[rpms/chromium] f45: Merge branch 'rawhide' into f45

[rpms/chromium] f45: Merge branch 'rawhide' into f45

[Than Ngo]

A new commit has been pushed.

Repo   : rpms/chromium
Branch : f45
Commit : e9ea9c924815e59260d629fa65b298fbce39c263
Author : Than Ngo <than@redhat.com>
Date   : 2026-09-19T09:26:57+02:00
Stats  : +7/-0 in 1 file(s)
URL    : https://src.fedoraproject.org/rpms/chromium/c/e9ea9c924815e59260d629fa65b298fbce39c263?branch=f45

Log:
Merge branch 'rawhide' into f45

---
diff --git a/chromium.spec b/chromium.spec
index 7c05159..3887344 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -13,6 +13,10 @@
 %global system_build_flags 0
 
 %global numjobs %{_smp_build_ncpus}
+# Limit to 48 cpus due to OOM on x86_64 platform
+%ifarch x86_64
+%global numjobs 48
+%endif
 
 # official builds have less debugging and go faster... but we have to shut some things off.
 %global official_build 1

diff --git a/chromium.spec b/chromium.spec
index 53f9fcc..3887344 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -2002,6 +2002,9 @@ fi
   * CVE-2026-93386: UI misrepresentation in WebAppInstalls
   * CVE-2026-93387: Improper state validation in Skia
 
+* Thu Sep 17 2026 Dominik Mierzejewski <dominik@greysector.net> - 153.0.8010.36-2
+- Rebuild for FFmpeg 9
+
 * Mon Sep 14 2026 Than Ngo <than@redhat.com> - 153.0.8010.36-1
 - Update to 153.0.8010.36
   * CVE-2026-87429: Missing authorization in ServiceWorker

[rpms/chromium] f45: Merge branch 'rawhide' into f45

[Than Ngo]

A new commit has been pushed.

Repo   : rpms/chromium
Branch : f45
Commit : 91b98fd33c81559cda4360810a05fb36e3fa9b46
Author : Than Ngo <than@redhat.com>
Date   : 2026-09-18T20:35:37+02:00
Stats  : +5/-2 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/chromium/c/91b98fd33c81559cda4360810a05fb36e3fa9b46?branch=f45

Log:
Merge branch 'rawhide' into f45

---
diff --git a/get_chromium.sh b/get_chromium.sh
index 60de04c..6272635 100755
--- a/get_chromium.sh
+++ b/get_chromium.sh
@@ -73,7 +73,7 @@ rm -rf build/linux/debian_bullseye_amd64-sysroot/ \
        buildtools/linux64/gn
 
 # Find and delete all precompiled executables, dynamic libraries, and Java archives
-find . -type f \( -name "*.exe" -o -name "*.dll" -o -name "*.so" -o -name "*.dylib" -o -name "*.jar" -o -name "*.bin" ! -path "*/ulp_language_code_locator/*" \) -delete
+find . -type f \( -name "*.exe" -o -name "*.dll" -o -name "*.so" -o -name "*.dylib" -o -name "*.jar" \) -delete
 
 # Remove ffmpeg source
 find third_party/ffmpeg/* -type d | xargs rm -rf

diff --git a/sources b/sources
index eba0609..4919320 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (node-v22.22.0-stripped.tar.gz) = f32a8a73063b3c78cbacf941e11dd529ebcf2618b3ba661966312e49ee9870c43a3acf256e8d331a4b0b621b16a501810c02a3ad763c75884cc250addca8e106
 SHA512 (typescript-linux-ppc64.tgz) = 0ce471e5bdec77fe12ede6b2c66e0542ff80ec2ae45081916878b023ca221d3008d5f00f5a1178274bc09640bc6e20251d2555c31310ded8d9dbf0d56e742288
-SHA512 (chromium-153.0.8010.52-clean.tar.xz) = b64042ce55b4b1ce971ed9988849960286185d2fc43dc5133fea73c7568bb3b7b5f7f3263f15eddb5d7c1c2d56d5a72dc78e109cf6100276469d284e2855088c
+SHA512 (chromium-153.0.8010.52-clean.tar.xz) = 681267b5f6e736c553769b9ec83cd5cb0390d10f6c30c6f35fc4a1f628aef2ddeb009de40cb7d2c73a8559d433fc25c2f20705d65382bc43fbb0f693e6c33a18

