Описание
Security update for chromium
This update for chromium fixes the following issues:
Changes in chromium:
- Chromium 149.0.7827.155 (boo#1268373):
- CVE-2026-12437: Use after free in WebShare
- CVE-2026-12438: Inappropriate implementation in WebView
- CVE-2026-12439: Use after free in Digital Credentials
- CVE-2026-12440: Use after free in DigitalCredentials
- CVE-2026-12441: Use after free in File Input
- CVE-2026-12442: Use after free in Passwords
- CVE-2026-12443: Use after free in Web Authentication
- CVE-2026-12444: Out of bounds read in Chromoting
- CVE-2026-12445: Use after free in Extensions
- CVE-2026-12446: Insufficient data validation in Passwords
- CVE-2026-12447: Heap buffer overflow in WebRTC
- CVE-2026-12448: Inappropriate implementation in WebView
- CVE-2026-12449: Use after free in Chromoting
- CVE-2026-12450: Inappropriate implementation in Media
- CVE-2026-12451: Use after free in DigitalCredentials
- CVE-2026-12452: Use after free in Downloads
- CVE-2026-12453: Insufficient validation of untrusted input in Input
- CVE-2026-12454: Race in Safe Browsing
- CVE-2026-12455: Use after free in Tab Strip
- CVE-2026-12456: Insufficient validation of untrusted input in Extensions
- CVE-2026-12457: Insufficient data validation in Extensions
- CVE-2026-12458: Incorrect security UI in Passwords
- CVE-2026-12459: Inappropriate implementation in Serial
- CVE-2026-12460: Insufficient policy enforcement in File System Access
- CVE-2026-12461: Out of bounds read in WebRTC
- CVE-2026-12462: Use after free in Media
- CVE-2026-12463: Inappropriate implementation in Views
- CVE-2026-12464: Use after free in Browser
- CVE-2026-12465: Insufficient validation of untrusted input in Metrics
- CVE-2026-12466: Heap buffer overflow in WebRTC
- CVE-2026-12467: Use after free in Extensions
- CVE-2026-12468: Inappropriate implementation in Updater
- CVE-2026-12469: Uninitialized Use in GPU
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1268373
- SUSE CVE CVE-2026-12437 page
- SUSE CVE CVE-2026-12438 page
- SUSE CVE CVE-2026-12439 page
- SUSE CVE CVE-2026-12440 page
- SUSE CVE CVE-2026-12441 page
- SUSE CVE CVE-2026-12442 page
- SUSE CVE CVE-2026-12443 page
- SUSE CVE CVE-2026-12444 page
- SUSE CVE CVE-2026-12445 page
- SUSE CVE CVE-2026-12446 page
- SUSE CVE CVE-2026-12447 page
- SUSE CVE CVE-2026-12448 page
- SUSE CVE CVE-2026-12449 page
- SUSE CVE CVE-2026-12450 page
- SUSE CVE CVE-2026-12451 page
- SUSE CVE CVE-2026-12452 page
- SUSE CVE CVE-2026-12453 page
- SUSE CVE CVE-2026-12454 page
Описание
Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12437
- SUSE Bug 1268373
Описание
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12438
- SUSE Bug 1268373
Описание
Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12439
- SUSE Bug 1268373
Описание
Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12440
- SUSE Bug 1268373
Описание
Use after free in File Input in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12441
- SUSE Bug 1268373
Описание
Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12442
- SUSE Bug 1268373
Описание
Use after free in Web Authentication in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Затронутые продукты
Ссылки
- CVE-2026-12443
- SUSE Bug 1268373
Описание
Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12444
- SUSE Bug 1268373
Описание
Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12445
- SUSE Bug 1268373
Описание
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12446
- SUSE Bug 1268373
Описание
Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12447
- SUSE Bug 1268373
Описание
Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12448
- SUSE Bug 1268373
Описание
Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12449
- SUSE Bug 1268373
Описание
Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12450
- SUSE Bug 1268373
Описание
Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12451
- SUSE Bug 1268373
Описание
Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12452
- SUSE Bug 1268373
Описание
Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12453
- SUSE Bug 1268373
Описание
Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12454
- SUSE Bug 1268373
Описание
Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12455
- SUSE Bug 1268373
Описание
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12456
- SUSE Bug 1268373
Описание
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12457
- SUSE Bug 1268373
Описание
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12458
- SUSE Bug 1268373
Описание
Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12459
- SUSE Bug 1268373
Описание
Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12460
- SUSE Bug 1268373
Описание
Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12461
- SUSE Bug 1268373
Описание
Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12462
- SUSE Bug 1268373
Описание
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12463
- SUSE Bug 1268373
Описание
Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12464
- SUSE Bug 1268373
Описание
Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12465
- SUSE Bug 1268373
Описание
Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12466
- SUSE Bug 1268373
Описание
Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12467
- SUSE Bug 1268373
Описание
Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12468
- SUSE Bug 1268373
Описание
Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Затронутые продукты
Ссылки
- CVE-2026-12469
- SUSE Bug 1268373