openSUSE-SU-2026:21913-1

Severidad por fuente

Ninguna fuente da una puntuación CVSS.

La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.

Descripción

This update for chromium fixes the following issues: Changes in chromium: - Chromium 153.0.8010.47 (boo#1280687): * CVE-2026-91726: Out of bounds read in WebGL * CVE-2026-91721: Use after free in Internals * CVE-2026-91749: Use after free in Workers * CVE-2026-91724: Use after free in Input * CVE-2026-91728: Integer overflow in V8 * CVE-2026-91734: Incorrect authorization in Core * CVE-2026-91727: Incorrect reference resolution in Extensions * CVE-2026-91743: Race condition in Core * CVE-2026-91744: Race condition in PlatformIntegration * CVE-2026-91712: Race condition in Extensions * CVE-2026-91748: Race condition in Extensions * CVE-2026-91720: Uninitialized resource in ANGLE * CVE-2026-91731: Type confusion in Compositing * CVE-2026-91747: Use after free in Skia * CVE-2026-91733: Improper state validation in Skia * CVE-2026-91741: Type confusion in CacheStorage * CVE-2026-91709: Type confusion in ServiceWorker * CVE-2026-91717: Missing authorization in Android * CVE-2026-91735: Incorrect authorization in WebUI * CVE-2026-91708: Race condition in Network * CVE-2026-91736: Use after free in DOM * CVE-2026-91740: Uninitialized resource in Skia * CVE-2026-91710: Use after free in WebAppInstalls * CVE-2026-91718: Use after free in Core * CVE-2026-91716: Use after free in Auth * CVE-2026-91746: Integer overflow in Compositing * CVE-2026-91729: Use after free in DigitalCredentials * CVE-2026-91737: Use after free in PDF * CVE-2026-91711: Out of bounds write in ServiceWorker * CVE-2026-91715: Type confusion in ServiceWorker * CVE-2026-91745: Use after free in V8 * CVE-2026-91723: Race condition in WebAppInstalls * CVE-2026-91732: Missing authorization in AppManifest * CVE-2026-91742: Confused deputy in PriceTracking * CVE-2026-91714: Observable discrepancy in Fonts * CVE-2026-91725: Observable discrepancy in CSS * CVE-2026-91739: Missing authorization in Transactions Platform * CVE-2026-91713: Missing authorization in Browser * CVE-2026-91738: Improper input validation in ANGLE * CVE-2026-91730: Incomplete cleanup in GetUserMedia * CVE-2026-91722: Use after free in Input * CVE-2026-91719: Code injection in XML

Paquetes afectados y versiones corregidas

Referencias

• https://bugzilla.suse.com/1280687
• https://www.suse.com/security/cve/CVE-2026-91708/
• https://www.suse.com/security/cve/CVE-2026-91709/
• https://www.suse.com/security/cve/CVE-2026-91710/
• https://www.suse.com/security/cve/CVE-2026-91711/
• https://www.suse.com/security/cve/CVE-2026-91712/
• https://www.suse.com/security/cve/CVE-2026-91713/
• https://www.suse.com/security/cve/CVE-2026-91714/