diff --git a/chromium.spec b/chromium.spec
index a1d6440..7c05159 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -1998,6 +1998,9 @@ fi
   * CVE-2026-93386: UI misrepresentation in WebAppInstalls
   * CVE-2026-93387: Improper state validation in Skia
 
+* Thu Sep 17 2026 Dominik Mierzejewski <dominik@greysector.net> - 153.0.8010.36-2
+- Rebuild for FFmpeg 9
+
 * Mon Sep 14 2026 Than Ngo <than@redhat.com> - 153.0.8010.36-1
 - Update to 153.0.8010.36
   * CVE-2026-87429: Missing authorization in ServiceWorker

[rpms/chromium] f45: Merge branch 'rawhide' into f45

[Than Ngo]

A new commit has been pushed.

Repo   : rpms/chromium
Branch : f45
Commit : 00afcdd80d32d10834749948b1d9bbe597c63917
Author : Than Ngo <than@redhat.com>
Date   : 2026-09-18T17:50:36+02:00
Stats  : +162/-70 in 4 file(s)
URL    : https://src.fedoraproject.org/rpms/chromium/c/00afcdd80d32d10834749948b1d9bbe597c63917?branch=f45

Log:
Merge branch 'rawhide' into f45

---
diff --git a/chromium.spec b/chromium.spec
index 1bdc90f..7c05159 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -271,8 +271,8 @@
 %endif
 
 Name:	chromium
-Version: 153.0.8010.36
-Release: 2%{?dist}
+Version: 153.0.8010.52
+Release: 1%{?dist}
 Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use
 Url: http://www.chromium.org/Home
 License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only)
@@ -1937,6 +1937,67 @@ fi
 %endif
 
