Upstream has issued an advisory on May 6:
https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html

Status comment: Fixed upstream in 136.0.7103.59 => Fixed upstream in 136.0.7103.92

Upstream has issued an advisory on May 14:
https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html

Status comment: Fixed upstream in 136.0.7103.92 => Fixed upstream in 136.0.7103.113
CVE: CVE-2025-4096, CVE-2025-4050, CVE-2025-4051, CVE-2025-4052, CVE-2025-4372 => CVE-2025-4096, CVE-2025-4050, CVE-2025-4051, CVE-2025-4052, CVE-2025-4372, CVE-2025-4664, CVE-2025-4609
Summary: chromium-browser-stable new security issues CVE-2025-4096, CVE-2025-405[0-2] and CVE-2025-4372 => chromium-browser-stable new security issues CVE-2025-4096, CVE-2025-405[0-2], CVE-2025-4372, CVE-2025-4664 and CVE-2025-4609

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Heap buffer overflow in HTML. (CVE-2025-4096)

Out of bounds memory access in DevTools. (CVE-2025-4050)

Insufficient data validation in DevTools. (CVE-2025-4051)

Inappropriate implementation in DevTools. (CVE-2025-4052)

Use after free in WebAudio. (CVE-2025-4372)

Insufficient policy enforcement in Loader. (CVE-2025-4664)

Incorrect handle provided in unspecified circumstances in Mojo. (CVE-2025-4609)

References:
https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html
https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop.html
https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html
========================

Updated packages in tainted/updates_testing:
========================
chromium-browser-136.0.7103.113-1.mga9.tainted
chromium-browser-stable-136.0.7103.113-1.mga9.tainted

from SRPM:
chromium-browser-stable-136.0.7103.113-1.mga9.tainted.src.rpm

Version: Cauldron => 9
Assignee: cjw => qa-bugs
Status comment: Fixed upstream in 136.0.7103.113 => (none)
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO => (none)

MGA9-64 Plasma Wayland on Compaq H000SB.
No installation issues.
Used newspaper site, you tube and images of family members, all OK.

CC: (none) => herman.viaene

RH

installing chromium-browser-stable-136.0.7103.113-1.mga9.tainted.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: chromium-browser-stable
                                 ##################################################################################################
      1/1: removing chromium-browser-stable-134.0.6998.165-2.mga9.tainted.x86_64
                                 ##################################################################################################

mail.com OK
facebook OK
youtube OK
webcam OK

ublock origin users is the begin of the end the browser warns the extension is not
compatible, I can enable again and lookm like works.

Happy to just use this just for QA

MGA9-64, Xfce, Intel celeron

The following 2 packages are going to be installed:

- chromium-browser-136.0.7103.113-1.mga9.tainted.x86_64
- chromium-browser-stable-136.0.7103.113-1.mga9.tainted.x86_64

9.4MB of additional disk space will be used.

$ chromium-browser -version
Chromium 136.0.7103.113 Mageia.Org 9

----



email
sites work

CC: (none) => brtians1

mga9-64, Plasma, X11

Quick check on my workstation OK

Clean update
Settings kept, tabs restored automatically
Swedish localisation
surfing some sites, incl video and banking, writing this
Downloaded a pdf, opened it, printed using built in dialogue.
In terminal from where i launched it, same messages as usual


[morgan@svarten ~]$ inxi -SCG
System:
  Host: svarten.tribun Kernel: 6.6.88-desktop-3.mga9 arch: x86_64 bits: 64
  Desktop: KDE Plasma v: 5.27.10 Distro: Mageia 9
CPU:
  Info: quad core model: Intel Core i7 870 bits: 64 type: MT MCP cache:
    L2: 1024 KiB
  Speed (MHz): avg: 1200 min/max: 1200/2934 cores: 1: 1200 2: 1200 3: 1200
    4: 1200 5: 1200 6: 1200 7: 1200 8: 1200
Graphics:
  Device-1: Advanced Micro Devices [AMD/ATI] Navi 24 [Radeon RX 6400/6500
    XT/6500M] driver: amdgpu v: kernel
  Display: x11 server: X.org v: 1.21.1.8 with: Xwayland v: 22.1.9 driver: X:
    loaded: amdgpu,v4l dri: radeonsi gpu: amdgpu resolution: 3840x2160~60Hz
  API: EGL v: 1.5 drivers: kms_swrast,radeonsi,swrast
    platforms: gbm,x11,surfaceless,device
  API: OpenGL v: 4.6 vendor: amd mesa v: 25.0.6 renderer: AMD Radeon RX
    6400 (radeonsi navi24 LLVM 15.0.6 DRM 3.54 6.6.88-desktop-3.mga9)

CC: (none) => fri

MGA9-64 Plasma, i5-7500, nvidia Quadro K620 graphics, using nvidia-current.

No installation issues. Logged onto my banking site, was relieved to see their figures matched min, but was annoyed with how my credit card balance is growing this month. (Buying gasoline and diesel for even a small farm will do that.)

But at least chromium works OK. Giving this an OK, and validating.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA9-64-OK
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0159.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED