CVS commit: pkgsrc/www/chromium

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/www/chromium
From: "Robert Bagdan" <kikadf%netbsd.org@localhost>
Date: Mon, 20 Jul 2026 13:53:51 +0000

Module Name:    pkgsrc
Committed By:   kikadf
Date:           Mon Jul 20 13:53:51 UTC 2026

Modified Files:
        pkgsrc/www/chromium: Makefile distinfo
        pkgsrc/www/chromium/patches:
            patch-components_password__manager_core_browser_features_password__features.cc

Log Message:
www/chromium: update to 150.0.7871.128

* 150.0.7871.128
This update includes 7 security fixes. Please see the Chrome Security Page for more information.

[N/A][516987782] Critical CVE-2026-15899: Use after free in CameraCapture. Reported by Google on 2026-05-27
[N/A][523750584] Critical CVE-2026-15900: Use after free in GPU. Reported by Google on 2026-06-14
[N/A][533446300] Critical CVE-2026-15901: Use after free in Network. Reported by Google on 2026-07-10
[N/A][522436154] High CVE-2026-15902: Use after free in Cast. Reported by Google on 2026-06-10
[TBD][531503216] High CVE-2026-15903: Out of bounds read and write in V8. Reported by OpenAI Codex Security (amyb) on 2026-07-06
[N/A][532925350] High CVE-2026-15904: Use after free in Ozone. Reported by Google on 2026-07-09
[N/A][532970574] High CVE-2026-15905: Use after free in Aura. Reported by Google on 2026-07-09

* 150.0.7871.124
This update includes 15 security fixes. Please see the Chrome Security Page for more information.

[N/A][517100492] Critical CVE-2026-15764: Use after free in Ozone. Reported by Google on 2026-05-27
[N/A][518007484] Critical CVE-2026-15765: Use after free in Ozone. Reported by Google on 2026-05-29
[N/A][514010477] High CVE-2026-15766: Uninitialized Use in Skia. Reported by Google on 2026-05-17
[N/A][514748734] High CVE-2026-15767: Heap buffer overflow in libyuv. Reported by Google on 2026-05-19
[N/A][517931625] High CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas. Reported by Google on 2026-05-29
[N/A][519731111] High CVE-2026-15769: Insufficient validation of untrusted input in Linux Toolkit Theming. Reported by Google on 2026-06-03
[N/A][524792614] High CVE-2026-15770: Uninitialized Use in V8. Reported by Google on 2026-06-17
[N/A][525177160] High CVE-2026-15771: Insufficient validation of untrusted input in Media. Reported by Google on 2026-06-18
[N/A][525317502] High CVE-2026-15772: Use after free in GPU. Reported by Google on 2026-06-18
[TBD][527676561] High CVE-2026-15773: Use after free in Core. Reported by xinchaotian of Microsoft on 2026-06-25
[N/A][530646115] High CVE-2026-15774: Use after free in Skia. Reported by Google on 2026-07-03
[TBD][531319201] High CVE-2026-15775: Insufficient policy enforcement in V8. Reported by wang1r923096443%gmail.com@localhost on 2026-07-05
[TBD][532595489] High CVE-2026-15776: Type Confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-07-08
[N/A][532929679] High CVE-2026-15777: Use after free in UI. Reported by Google on 2026-07-09
[N/A][513795122] Medium CVE-2026-15778: Insufficient validation of untrusted input in Navigation. Reported by Google on 2026-05-16

* 150.0.7871.114
This update includes 27 security fixes. Please see the Chrome Security Page for more information.