 %changelog
+* Fri Sep 18 2026 Than Ngo <than@redhat.com> - 153.0.8010.52-1
+- Update to 153.0.8010.52
+  * CVE-2026-91708: Race condition in Network
+  * CVE-2026-91709: Type confusion in ServiceWorker
+  * CVE-2026-91710: Use after free in WebAppInstalls
+  * CVE-2026-91711: Out of bounds write in ServiceWorker
+  * CVE-2026-91712: Race condition in Extensions
+  * CVE-2026-91713: Missing authorization in Browser
+  * CVE-2026-91714: Observable discrepancy in Fonts
+  * CVE-2026-91715: Type confusion in ServiceWorker
+  * CVE-2026-91716: Use after free in Auth
+  * CVE-2026-91717: Missing authorization in Android
+  * CVE-2026-91718: Use after free in Core
+  * CVE-2026-91719: Code injection in XML
+  * CVE-2026-91720: Uninitialized resource in ANGLE
+  * CVE-2026-91721: Use after free in Internals
+  * CVE-2026-91722: Use after free in Input
+  * CVE-2026-91723: Race condition in WebAppInstalls
+  * CVE-2026-91724: Use after free in Input
+  * CVE-2026-91725: Observable discrepancy in CSS
+  * CVE-2026-91726: Out of bounds read in WebGL
+  * CVE-2026-91727: Incorrect reference resolution in Extensions
+  * CVE-2026-91728: Integer overflow in V8
+  * CVE-2026-91729: Use after free in DigitalCredentials
+  * CVE-2026-91730: Incomplete cleanup in GetUserMedia
+  * CVE-2026-91731: Type confusion in Compositing
+  * CVE-2026-91732: Missing authorization in AppManifest
+  * CVE-2026-91733: Improper state validation in Skia
+  * CVE-2026-91734: Incorrect authorization in Core
+  * CVE-2026-91735: Incorrect authorization in WebUI
+  * CVE-2026-91736: Use after free in DOM
+  * CVE-2026-91737: Use after free in PDF
+  * CVE-2026-91738: Improper input validation in ANGLE
+  * CVE-2026-91739: Missing authorization in Transactions Platform
+  * CVE-2026-91740: Uninitialized resource in Skia
+  * CVE-2026-91741: Type confusion in CacheStorage
+  * CVE-2026-91742: Confused deputy in PriceTracking
+  * CVE-2026-91743: Race condition in Core
+  * CVE-2026-91744: Race condition in PlatformIntegration
+  * CVE-2026-91745: Use after free in V8
+  * CVE-2026-91746: Integer overflow in Compositing
+  * CVE-2026-91747: Use after free in Skia
+  * CVE-2026-91748: Race condition in Extensions
+  * CVE-2026-91749: Use after free in Workers
+  * CVE-2026-93372: Buffer overflow in WebGL
+  * CVE-2026-93373: Use after free in Extensions
+  * CVE-2026-93374: Use after free in Dawn
+  * CVE-2026-93375: Incorrect reference resolution in Tracing
+  * CVE-2026-93376: Out of bounds read in DataTransfer
+  * CVE-2026-93377: Type confusion in V8
+  * CVE-2026-93378: Missing authorization in Storage
+  * CVE-2026-93379: Incorrect authorization in ORB
+  * CVE-2026-93380: Race condition in FileSystem
+  * CVE-2026-93381: Buffer overflow in PDFium
+  * CVE-2026-93382: Use after free in PDFium
+  * CVE-2026-93383: Information leak in Permissions
+  * CVE-2026-93384: Server-side request forgery in Omnibox
+  * CVE-2026-93385: Information leak in Paint
+  * CVE-2026-93386: UI misrepresentation in WebAppInstalls
+  * CVE-2026-93387: Improper state validation in Skia
+
 * Thu Sep 17 2026 Dominik Mierzejewski <dominik@greysector.net> - 153.0.8010.36-2
 - Rebuild for FFmpeg 9
 

