026 Than Ngo - 145.0.25^chromium145.0.7632.116-1 - Update to 145.0.7632.116 - * CVE-2026-3061: Out of bounds read in Media - * CVE-2026-3062: Out of bounds read and write in Tint - * CVE-2026-3063: Inappropriate implementation in DevTools * Sat Mar 07 2026 Than Ngo - 145.0.25^chromium145.0.7632.109-1 - Update to 145.0.7632.109 - * CVE-2026-2648: Heap buffer overflow in PDFium - * CVE-2026-2649: Integer overflow in V8 - * CVE-2026-2650: Heap buffer overflow in Media * Sat Mar 07 2026 Hoshino Lina - 145.0.25^chromium145.0.7632.75-5 - Use C++20 for libcef target * Fri Feb 20 2026 Than Ngo - 145.0.25^chromium145.0.7632.75-1 - Update to 145.0.7632.75 - * CVE-2026-2441: Use after free in CSS - Fix FTFS on aarch64/ppc64le caused by missing include file (el9) - Enable rustc_nightly_capability * Fri Feb 20 2026 Than Ngo - 145.0.25^chromium145.0.7632.45-1 - Update to 145.0.7632.45 - * CVE-2026-2313: Use after free in CSS - * CVE-2026-2314: Heap buffer overflow in Codecs - * CVE-2026-2315: Inappropriate implementation in WebGPU - * CVE-2026-2316: Insufficient policy enforcement in Frames - * CVE-2026-2317: Inappropriate implementation in Animation - * CVE-2026-2318: Inappropriate implementation in PictureInPicture - * CVE-2026-2319: Race in DevTools - * CVE-2026-2320: Inappropriate implementation in File input - * CVE-2026-2321: Use after free in Ozone - * CVE-2026-2322: Inappropriate implementation in File input - * CVE-2026-2323: Inappropriate implementation in Downloads - Hoshino Lina: Update to cef-145.0.25+g265860d * Fri Feb 20 2026 Than Ngo - 144.0.11^chromium144.0.7559.132-1 - Update to 144.0.7559.132 - * CVE-2026-1861: Heap buffer overflow in libvpx - * CVE-2026-1862: Type Confusion in V8 - Add BR on esbuild - Disable devtool bundle - Update scripts for downloading the source * Sat Jan 31 2026 Jan Staněk - 144.0.11^chromium144.0.7559.109-2 - Update BR for nodejs * Sat Jan 31 2026 Than Ngo - 144.0.11^chromium144.0.7559.109-1 - Update to 144.0.7559.109 - * CVE-2026-1504: Inappropriate implementation in Background Fetch API * Sat Jan 24 2026 Hoshino Lina - 144.0.11^chromium144.0.7559.96-1 - Update to cef-144.0.11+ge135be2 (rhbz#2432335) * Sat Jan 24 2026 Than Ngo - 144.0.6^chromium144.0.7559.96-1 - Update to 144.0.7559.96 [rhbz#2432335] - * CVE-2026-1220: Race in V8 * Wed Jan 21 2026 Than Ngo - 144.0.6^chromium144.0.7559.59-1 - Update to 144.0.7559.59 - * CVE-2026-0899: Out of bounds memory access in V8 - * CVE-2026-0900: Inappropriate implementation in V8 - * CVE-2026-0901: Inappropriate implementation in Blink - * CVE-2026-0902: Inappropriate implementation in V8 - * CVE-2026-0903: Insufficient validation of untrusted input in Downloads - * CVE-2026-0904: Incorrect security UI in Digital Credentials - * CVE-2026-0905: Insufficient policy enforcement in Network - * CVE-2026-0906: Incorrect security UI - * CVE-2026-0907: Incorrect security UI in Split View - * CVE-2026-0908: Use after free in ANGLE - Hoshino Lina: Update to cef-144.0.6+g5f7e671 (rhbz#2431156) * Fri Jan 16 2026 Fedora Release Engineering - 143.0.13^chromium143.0.7499.192-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 16 2026 Fedora Release Engineering - 143.0.13^chromium143.0.7499.192-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Jan 09 2026 Than Ngo - 143.0.13^chromium143.0.7499.192-1 - Update to 143.0.7499.192 [rhbz#2427842] - * High CVE-2026-0628: Insufficient policy enforcement in WebView tag - Fix rhbz#2425338, Enable control flow integrity support for x86_64/aarch64 - Enable build for epel10.1 * Wed Dec 31 2025 Hoshino Lina - 143.0.13^chromium143.0.7499.169-1 - Update to cef-143.0.13+g30cb3bd (rhbz#2424099) * Wed Dec 31 2025 Than Ngo - 143.0.10^chromium143.0.7499.169-1 - Update to 143.0.7499.169 * Thu Dec 18 2025 Than Ngo - 143.0.10^chromium143.0.7499.146-1 - Update to 143.0.7499.146 [rhbz#2423482] - * High CVE-2025-14765: Use after free in WebGPU - * High CVE-2025-14766: Out of bounds read and write in V8 - Force dark mode when auto dark mode web content is on - Remove omnibox-next-Improve-cutout-mouse-handling-for-Wayla patch, as it's merged * Thu Dec 18 2025 Hoshino Lina - 143.0.10^chromium143.0.7499.109-7 - Fix accelerated paint regression * Sun Dec 14 2025 Hoshino Lina - 143.0.10^chromium143.0.7499.109-6 - Remove GTK dependency * Fri Dec 12 2025 Than Ngo - 143.0.10^chromium143.0.7499.109-2 - Enable gtk4 by default * Fri Dec 12 2025 Than Ngo - 143.0.10^chromium143.0.7499.109-1 - Update to 143.0.7499.109 - * High: Under coordination - * Medium CVE-2025-14372: Use after free in Password Manager - * Medium CVE-2025-14373: Inappropriate implementation in Toolbar - Workaround problem of auto dark mode inverting images and making them unreadable - Hoshino Lina: Update to cef-143.0.10+g8aed01b (rhbz#2421703) * Wed Dec 10 2025 LuK1337 - 143.0.9^chromium143.0.7499.40-6 - Backport Wayland Omnibox bug fix from upstream * Wed Dec 10 2025 Than Ngo - 143.0.9^chromium143.0.7499.40-1 - Update to 143.0.7499.40 - Hoshino Lina: Update to cef-143.0.9+ge88e818 (rhbz#2420939) - * High CVE-2025-13630: Type Confusion in V8 - * High CVE-2025-13631: Inappropriate implementation in Google Updater - * High CVE-2025-13632: Inappropriate implementation in DevTools - * High CVE-2025-13633: Use after free in Digital Credentials - * Medium CVE-2025-13634: Inappropriate implementation in Downloads - * Medium CVE-2025-13720: Bad cast in Loader - * Medium CVE-2025-13721: Race in v8 - * Low CVE-2025-13635: Inappropriate implementation in Downloads - * Low CVE-2025-13636: Inappropriate implementation in Split View - * Low CVE-2025-13637: Inappropriate implementation in Downloads - * Low CVE-2025-13638: Use after free in Media Stream - * Low CVE-2025-13639: Inappropriate implementation in WebRTC - * Low CVE-2025-13640: Inappropriate implementation in Passwords - Drop workaround darkmode-image-policy.patch - Fix build error due to Unresolved dependencies - Fix swiftshader to compile with llvm-16.0 - Refresh python-3.9-ftbfs patch for el9 - Refresh ppc64le patches - Refresh chromium.conf * Tue Dec 02 2025 Asahi Lina - 142.0.17^chromium142.0.7444.175-1 - Update to cef-142.0.17+g60aac24 (rhbz#2413981) * Mon Dec 01 2025 LuK1337 - 142.0.14^chromium142.0.7444.175-4 - Backport one more Wayland DnD bug fix from upstream * Mon Dec 01 2025 Than Ngo - 142.0.14^chromium142.0.7444.175-3 - Enable system libcxx - Fix link error when building with system libcxx - Apply memory-allocator-dcheck-assert-fix for aarch64 * Mon Dec 01 2025 LuK1337 - 142.0.14^chromium142.0.7444.175-2 - Backport Wayland DnD bug fix from upstream * Mon Dec 01 2025 Than Ngo - 142.0.14^chromium142.0.7444.175-1 - Update to 142.0.7444.175 - * High CVE-2025-13223: Type Confusion in V8 - * High CVE-2025-13224: Type Confusion in V8 * Tue Nov 18 2025 Asahi Lina - 142.0.14^chromium142.0.7444.162-1 - Update to cef-142.0.14+gceaf578 (rhbz#2413981) * Tue Nov 18 2025 Than Ngo - 142.0.10^chromium142.0.7444.162-4 - Fix FTBFS caused by rust-1.88 on EL9 * Tue Nov 18 2025 Than Ngo - 142.0.10^chromium142.0.7444.162-3 - Fix FTBFS - epel9 has new rust-1.88, dropp chromium-134-rust- libadler2.patch * Fri Nov 14 2025 Than Ngo - 142.0.10^chromium142.0.7444.162-1 - Update to 142.0.7444.162 - * High CVE-2025-13042: Inappropriate implementation in V8 * Tue Nov 11 2025 Dominik 'Rathann' Mierzejewski - 142.0.10^chromium142.0.7444.134-2 - Rebuilt for FFmpeg 8 * Tue Nov 11 2025 Asahi Lina - 142.0.10^chromium142.0.7444.134-1 - Update to cef-142.0.10+g29548e2 (rhbz#2413981) * Sun Nov 09 2025 Than Ngo - 142.0.6^chromium142.0.7444.134-1 - Update to 142.0.7444.134 (rhbz#2413621) - * High CVE-2025-12725: Out of bounds write in WebGPU - * High CVE-2025-12726: Inappropriate implementation in Views - * High CVE-2025-12727: Inappropriate implementation in V8 - * Medium CVE-2025-12728: Inappropriate implementation in Omnibox - * Medium CVE-2025-12729: Inappropriate implementation in Omnibox * Sun Nov 09 2025 Than Ngo - 142.0.6^chromium142.0.7444.59-5 - Add CVEs in changelog - * High CVE-2025-12428: Type Confusion in V8 - * High CVE-2025-12429: Inappropriate implementation in V8 - * High CVE-2025-12430: Object lifecycle issue in Media - * High CVE-2025-12431: Inappropriate implementation in Extensions - * High CVE-2025-12432: Race in V8 - * High CVE-2025-12433: Inappropriate implementation in V8 - * High CVE-2025-12036: Inappropriate implementation in V8 - * Medium CVE-2025-12434: Race in Storage - * Medium CVE-2025-12435: Incorrect security UI in Omnibox - * Medium CVE-2025-12436: Policy bypass in Extensions - * Medium CVE-2025-12437: Use after free in PageInfo - * Medium CVE-2025-12438: Use after free in Ozone - * Medium CVE-2025-12439: Inappropriate implementation in App-Bound Encryption - * Low CVE-2025-12440: Inappropriate implementation in Autofill - * Medium CVE-2025-12441: Out of bounds read in V8 - * Medium CVE-2025-12443: Out of bounds read in WebXR - * Low CVE-2025-12444: Incorrect security UI in Fullscreen UI - * Low CVE-2025-12445: Policy bypass in Extensions - * Low CVE-2025-12446: Incorrect security UI in SplitView - * Low CVE-2025-12447: Incorrect security UI in Omnibox * Tue Nov 04 2025 Dominik 'Rathann' Mierzejewski - 142.0.6^chromium142.0.7444.59-2 - Rebuilt for FFmpeg 8 * Thu Oct 30 2025 Than Ngo - 142.0.6^chromium142.0.7444.59-1 - Update to 142.0.7444.59 - * Update to cef-142.0.6+ga56110d (Asahi Lina) (beta) - * Refreshed ppc64le patches - * Refreshed system-brotli patch - * Refreshed clang++-unknown-argument patch - * Refreshed split-threshold-for-reg-with-hint patch - * Fixed some FTBFS caused by missing header files - * Fixed FTBFS caused by old rust compiler - * Fixed FTBFS caused by new glibc-2.42 in Rawhide - * Fixed FTBFS caused by old python-3.9.x in EL8/9 - * Dropped obsoleted chromium-141-el9-ffmpeg-5.x-duration.patch for old ffmpeg on EL9 * Thu Oct 30 2025 Than Ngo - 141.0.11^chromium141.0.7390.122-1 - Update to 141.0.7390.122 - * High CVE-2025-12036 chromium: Inappropriate implementation in V8 * Thu Oct 30 2025 Than Ngo - 141.0.11^chromium141.0.7390.107-1 - Update 141.0.7390.107 - * High CVE-2025-11756: Use after free in Safe Browsing * Thu Oct 30 2025 Than Ngo - 141.0.11^chromium141.0.7390.76-1 - Update to 141.0.7390.76 * Thu Oct 30 2025 Than Ngo - 141.0.11^chromium141.0.7390.65-1 - Update to 141.0.7390.65 - * High CVE-2025-11458: Heap buffer overflow in Sync - * High CVE-2025-11460: Use after free in