[N/A][518006275] Critical CVE-2026-15112: Use after free in Ozone. Reported by Google on 2026-05-29
[N/A][524045160] Critical CVE-2026-15129: Use after free in Views. Reported by Google on 2026-06-15
[$500][527385397] High CVE-2026-15132: Uninitialized Use in V8. Reported by Pierre Langlois from Arm on 2026-06-24
[$500][527406824] High CVE-2026-15133: Use after free in InterestGroups. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-06-24
[N/A][515443146] High CVE-2026-15108: Integer overflow in Extensions API. Reported by Google on 2026-05-21
[N/A][516899138] High CVE-2026-15109: Uninitialized Use in ANGLE. Reported by Google on 2026-05-26
[N/A][516948486] High CVE-2026-15110: Use after free in Extensions. Reported by Google on 2026-05-27
[N/A][517508651] High CVE-2026-15111: Use after free in Views. Reported by Google on 2026-05-28
[N/A][520540744] High CVE-2026-15113: Use after free in Autofill. Reported by Google on 2026-06-05
[N/A][520565945] High CVE-2026-15114: Out of bounds read and write in Codecs. Reported by Google on 2026-06-06
[N/A][520576676] High CVE-2026-15115: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-06-06
[N/A][522092013] High CVE-2026-15116: Use after free in Actor. Reported by Google on 2026-06-10
[N/A][522568496] High CVE-2026-15117: Use after free in Payments. Reported by Google on 2026-06-11
[N/A][523238265] High CVE-2026-15118: Use after free in Input. Reported by Google on 2026-06-12
[N/A][523505418] High CVE-2026-15119: Inappropriate implementation in GetUserMedia. Reported by Google on 2026-06-13
[N/A][523609602] High CVE-2026-15120: Use after free in Core. Reported by Google on 2026-06-13
[N/A][523712556] High CVE-2026-15121: Use after free in WebRTC. Reported by Google on 2026-06-14
[N/A][523717219] High CVE-2026-15122: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-06-14
[N/A][523729553] High CVE-2026-15123: Insufficient data validation in DOM. Reported by Google on 2026-06-14
[N/A][523735038] High CVE-2026-15124: Insufficient policy enforcement in Passwords. Reported by Google on 2026-06-14
[N/A][523737685] High CVE-2026-15125: Inappropriate implementation in Forms. Reported by Google on 2026-06-14
[N/A][523748081] High CVE-2026-15126: Use after free in Forms. Reported by Google on 2026-06-14
[N/A][523752265] High CVE-2026-15127: Inappropriate implementation in WebGL. Reported by Google on 2026-06-14
[N/A][523756329] High CVE-2026-15128: Inappropriate implementation in Forms. Reported by Google on 2026-06-14
[N/A][526541544] High CVE-2026-15130: Insufficient policy enforcement in Navigation. Reported by Google on 2026-06-22
[$2000][503553615] Medium CVE-2026-15107: Use after free in IndexedDB. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2026-04-17
[N/A][526542464] Medium CVE-2026-15131: Insufficient data validation in Navigation. Reported by Google on 2026-06-22


To generate a diff of this commit:
cvs rdiff -u -r1.69 -r1.70 pkgsrc/www/chromium/Makefile
cvs rdiff -u -r1.50 -r1.51 pkgsrc/www/chromium/distinfo
cvs rdiff -u -r1.23 -r1.24 \
    pkgsrc/www/chromium/patches/patch-components_password__manager_core_browser_features_password__features.cc

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/chromium/Makefile
diff -u pkgsrc/www/chromium/Makefile:1.69 pkgsrc/www/chromium/Makefile:1.70
--- pkgsrc/www/chromium/Makefile:1.69   Mon Jul 13 04:36:34 2026
+++ pkgsrc/www/chromium/Makefile        Mon Jul 20 13:53:51 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.69 2026/07/13 04:36:34 wiz Exp $
+# $NetBSD: Makefile,v 1.70 2026/07/20 13:53:51 kikadf Exp $
 
 DISTNAME=                      chromium-${VERSION}
-VERSION=                       150.0.7871.100
-PKGREVISION=                   1
+VERSION=                       150.0.7871.128
 CATEGORIES=                    www
 MASTER_SITES=                  https://commondatastorage.googleapis.com/chromium-browser-official/
 EXTRACT_SUFX_C=                        .tar.xz