diff --git a/get_chromium.sh b/get_chromium.sh
new file mode 100755
index 0000000..60de04c
--- /dev/null
+++ b/get_chromium.sh
@@ -0,0 +1,95 @@
+#!/usr/bin/bash
+#
+# than@redhat.com, new download script from GitHub.
+#
+
+GITHUB_REPO="chromium-linux-tarballs/chromium-tarballs"
+WORK_DIR="$(pwd)/chromium_clean_build"
+
+echo "=== 1. Fetching latest stable release from GitHub ==="
+mkdir -p "${WORK_DIR}"
+cd "${WORK_DIR}"
+
+# Fetch the latest release tag name using GitHub API
+VERSION=$(curl -s "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" | grep -oP '"tag_name": "\K[^"]+')
+
+if [ -z "${VERSION}" ]; then
+  echo "Error: Could not determine the latest release from GitHub." >&2
+  exit 1
+fi
+
+echo "Latest version found: ${VERSION}"
+
+TARBALL_NAME="chromium-${VERSION}-linux.tar.xz"
+CLEAN_TARBALL_NAME="chromium-${VERSION}-clean.tar.xz"
+DOWNLOAD_URL="https://github.com/${GITHUB_REPO}/releases/download/${VERSION}/${TARBALL_NAME}"
+
+# === 2. Download the Tarball ===
+if [ ! -f "${TARBALL_NAME}" ]; then
+  echo "=== 2. Downloading ${TARBALL_NAME} ==="
+  wget -O "${TARBALL_NAME}" "${DOWNLOAD_URL}"
+else
+  echo "=== 2. Archive ${TARBALL_NAME} already exists locally ==="
+fi
+
+# === 3. Extract the Source ===
+echo "=== 3. Extracting source code ==="
+UNPACK_DIR="chromium-${VERSION}"
+rm -rf "${UNPACK_DIR}"
+tar -xf "${TARBALL_NAME}"
+
+cd "${UNPACK_DIR}"
+
+# === 4. Remove Proprietary Blobs & Precompiled Binaries ===
+echo "=== 4. Removing proprietary blobs, binary files ==="
+rm -rf build/linux/debian_bullseye_amd64-sysroot/ \
+       build/linux/debian_bullseye_i386-sysroot/ \
+       buildtools/linux64/ \
+       third_party/node/linux/node-linux-x64/ \
+       third_party/rust-toolchain/ \
+       third_party/rust-src/ \
+       third_party/devtools-frontend/src/third_party/esbuild/ \
+       third_party/devtools-frontend/src/third_party/rollup_libs/ \
+       third_party/devtools-frontend/src/node_modules/@rollup/rollup-linux-x64-gnu/ \
+       third_party/enterprise_companion/chromium_linux64/ \
+       third_party/enterprise_companion/chromium_mac_amd64/ \
+       third_party/enterprise_companion/chromium_mac_arm64/ \
+       third_party/enterprise_companion/chromium_win_x86/ \
+       third_party/enterprise_companion/chromium_win_x86_64/ \
+       third_party/enterprise_companion/chromium_linux64/cipd/ \
+       third_party/ninja/ \
+       third_party/openscreen/src/third_party/ninja/ \
+       third_party/updater/chrome_linux64/ \
+       third_party/updater/chrome_linux64_sans_iid/cipd/ \
+       third_party/updater/chromium_linux64/ \
+       third_party/updater/chromium_linux64_sans_iid/cipd/ \
+       third_party/dawn/third_party/ninja/ \
+       third_party/dawn/tools/golang/ \
+       third_party/depot_tools/external_bin/ \
+       third_party/libei/cipd/ \
+       third_party/gperf/cipd/ \
+       third_party/node/linux/node-linux-x64.tar.gz \
+       buildtools/third_party/eu-strip/bin/eu-strip \
+       buildtools/linux64/gn
+
+# Find and delete all precompiled executables, dynamic libraries, and Java archives
+find . -type f \( -name "*.exe" -o -name "*.dll" -o -name "*.so" -o -name "*.dylib" -o -name "*.jar" -o -name "*.bin" ! -path "*/ulp_language_code_locator/*" \) -delete
+
+# Remove ffmpeg source
+find third_party/ffmpeg/* -type d | xargs rm -rf
+
+# Clean openh264 from proprietary things
+find third_party/openh264/* -type d | xargs rm -rf
+
+# === 5. Repack as -lite.tar.xz ===
+echo "=== 5. Creating clean archive: ${CLEAN_TARBALL_NAME} ==="
+cd ..
+
+# Compress using xz with multithreading enabled (-T0 utilizes all CPU cores)
+tar -cf - "${UNPACK_DIR}" | xz -v -9 -T0 > "${CLEAN_TARBALL_NAME}"
+
+# Clean up temporary extracted folder
+rm -rf "${UNPACK_DIR}"
+
+echo "=== SUCCESS ==="
+echo "Cleaned Lite Tarball created at: ${WORK_DIR}/${CLEAN_TARBALL_NAME}"

