Repository navigation
Track the remaining Chromium 155.0.8059.39 upstream vulnerabilities #14
Description
The five Chromium CVEs reported in #13, plus CVE-2026-106195 and CVE-2026-106237, are absent from the v1.2.7 image scans. Fresh scans still report 37 other Chromium CVEs on AMD64 and ARM64. Those are accepted upstream findings, not verified fixes.
Affected packages: chromium, chromium-common, and chromium-sandbox 155.0.8059.39-1~deb13u1.
The remaining IDs are CVE-2026-110136 through CVE-2026-110172, inclusive. Trivy reports 36 unique HIGH CVEs across the three packages. Scout reports 31 unique CVEs on chromium-sandbox, including seven CRITICAL findings: CVE-2026-110136, CVE-2026-110142, CVE-2026-110149, CVE-2026-110152, CVE-2026-110159, CVE-2026-110161 and CVE-2026-110165. The scanner union is 37, rather than the sum of repeated package or architecture rows. Neither report lists a fixed version.
The v1.2.7 release includes the full per-architecture reports, inventories, software bills of materials and accepted-finding records. The release workflow records validation of the exact published candidate digest.
Avoid untrusted browser content and automation while these findings remain. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port. Those controls do not prove the vulnerabilities are unreachable. Use official upstream packages; do not patch or custom-build Chromium.
Close this issue only after an official compatible package clears these findings in a released HolyCode image, with fresh native AMD64 and ARM64 browser checks, package inventories, full Scout and Trivy reports, verified registry digests and updated public warnings. Accepted findings alone do not satisfy closure.
Activity
CoderLuii commentedon Oct 26, 2026
Fixed for the 37 tracked Chromium IDs in v1.2.8.
Fresh full Critical/High Trivy and Docker Scout reports contain none of those IDs in either released native AMD64 or ARM64 image. Native browser checks passed on both architectures. The package inventories and verified Docker Hub/GHCR digests identify those same images, and the release includes the full reports and updated public warnings.
Stop the stack and back up your data, cache and workspace folders before upgrading. Select
coderluii/holycode:1.2.8in your Compose configuration, then run:Keep your pre-upgrade copies until your normal workflows pass.
Other accepted upstream vulnerabilities remain; acceptance doesn't fix them or prove they're unreachable. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port, and avoid untrusted browser content and automation while known findings remain.
Release and reports: v1.2.8.