Index: pkgsrc/www/chromium/distinfo
diff -u pkgsrc/www/chromium/distinfo:1.50 pkgsrc/www/chromium/distinfo:1.51
--- pkgsrc/www/chromium/distinfo:1.50   Wed Jul  8 13:42:13 2026
+++ pkgsrc/www/chromium/distinfo        Mon Jul 20 13:53:51 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.50 2026/07/08 13:42:13 kikadf Exp $
+$NetBSD: distinfo,v 1.51 2026/07/20 13:53:51 kikadf Exp $
 
 BLAKE2s (ahash-0.8.12.crate) = 157e4e2836883526fa391419f08c2aa4c932fb96ddf2b254bb436193691754c4
 SHA512 (ahash-0.8.12.crate) = 872e5fa0d1334abac96d10eca18f32c2b1a1e0b38671c132b6effd029e9f0147ddcef79f4d85c8baf0537ddfb8c39a85f61d073e1fb3143dba659a8385641e1b
@@ -66,12 +66,12 @@ Size (cc-1.2.61.crate) = 97163 bytes
 BLAKE2s (cfg-if-1.0.4.crate) = 517b7cff4f133f9b02492c0db281822fd02c24941a7aa4f9b1502895dc5e58d9
 SHA512 (cfg-if-1.0.4.crate) = 176e04df7ba783b7143bb84397b777f5c5a1305c08a5c3a218d4a66830620be89ed68992ba27686165bcd3fb2f34b2daf80b2a1d4b481ecc267c988e84d28e9d
 Size (cfg-if-1.0.4.crate) = 9360 bytes
-BLAKE2s (chromium-150.0.7871.100-lite.tar.xz) = 08e1068a8861caa608b6868fe5d6c3d5db0610990a527d3306b03d59785a00e7
-SHA512 (chromium-150.0.7871.100-lite.tar.xz) = a965cedb12bf98116cd86d15cb8b7fd5250c36c6e8d6ba111fcce2335b91c3125c19cab9c7d799e0cad6fe7fe0d0da51833edb5cc750b0d5ce9b0fdfffd16a24
-Size (chromium-150.0.7871.100-lite.tar.xz) = 1668003676 bytes
-BLAKE2s (chromium-150.0.7871.100-testdata.tar.xz) = 0ba28e89646352f44fc49180b0ec2a91739a285ad9f2bbe8753bbb8ffbdd755f
-SHA512 (chromium-150.0.7871.100-testdata.tar.xz) = b09a630a200b4f1eb68e950dfd993546af5ce42971c7fe335ed832ed004dd72b949ac2c9642f1541caa446d7e9245761a723ac6b4d6ec0263b90506520166579
-Size (chromium-150.0.7871.100-testdata.tar.xz) = 1314438252 bytes
+BLAKE2s (chromium-150.0.7871.128-lite.tar.xz) = 51664bfdfcefa3d720cea0f69c531a606c85fc01d1c6425ad9ffc1b37710d876
+SHA512 (chromium-150.0.7871.128-lite.tar.xz) = ee69d03ee170eb57a2e2fd9b6ce691d08a5cd72a738044d7ac2d58c53cbec33d39369b6f543bf9d44934f62e33240e2e5a0f0b093ee5b846de1a0e9d1ad48b0d
+Size (chromium-150.0.7871.128-lite.tar.xz) = 1670339852 bytes
+BLAKE2s (chromium-150.0.7871.128-testdata.tar.xz) = 10aaa0ec680d6f7b300682f3b353b925bda2337068b208433304ae230aa1f1da
+SHA512 (chromium-150.0.7871.128-testdata.tar.xz) = ac983c117b51925a068b97a14bef33b0cececc268137426bcef5680fb642a4d9485490ed66a61307ba0b67b27a705a00661c42484d7022680eda09c8a00873d9
+Size (chromium-150.0.7871.128-testdata.tar.xz) = 1314346616 bytes
 BLAKE2s (cmake-0.1.58.crate) = a4568b73f30075a127114fb24a891b182573483d81080643888ecbd5e954efe7
 SHA512 (cmake-0.1.58.crate) = 49420a5d7d71ddccc21b71373769e1e28ab98c9af1a0c5d59fc3127e6dcc45cb1b7c6b5a37c9110907daceda7fd10bb59344f2bb8f041b18d62b16c22c5d0d60
 Size (cmake-0.1.58.crate) = 20474 bytes
@@ -1299,7 +1299,7 @@ SHA1 (patch-components_paint__preview_br
 SHA1 (patch-components_paint__preview_browser_paint__preview__client__unittest.cc) = eb4e8df66fe0c4748471e861d84e2818df92d6a8
 SHA1 (patch-components_paint__preview_common_proto_paint__preview.proto) = 533c5d0a3a99a57f1edb61c5e81d502fa5169ef5
 SHA1 (patch-components_paint__preview_player_player__compositor__delegate.cc) = 728e1b82477670e87d012280ae56d25782294463
-SHA1 (patch-components_password__manager_core_browser_features_password__features.cc) = 4e3998ea34d7f965b00a4ea36bf3c566c981f21c
+SHA1 (patch-components_password__manager_core_browser_features_password__features.cc) = 95f59f57861fb8a679fe7cab0ce2318010cc6d74
 SHA1 (patch-components_password__manager_core_browser_features_password__features.h) = 3099f4dfcd81d0721da2a24f62ea5a33076ecf1e
 SHA1 (patch-components_password__manager_core_browser_password__autofill__manager.cc) = 78a87f611561a1b78192fc9c3780d996ea1277e6
 SHA1 (patch-components_password__manager_core_browser_password__autofill__manager.h) = 3eb9396b297283061d6f45ce0caf1cb0c6d82b81

Index: pkgsrc/www/chromium/patches/patch-components_password__manager_core_browser_features_password__features.cc
diff -u pkgsrc/www/chromium/patches/patch-components_password__manager_core_browser_features_password__features.cc:1.23 
pkgsrc/www/chromium/patches/patch-components_password__manager_core_browser_features_password__features.cc:1.24
--- pkgsrc/www/chromium/patches/patch-components_password__manager_core_browser_features_password__features.cc:1.23     Wed Jul  8 13:42:21 2026
+++ pkgsrc/www/chromium/patches/patch-components_password__manager_core_browser_features_password__features.cc  Mon Jul 20 13:53:51 2026
@@ -1,4 +1,4 @@
-$NetBSD: patch-components_password__manager_core_browser_features_password__features.cc,v 1.23 2026/07/08 13:42:21 kikadf Exp $
+$NetBSD: patch-components_password__manager_core_browser_features_password__features.cc,v 1.24 2026/07/20 13:53:51 kikadf Exp $
 
 * Part of patchset to build chromium on NetBSD
 * Based on OpenBSD's chromium patches, and
@@ -15,15 +15,6 @@ $NetBSD: patch-components_password__mana
               base::FEATURE_ENABLED_BY_DEFAULT
  #else
               base::FEATURE_DISABLED_BY_DEFAULT
-@@ -115,7 +115,7 @@ BASE_FEATURE(kFetchChangePasswordUrlForP
- BASE_FEATURE(kFillOnAccountSelect,
-              "fill-on-account-select",
- // TODO(504600482): Disable the feature again upon fixing the bug.
--#if BUILDFLAG(IS_LINUX)
-+#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_BSD)
-              base::FEATURE_ENABLED_BY_DEFAULT
- #else
-              base::FEATURE_DISABLED_BY_DEFAULT
 @@ -181,7 +181,7 @@ BASE_FEATURE(kPasswordStorePropagatesAct
  
  BASE_FEATURE(kPasswordCheckupPrototype, base::FEATURE_DISABLED_BY_DEFAULT);

Prev by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index