diff --git a/get_chromium_from_git.sh b/get_chromium_from_git.sh
deleted file mode 100755
index cd4e4f2..0000000
--- a/get_chromium_from_git.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#! /bin/bash
-
-SRC_DIR="chromium-src"
-VERSION="$1"
-# clean|remove
-FFMPEG_SOURCE="remove"
-
-if [[ -z $VERSION ]]; then
-  echo "Version is missing"
-  exit 1
-fi
-
-if [ -d $SRC_DIR ] ; then
-   rm -rf $SRC_DIR
-fi
-mkdir -p $SRC_DIR
-pushd $SRC_DIR
-echo "cloning depot_tools..."
-git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git
-export PATH+=":$PWD/depot_tools"
-echo "Clone chromium-$VERSION..." 
-fetch --nohooks --no-history chromium
-pushd src
-git fetch origin tag $VERSION
-git checkout tags/$VERSION
-gclient sync --with_branch_heads --with_tags
-popd # src
-
-find src -type d -name ".git" | xargs rm -rf
-find src/third_party/jdk/current -type f -delete
-rm -rf src/build/linux/debian_bullseye_amd64-sysroot \
-       src/build/linux/debian_bullseye_i386-sysroot \
-       src/third_party/node/linux/node-linux-x64* \
-       src/third_party/rust-toolchain \
-       src/third_party/rust-src \
-       src/third_party/devtools-frontend/src/third_party/esbuild \
-       src/third_party/enterprise_companion/chromium_linux64 \
-       src/third_party/enterprise_companion/chromium_mac_amd64 \
-       src/third_party/enterprise_companion/chromium_mac_arm64 \
-       src/third_party/enterprise_companion/chromium_win_x86 \
-       src/third_party/enterprise_companion/chromium_win_x86_64 \
-       src/third_party/node/linux/node-linux-x64.tar.gz \
-       src/buildtools/third_party/eu-strip/bin/eu-strip \
-       src/buildtools/linux64/gn
-
-if [ "$FFMPEG_SOURCE" == "clean" ] ; then
-   # clean ffmpeg from proprietary things
-   echo "Cleaning ffmpeg from proprietary things..."
-   ln -s ../clean_ffmpeg.sh .
-   ln -s ../ffmpeg-clean.patch .
-   ln -s ../get_free_ffmpeg_source_files.py .
-   ./clean_ffmpeg.sh src 1
-else
-   # remove ffmpeg source
-   find src/third_party/ffmpeg/* -type d | xargs rm -rf
-fi
-
-# clean openh264
-echo "Cleaning openh264 from proprietary things..."
-find src/third_party/openh264/src -type f -not -name '*.h' -delete
-mv src ../chromium-$VERSION
-popd
-
-echo "Compressing cleaned tree, please wait..."
-tar -cf - chromium-$VERSION | xz -9 -T 0 -f > chromium-$VERSION-clean.tar.xz
-
-echo "Done!"

diff --git a/sources b/sources
index 6c15195..eba0609 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (node-v22.22.0-stripped.tar.gz) = f32a8a73063b3c78cbacf941e11dd529ebcf2618b3ba661966312e49ee9870c43a3acf256e8d331a4b0b621b16a501810c02a3ad763c75884cc250addca8e106
-SHA512 (chromium-153.0.8010.36-clean.tar.xz) = c4bf5cbdc8a3d95d607f98b48ab3f22a11c5d21206dab190721423da68bdf485179d979ec3d25c72ebe6b97aef24c69b456d3be7ec5d2d19806a5fc71ef13542
 SHA512 (typescript-linux-ppc64.tgz) = 0ce471e5bdec77fe12ede6b2c66e0542ff80ec2ae45081916878b023ca221d3008d5f00f5a1178274bc09640bc6e20251d2555c31310ded8d9dbf0d56e742288
+SHA512 (chromium-153.0.8010.52-clean.tar.xz) = b64042ce55b4b1ce971ed9988849960286185d2fc43dc5133fea73c7568bb3b7b5f7f3263f15eddb5d7c1c2d56d5a72dc78e109cf6100276469d284e2855088c

diff --git a/chromium.spec b/chromium.spec
index a1d6440..7c05159 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -1998,6 +1998,9 @@ fi
   * CVE-2026-93386: UI misrepresentation in WebAppInstalls
   * CVE-2026-93387: Improper state validation in Skia
 
+* Thu Sep 17 2026 Dominik Mierzejewski <dominik@greysector.net> - 153.0.8010.36-2
+- Rebuild for FFmpeg 9
+
 * Mon Sep 14 2026 Than Ngo <than@redhat.com> - 153.0.8010.36-1
 - Update to 153.0.8010.36
   * CVE-2026-87429: Missing authorization in ServiceWorker