Описание
Security update for chromium
This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 147.0.7727.101 (boo#1262174)
- CVE-2026-6296: Heap buffer overflow in ANGLE
- CVE-2026-6297: Use after free in Proxy
- CVE-2026-6298: Heap buffer overflow in Skia
- CVE-2026-6299: Use after free in Prerender
- CVE-2026-6358: Use after free in XR
- CVE-2026-6359: Use after free in Video
- CVE-2026-6300: Use after free in CSS
- CVE-2026-6301: Type Confusion in Turbofan
- CVE-2026-6302: Use after free in Video
- CVE-2026-6303: Use after free in Codecs
- CVE-2026-6304: Use after free in Graphite
- CVE-2026-6305: Heap buffer overflow in PDFium
- CVE-2026-6306: Heap buffer overflow in PDFium
- CVE-2026-6307: Type Confusion in Turbofan
- CVE-2026-6308: Out of bounds read in Media
- CVE-2026-6309: Use after free in Viz
- CVE-2026-6360: Use after free in FileSystem
- CVE-2026-6310: Use after free in Dawn
- CVE-2026-6311: Uninitialized Use in Accessibility
- CVE-2026-6312: Insufficient policy enforcement in Passwords
- CVE-2026-6313: Insufficient policy enforcement in CORS
- CVE-2026-6314: Out of bounds write in GPU
- CVE-2026-6315: Use after free in Permissions
- CVE-2026-6316: Use after free in Forms
- CVE-2026-6361: Heap buffer overflow in PDFium
- CVE-2026-6362: Use after free in Codecs
- CVE-2026-6317: Use after free in Cast
- CVE-2026-6363: Type Confusion in V8
- CVE-2026-6318: Use after free in Codecs
- CVE-2026-6319: Use after free in Payments
- CVE-2026-6364: Out of bounds read in Skia
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1262174
- SUSE CVE CVE-2026-6296 page
- SUSE CVE CVE-2026-6297 page
- SUSE CVE CVE-2026-6298 page
- SUSE CVE CVE-2026-6299 page
- SUSE CVE CVE-2026-6300 page
- SUSE CVE CVE-2026-6301 page
- SUSE CVE CVE-2026-6302 page
- SUSE CVE CVE-2026-6303 page
- SUSE CVE CVE-2026-6304 page
- SUSE CVE CVE-2026-6305 page
- SUSE CVE CVE-2026-6306 page
- SUSE CVE CVE-2026-6307 page
- SUSE CVE CVE-2026-6308 page
- SUSE CVE CVE-2026-6309 page
- SUSE CVE CVE-2026-6310 page
- SUSE CVE CVE-2026-6311 page
- SUSE CVE CVE-2026-6312 page
- SUSE CVE CVE-2026-6313 page
Описание
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-6296
- SUSE Bug 1262174
Описание
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-6297
- SUSE Bug 1262174
Описание
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-6298
- SUSE Bug 1262174
Описание
Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-6299
- SUSE Bug 1262174
Описание
Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6300
- SUSE Bug 1262174
Описание
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6301
- SUSE Bug 1262174
Описание
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6302
- SUSE Bug 1262174
Описание
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6303
- SUSE Bug 1262174
Описание
Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6304
- SUSE Bug 1262174
Описание
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6305
- SUSE Bug 1262174
Описание
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6306
- SUSE Bug 1262174
Описание
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6307
- SUSE Bug 1262174
Описание
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6308
- SUSE Bug 1262174
Описание
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6309
- SUSE Bug 1262174
Описание
Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6310
- SUSE Bug 1262174
Описание
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6311
- SUSE Bug 1262174
Описание
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6312
- SUSE Bug 1262174
Описание
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6313
- SUSE Bug 1262174
Описание
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6314
- SUSE Bug 1262174
Описание
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6315
- SUSE Bug 1262174
Описание
Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6316
- SUSE Bug 1262174
Описание
Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6317
- SUSE Bug 1262174
Описание
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2026-6318
- SUSE Bug 1262174
Описание
Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2026-6319
- SUSE Bug 1262174
Описание
Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-6358
- SUSE Bug 1262174
Описание
Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6359
- SUSE Bug 1262174
Описание
Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6360
- SUSE Bug 1262174
Описание
Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6361
- SUSE Bug 1262174
Описание
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-6362
- SUSE Bug 1262174
Описание
Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2026-6363
- SUSE Bug 1262174
Описание
Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. (Chromium security severity: Medium)
Затронутые продукты
Ссылки
- CVE-2026-6364
- SUSE Bug 1262174