SUSE alert openSUSE-SU-2026:21135-1 (chromium)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21135-1: important: Security update for chromium
Date:
             
 
Tue, 30 Jun 2026 09:48:33 +0200
Message-ID:
             
 
<20260630074833.2675BFF75@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for chromium
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21135-1
Rating: important
References:

  * bsc#1268373



Cross-References:

  * CVE-2026-12437
  * CVE-2026-12438
  * CVE-2026-12439
  * CVE-2026-12440
  * CVE-2026-12441
  * CVE-2026-12442
  * CVE-2026-12443
  * CVE-2026-12444
  * CVE-2026-12445
  * CVE-2026-12446
  * CVE-2026-12447
  * CVE-2026-12448
  * CVE-2026-12449
  * CVE-2026-12450
  * CVE-2026-12451
  * CVE-2026-12452
  * CVE-2026-12453
  * CVE-2026-12454
  * CVE-2026-12455
  * CVE-2026-12456
  * CVE-2026-12457
  * CVE-2026-12458
  * CVE-2026-12459
  * CVE-2026-12460
  * CVE-2026-12461
  * CVE-2026-12462
  * CVE-2026-12463
  * CVE-2026-12464
  * CVE-2026-12465
  * CVE-2026-12466
  * CVE-2026-12467
  * CVE-2026-12468
  * CVE-2026-12469



Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 33 vulnerabilities and has one bug fix can now be installed.

Description:

This update for chromium fixes the following issues:

Changes in chromium:

- Chromium 149.0.7827.155 (boo#1268373):
  * CVE-2026-12437: Use after free in WebShare
  * CVE-2026-12438: Inappropriate implementation in WebView
  * CVE-2026-12439: Use after free in Digital Credentials
  * CVE-2026-12440: Use after free in DigitalCredentials
  * CVE-2026-12441: Use after free in File Input
  * CVE-2026-12442: Use after free in Passwords
  * CVE-2026-12443: Use after free in Web Authentication
  * CVE-2026-12444: Out of bounds read in Chromoting
  * CVE-2026-12445: Use after free in Extensions
  * CVE-2026-12446: Insufficient data validation in Passwords
  * CVE-2026-12447: Heap buffer overflow in WebRTC
  * CVE-2026-12448: Inappropriate implementation in WebView
  * CVE-2026-12449: Use after free in Chromoting
  * CVE-2026-12450: Inappropriate implementation in Media
  * CVE-2026-12451: Use after free in DigitalCredentials
  * CVE-2026-12452: Use after free in Downloads
  * CVE-2026-12453: Insufficient validation of untrusted input in Input
  * CVE-2026-12454: Race in Safe Browsing
  * CVE-2026-12455: Use after free in Tab Strip
  * CVE-2026-12456: Insufficient validation of untrusted input in Extensions
  * CVE-2026-12457: Insufficient data validation in Extensions
  * CVE-2026-12458: Incorrect security UI in Passwords
  * CVE-2026-12459: Inappropriate implementation in Serial
  * CVE-2026-12460: Insufficient policy enforcement in File System Access
  * CVE-2026-12461: Out of bounds read in WebRTC
  * CVE-2026-12462: Use after free in Media
  * CVE-2026-12463: Inappropriate implementation in Views
  * CVE-2026-12464: Use after free in Browser
  * CVE-2026-12465: Insufficient validation of untrusted input in Metrics
  * CVE-2026-12466: Heap buffer overflow in WebRTC
  * CVE-2026-12467: Use after free in Extensions
  * CVE-2026-12468: Inappropriate implementation in Updater
  * CVE-2026-12469: Uninitialized Use in GPU


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-330=1

Package List:

- openSUSE Leap 16.0:

  chromedriver-149.0.7827.155-bp160.1.1
  chromium-149.0.7827.155-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-12437.html
  * https://www.suse.com/security/cve/CVE-2026-12438.html
  * https://www.suse.com/security/cve/CVE-2026-12439.html
  * https://www.suse.com/security/cve/CVE-2026-12440.html
  * https://www.suse.com/security/cve/CVE-2026-12441.html
  * https://www.suse.com/security/cve/CVE-2026-12442.html
  * https://www.suse.com/security/cve/CVE-2026-12443.html
  * https://www.suse.com/security/cve/CVE-2026-12444.html
  * https://www.suse.com/security/cve/CVE-2026-12445.html
  * https://www.suse.com/security/cve/CVE-2026-12446.html
  * https://www.suse.com/security/cve/CVE-2026-12447.html
  * https://www.suse.com/security/cve/CVE-2026-12448.html
  * https://www.suse.com/security/cve/CVE-2026-12449.html
  * https://www.suse.com/security/cve/CVE-2026-12450.html
  * https://www.suse.com/security/cve/CVE-2026-12451.html
  * https://www.suse.com/security/cve/CVE-2026-12452.html
  * https://www.suse.com/security/cve/CVE-2026-12453.html
  * https://www.suse.com/security/cve/CVE-2026-12454.html
  * https://www.suse.com/security/cve/CVE-2026-12455.html
  * https://www.suse.com/security/cve/CVE-2026-12456.html
  * https://www.suse.com/security/cve/CVE-2026-12457.html
  * https://www.suse.com/security/cve/CVE-2026-12458.html
  * https://www.suse.com/security/cve/CVE-2026-12459.html
  * https://www.suse.com/security/cve/CVE-2026-12460.html
  * https://www.suse.com/security/cve/CVE-2026-12461.html
  * https://www.suse.com/security/cve/CVE-2026-12462.html
  * https://www.suse.com/security/cve/CVE-2026-12463.html
  * https://www.suse.com/security/cve/CVE-2026-12464.html
  * https://www.suse.com/security/cve/CVE-2026-12465.html
  * https://www.suse.com/security/cve/CVE-2026-12466.html
  * https://www.suse.com/security/cve/CVE-2026-12467.html
  * https://www.suse.com/security/cve/CVE-2026-12468.html
  * https://www.suse.com/security/cve/CVE-2026-12469.html