SUSE alert openSUSE-SU-2026:20372-1 (chromium)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:20372-1: critical: Security update for chromium
Date:
             
 
Wed, 18 Mar 2026 17:52:10 +0100
Message-ID:
             
 
<20260318165210.39325FD57@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for chromium
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20372-1
Rating: critical
References:

  * bsc#1259530
  * bsc#1259648
  * bsc#1259659



Cross-References:

  * CVE-2026-3909
  * CVE-2026-3910
  * CVE-2026-3913
  * CVE-2026-3914
  * CVE-2026-3915
  * CVE-2026-3916
  * CVE-2026-3917
  * CVE-2026-3918
  * CVE-2026-3919
  * CVE-2026-3920
  * CVE-2026-3921
  * CVE-2026-3922
  * CVE-2026-3923
  * CVE-2026-3924
  * CVE-2026-3925
  * CVE-2026-3926
  * CVE-2026-3927
  * CVE-2026-3928
  * CVE-2026-3929
  * CVE-2026-3930
  * CVE-2026-3931
  * CVE-2026-3932
  * CVE-2026-3934
  * CVE-2026-3935
  * CVE-2026-3936
  * CVE-2026-3937
  * CVE-2026-3938
  * CVE-2026-3939
  * CVE-2026-3940
  * CVE-2026-3941
  * CVE-2026-3942



Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 31 vulnerabilities and has 3 bug fixes can now be installed.

Description:

This update for chromium fixes the following issues:

Changes in chromium:

- Chromium 146.0.7680.80:
	  * CVE-2026-3909: Out of bounds write in Skia (boo#1259659)

- Chromium 146.0.7680.75 (released 2026-03-12) (boo#1259648)
  * CVE-2026-3910: Inappropriate implementation in V8.

- Chromium 146.0.7680.71 (released 2026-03-11) (boo#1259530)
  * CVE-2026-3913: Heap buffer overflow in WebML
  * CVE-2026-3914: Integer overflow in WebML
  * CVE-2026-3915: Heap buffer overflow in WebML
  * CVE-2026-3916: Out of bounds read in Web Speech
  * CVE-2026-3917: Use after free in Agents
  * CVE-2026-3918: Use after free in WebMCP
  * CVE-2026-3919: Use after free in Extensions
  * CVE-2026-3920: Out of bounds memory access in WebML
  * CVE-2026-3921: Use after free in TextEncoding
  * CVE-2026-3922: Use after free in MediaStream
  * CVE-2026-3923: Use after free in WebMIDI
  * CVE-2026-3924: Use after free in WindowDialog
  * CVE-2026-3925: Incorrect security UI in LookalikeChecks
  * CVE-2026-3926: Out of bounds read in V8
  * CVE-2026-3927: Incorrect security UI in PictureInPicture
  * CVE-2026-3928: Insufficient policy enforcement in Extensions
  * CVE-2026-3929: Side-channel information leakage in ResourceTiming
  * CVE-2026-3930: Unsafe navigation in Navigation
  * CVE-2026-3931: Heap buffer overflow in Skia
  * CVE-2026-3932: Insufficient policy enforcement in PDF
  * CVE-2026-3934: Insufficient policy enforcement in ChromeDriver
  * CVE-2026-3935: Incorrect security UI in WebAppInstalls
  * CVE-2026-3936: Use after free in WebView
  * CVE-2026-3937: Incorrect security UI in Downloads
  * CVE-2026-3938: Insufficient policy enforcement in Clipboard
  * CVE-2026-3939: Insufficient policy enforcement in PDF
  * CVE-2026-3940: Insufficient policy enforcement in DevTools
  * CVE-2026-3941: Insufficient policy enforcement in DevTools
  * CVE-2026-3942: Incorrect security UI in PictureInPicture


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-165=1

Package List:

- openSUSE Leap 16.0:

  chromedriver-146.0.7680.80-bp160.1.1
  chromium-146.0.7680.80-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-3909.html
  * https://www.suse.com/security/cve/CVE-2026-3910.html
  * https://www.suse.com/security/cve/CVE-2026-3913.html
  * https://www.suse.com/security/cve/CVE-2026-3914.html
  * https://www.suse.com/security/cve/CVE-2026-3915.html
  * https://www.suse.com/security/cve/CVE-2026-3916.html
  * https://www.suse.com/security/cve/CVE-2026-3917.html
  * https://www.suse.com/security/cve/CVE-2026-3918.html
  * https://www.suse.com/security/cve/CVE-2026-3919.html
  * https://www.suse.com/security/cve/CVE-2026-3920.html
  * https://www.suse.com/security/cve/CVE-2026-3921.html
  * https://www.suse.com/security/cve/CVE-2026-3922.html
  * https://www.suse.com/security/cve/CVE-2026-3923.html
  * https://www.suse.com/security/cve/CVE-2026-3924.html
  * https://www.suse.com/security/cve/CVE-2026-3925.html
  * https://www.suse.com/security/cve/CVE-2026-3926.html
  * https://www.suse.com/security/cve/CVE-2026-3927.html
  * https://www.suse.com/security/cve/CVE-2026-3928.html
  * https://www.suse.com/security/cve/CVE-2026-3929.html
  * https://www.suse.com/security/cve/CVE-2026-3930.html
  * https://www.suse.com/security/cve/CVE-2026-3931.html
  * https://www.suse.com/security/cve/CVE-2026-3932.html
  * https://www.suse.com/security/cve/CVE-2026-3934.html
  * https://www.suse.com/security/cve/CVE-2026-3935.html
  * https://www.suse.com/security/cve/CVE-2026-3936.html
  * https://www.suse.com/security/cve/CVE-2026-3937.html
  * https://www.suse.com/security/cve/CVE-2026-3938.html
  * https://www.suse.com/security/cve/CVE-2026-3939.html
  * https://www.suse.com/security/cve/CVE-2026-3940.html
  * https://www.suse.com/security/cve/CVE-2026-3941.html
  * https://www.suse.com/security/cve/CVE-2026-3942.html