Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Chromium: CVE-2026-118319 Memory corruption in Skia
On Wed, Oct 21, 2026 at 6:16 PM Jakub Wilk <jwilk () jwilk net> wrote: Solar Designer <solar () openwall com>, 2026-10-21 07:54: On Tue, Oct 20, 2026 at 03:44:34PM -0400, Jeffrey Walton wrote: It is probably worth noting the Comodo AAA Services Root removal is not related to the eMudhra incident. Are you sure? Doesn't it cross-sign the compromised intermediates? It does cross-sign them. Yes, you're correct. My bad. Ugh...
Comodo AAA Services Root had the TLS trust bit removed in April 2025, and that meant it was dropped from Browser trust stores and some tooling. However, the certificate could still be used for S/MIME. Confer, <https://www.openwall.com/lists/oss-security/2026/10/22/12>. The issue with Comodo AAA Services Root was the removal of the TLS trust bit by browsers because the root is too old. The current CA/Browser (CA/B) Baseline Requirements (BR) policies say a root has a maximum lifespan of 15 years from creation date. Comodo AAA Services Root was issued in 2004, so it violates current policy. Also see <https://cabforum.org/working-groups/server/baseline-requirements/>. FWIW, I couldn't find such a requirement in CA/B BR. My bad again. The notAfter is specified in the CA/B BR Section 7.1.2.1.1, Root CA Validity. And it is 25 years.
The reason the trust bit was removed from Comodo AAA Services Root was due to root program policies implemented by Mozilla and Chrome, not the CA/B BR. It happened in April 2025. So software like Google Chrome, Mozilla Firefox, NSS and ca packages like certifi lacked the certificate.
Ugh, I've got to do a better job in the future. This may be right, but perhaps the urgency to remove it now is related to the eMudhra incident?
Incidentally, it is not yet removed in NSS 3.131.1, which does remove the emSign certs. An omission to fix in a further update urgently? AFAICT the Comodo AAA cert hasn't been removed from NSS, but it had the web trust bit turned off last year: https://bugzilla.mozilla.org/showbug.cgi?id=1957685 Yes. That said, my Firefox 153 ESR (which is supposed to include that change) still trusted the Comodo AAA cert, so I'm confused. Yeah, I am confused, too. Chrome and Firefox removed Comodo AAA Services Root in April 2025. I'm not sure why it would be present in Firefox 153 ESR.
Jeff
Chromium CVE-2026-113175: Improper input validation
Chromium CVE-2026-113339: Use after free
Chromium CVE-2026-113280: Memory corruption
Chromium CVE-2026-113072: Memory corruption
Chromium CVE-2026-113271: Use after free
Chromium CVE-2026-113279: Memory corruption
cross-origin reuse of a Negotiate connection
Chromium CVE-2026-112993: Use after free
Chromium CVE-2026-113000: Memory corruption
Chromium CVE-2026-113019: Use after free
Chromium CVE-2026-113012: Improper input validation
Chromium CVE-2026-113020: Improper input validation
Chromium CVE-2026-113040: Improper input validation
Chromium CVE-2026-113336: Memory corruption
Chromium CVE-2026-113338: Use after free
Chromium CVE-2026-113303: Memory corruption