DSA-6422-1 chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6422-1
CSIRTS triage
- What
- Multiple security vulnerabilities in Chromium allow arbitrary code execution, denial of service, or information disclosure.
- Who is affected
- All users of vulnerable Chromium versions across all platforms.
- Urgency
- High; multiple attack vectors including remote code execution warrant prompt remediation.
- Action
- Apply the security update from Debian (DSA-6422-1) or upgrade Chromium to the latest patched version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Chromium
Get an email when a new Chromium advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00333.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-191370.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191380.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191390.08% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 0% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191400.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191410.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191420.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191430.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191440.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191450.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-191460.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Google Chrome: Multiple vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Microsoft Edge (August 12, 2026)cert-fr-avis
- unknownCVE-2026-19138: CVE-2026-19138 Heap buffer overflow in CrashReportingmsrc
- unknownCVE-2026-19142: CVE-2026-19142 Use after free in Viewsmsrc
- unknownCVE-2026-19157: CVE-2026-19157 Out of bounds write in ANGLEmsrc
- unknownCVE-2026-19137: CVE-2026-19137 Use after free in WebGLmsrc
- unknownCVE-2026-19146: CVE-2026-19146 Uninitialized Use in GPUmsrc
- unknownCVE-2026-19144: CVE-2026-19144 Use after free in HTMLmsrc
- unknownCVE-2026-19152: CVE-2026-19152 Inappropriate implementation in Navigationmsrc
- unknownCVE-2026-19162: CVE-2026-19162 Out of bounds write in V8msrc
- unknownCVE-2026-19175: CVE-2026-19175 Use after free in Paymentsmsrc
- unknownCVE-2026-19148: CVE-2026-19148 Out of bounds write in GPUmsrc
More from Debian Security Advisories
- unknownDSA-6443-1 docker.io - security update2026-08-16
- unknownDSA-6444-1 neutron - security update2026-08-16
- unknownDSA-6442-1 util-linux - security update2026-08-14
- unknownDSA-6440-1 unzip - security update2026-08-14
- unknownDSA-6439-1 zip - security update2026-08-14