Storage - * Medium CVE-2025-11211: Out of bounds read in WebCodecs - remove 0001-Change-use-of-removed-intrinsic.patch as it is included in 141.0.7390.65 * Thu Oct 30 2025 Than Ngo - 141.0.11^chromium141.0.7390.54-1 - Update to 141.0.7390.54 - * Update to cef-141.0.11+g7e73ac4 (rhbz#2402447) (Asahi Lina) - * High CVE-2025-11205: Heap buffer overflow in WebGPU - * High CVE-2025-11206: Heap buffer overflow in Video - * Medium CVE-2025-11207: Side-channel information leakage in Storage - * Medium CVE-2025-11208: Inappropriate implementation in Media - * Medium CVE-2025-11209: Inappropriate implementation in Omnibox - * Medium CVE-2025-11210: Side-channel information leakage in Tab - * Medium CVE-2025-11211: Out of bounds read in Media - * Medium CVE-2025-11212: Inappropriate implementation in Media - * Medium CVE-2025-11213: Inappropriate implementation in Omnibox - * Medium CVE-2025-11215: Off by one error in V8 - * Low CVE-2025-11216: Inappropriate implementation in Storage - * Low CVE-2025-11219: Use after free in V8 - Refreshed ppc64le patches - Fixed issue with incorrect display of the links on startpage in Darkmode - Fixed FTBFS - error: no member named 'bPsnrY' in 'Source_Picture_s' - Fixed, DebugInfo packages aren't being produced - Refreshed rust-clanglib patch - Fixed FTBFS due to old ffmpeg on Epel9 - Fixed FTBFS - error: invalid application of 'sizeof' to an incomplete type 'blink::CSSStyleSheet' - Fixed FTBFS due to missing header files * Tue Sep 30 2025 Than Ngo - 140.1.15^chromium140.0.7339.207-1 - Update to 140.0.7339.207 - * CVE-2025-10890: Side-channel information leakage in V8 - * CVE-2025-10891: Integer overflow in V8 - * CVE-2025-10892: Integer overflow in V8 * Tue Sep 30 2025 Than Ngo - 140.1.15^chromium140.0.7339.185-1 - Update to 140.0.7339.185 - * CVE-2025-10585: Type Confusion in V8 - * CVE-2025-10500: Use after free in Dawn - * CVE-2025-10501: Use after free in WebRTC - * CVE-2025-10502: Heap buffer overflow in ANGLE - * Fix rendering issue on epel9 * Tue Sep 30 2025 Than Ngo - 140.1.15^chromium140.0.7339.127-1 - Update to 140.0.7339.127 - * CVE-2025-10200: Use after free in Serviceworker - * CVE-2025-10201: Inappropriate implementation in Mojo * Tue Sep 30 2025 Than Ngo - 140.1.15^chromium140.0.7339.80-1 - Update to 140.0.7339.80 (rhbz#2396308) - * Update to cef-140.1.15+gfaef09b (rhbz#2380429) (Asahi Lina) - * CVE-2025-9864: Use after free in V8 - * CVE-2025-9865: Inappropriate implementation in Toolbar - * CVE-2025-9866: Inappropriate implementation in Extensions - * CVE-2025-9867: Inappropriate implementation in Downloads * Fri Aug 29 2025 Than Ngo - 139.0.37^chromium139.0.7258.154-1 - Update to 139.0.7258.154 - * CVE-2025-9478: Use after free in ANGLE * Fri Aug 29 2025 Asahi Lina - 139.0.37^chromium139.0.7258.138-1 - Update to cef 139.0.37+gb457b0b (rhbz#2391243) * Fri Aug 29 2025 Than Ngo - 139.0.26^chromium139.0.7258.138-1 - Updated to 139.0.7258.138 - * CVE-2025-9132: Out of bounds write in V8 * Thu Aug 21 2025 Asahi Lina - 139.0.26^chromium139.0.7258.127-1 - Update to cef-139.0.26+g9d80e0d * Thu Aug 14 2025 Than Ngo - 139.0.20^chromium139.0.7258.127-1 - Updated to 139.0.7258.127 (rhbz#2381869) - * CVE-2025-8879: Heap buffer overflow in libaom - * CVE-2025-8880: Race in V8 - * CVE-2025-8901: Out of bounds write in ANGLE - * CVE-2025-8881: Inappropriate implementation in File Picker - * CVE-2025-8882: Use after free in Aura * Thu Aug 14 2025 Than Ngo - 139.0.20^chromium139.0.7258.66-1 - Updated to 139.0.7258.66 - Asahi Lina: Update to cef-139.0.20+g60bd77d - * CVE-2025-8576: Use after free in Extensions - * CVE-2025-8578: Use after free in Cast - * CVE-2025-8579: Inappropriate implementation in Gemini Live in Chrome - * CVE-2025-8580: Inappropriate implementation in Filesystems - * CVE-2025-8581: Inappropriate implementation in Extensions - * CVE-2025-8582: Insufficient validation of untrusted input in DOM - * CVE-2025-8583: Inappropriate implementation in Permissions * Thu Aug 14 2025 Than Ngo - 138.0.25^chromium138.0.7204.183-1 - Update to 138.0.7204.183 - * CVE-2025-8292: Use after free in Media Stream * Thu Aug 14 2025 Than Ngo - 138.0.25^chromium138.0.7204.168-1 - Update to 138.0.7204.168 - * CVE-2025-8010: Type Confusion in V8 - * CVE-2025-8011: Type Confusion in V8 * Thu Aug 14 2025 Tom Stellard - 138.0.25^chromium138.0.7204.157-4 - Backport fix for build failure with clang-21 * Thu Jul 24 2025 Dominik Mierzejewski - 138.0.25^chromium138.0.7204.157-3 - drop unused yasm build dependency * Wed Jul 23 2025 Fedora Release Engineering - 138.0.25^chromium138.0.7204.157-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Thu Jul 17 2025 Asahi Lina - 138.0.25^chromium138.0.7204.157-1 - Update to cef-138.0.25+g251e1c1 (rhbz#2380429) * Thu Jul 17 2025 Than Ngo - 138.0.21^chromium138.0.7204.157-1 - Update to 138.0.7204.157 - * CVE-2025-7656: Integer overflow in V8 - * CVE-2025-7657: Use after free in WebRTC - * CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU * Sat Jul 12 2025 Asahi Lina - 138.0.21^chromium138.0.7204.100-1 - Update to cef-138.0.21+g54811fe (rhbz#2379500) - Add cherry-pick.sh convenience script * Sat Jul 12 2025 Than Ngo - 138.0.15^chromium138.0.7204.100-1 - Update to 138.0.7204.100 * Sun Jul 06 2025 Asahi Lina - 138.0.15^chromium138.0.7204.92-3 - Do not strip debug info from libraries * Fri Jul 04 2025 Asahi Lina - 138.0.15^chromium138.0.7204.92-2 - Enable building debuginfo package * Fri Jul 04 2025 Than Ngo - 138.0.15^chromium138.0.7204.92-1 - Update to 138.0.7204.92 - * High CVE-2025-6554: Type Confusion in V8 * Fri Jul 04 2025 Asahi Lina - 138.0.15^chromium138.0.7204.49-4 - Disable some Chromium features not appropriate for CEF * Fri Jul 04 2025 Asahi Lina - 138.0.15^chromium138.0.7204.49-1 - Update to cef-138.0.15+gd0f1f64 - Than Ngo : Update to 138.0.7204.49 - * CVE-2025-6555: Use after free in Animation - * CVE-2025-6556: Insufficient policy enforcement in Loader - * CVE-2025-6557: Insufficient data validation in DevTools * Wed Jul 02 2025 Than Ngo - 137.0.17^chromium137.0.7151.119-1 - Update to 137.0.7151.119 - * CVE-2025-6191: Integer overflow in V8 - * CVE-2025-6192: Use after free in Profiler * Tue Jun 17 2025 Than Ngo - 137.0.17^chromium137.0.7151.103-1 - Update to 137.0.7151.103 - Provide correct version for bundle librarires - Fix rhbz#2368923, Chromium crash * Tue Jun 17 2025 Than Ngo - 137.0.17^chromium137.0.7151.68-1 - Update to 137.0.7151.68 * Tue Jun 17 2025 Asahi Lina - 137.0.17^chromium137.0.7151.55-1 - Update to cef-137.0.17+gf354b0e - Than Ngo : Update to 137.0.7151.55 - Fix FTBFS caused by simdutf and pdfium-png_decoder - Remove chromium-135-gperf.patch and chromium-135-add-cfi-suppressions- for-pipewire-functions.patch, merged by upstream - Refresh ppc64le patches - Enable system simdutf for F43 * Tue Jun 17 2025 Asahi Lina - 136.1.6^chromium136.0.7103.113-1 - Initial import (rhbz#2368737) ## END: Generated by rpmautospec