openSUSE Ships Chromium Update Closing Thirty Seven Browser Security Flaws
openSUSE has published security update openSUSE-SU-2026:0349-1, rated important, which rebases Chromium to version 155.0.8059.79 and fixes 37 separate vulnerabilities tracked as CVE-2026-110136 through CVE-2026-110172. The update is issued for openSUSE Backports SLE-15-SP7 on aarch64 and x86_64, and delivers the packages chromium-155.0.8059.79-bp157.2.244.1 and chromedriver-155.0.8059.79-bp157.2.244.1. The advisory is tied to bug report boo#1285401. Any workstation, build agent or test runner on SLE-15-SP7 Backports that has Chromium or ChromeDriver installed falls inside the affected scope, which makes this relevant to developer fleets and automated browser testing infrastructure as well as general desktop users.
The advisory lists the flaw class and affected component for each CVE but does not publish exploitation details, proof-of-concept code or attack prerequisites, which is normal practice while a browser fix propagates downstream. The dominant pattern is memory corruption, with use-after-free conditions reported in Media, V8, DOM, SVG, PDF, WebRTC, Canvas, Network, Bindings, FileSystem, ShapeDetection and the Browser process itself. Buffer overflows are recorded in ANGLE, PDFium and Animation, alongside a type confusion issue in V8 and a use of an uninitialised variable in the bundled lzma_sdk third-party code. The remaining entries cover logic and access-control problems rather than memory safety, including missing authorization in ReadingMode, incorrect authorization in Mojo and in the Updater, incorrect reference resolution in Extensions, an information leak in Passwords, an observable discrepancy in Media and a privilege elevation issue in the Installer. Flaws in these components are typically reached through content the browser renders, but the vendor has not confirmed a specific attack chain for any individual CVE in this set.
A browser is the single largest piece of untrusted-input processing software on most endpoints, so a release of this size materially changes the exposure profile of unpatched hosts, particularly where renderer flaws sit next to an Installer privilege elevation and an Updater authorization weakness that could extend an initial compromise beyond the sandbox. Current exploitation signals are low. FIRST EPSS scores twelve of these issues between 0.2 and 0.4 percent probability of exploitation within the next 30 days, with CVE-2026-110137 the highest at 0.4 percent and CVE-2026-110136, CVE-2026-110138, CVE-2026-110139, CVE-2026-110140, CVE-2026-110142, CVE-2026-110145 and CVE-2026-110147 at 0.3 percent. No exploitation data has been published for the remaining CVEs in the advisory, and none of them are reported as exploited in the wild or listed in a known exploited vulnerability catalogue. That absence of evidence is not a statement of safety, and the information leak in Passwords and the Extensions reference-resolution flaw remain attractive targets on shared or privileged workstations where saved credentials and installed extensions carry real value to an attacker.
Attack Surface
Web Browser, Endpoint
Tactics
Initial Access, Execution, Privilege Escalation, Credential Access
Techniques
- T1189 – Drive-by Compromise
- T1203 – Exploitation for Client Execution
- T1068 – Exploitation for Privilege Escalation
- T1555.003 – Credentials from Password Stores: Credentials from Web Browsers
SuperPRO's Threat Countermeasures Procedures
- Apply the openSUSE patch on all SLE-15-SP7 Backports hosts with the command zypper in -t patch openSUSE-2026-349=1, or run the equivalent through YaST online_update or zypper patch.
- Confirm remediation on each host with rpm -q chromium chromedriver and require the output to show 155.0.8059.79-bp157.2.244.1 or later on both aarch64 and x86_64 systems.
- Include CI and QA build agents in the rollout, since chromedriver-155.0.8059.79-bp157.2.244.1 ships in the same patch and headless test runners are frequently excluded from desktop patch cycles.
- Force a restart of all running Chromium processes after the package upgrade, as the patched binary is not loaded by long-lived browser sessions that were started before the update.
- Lock down extension installation with the Chromium enterprise policies ExtensionInstallBlocklist set to the wildcard value and ExtensionInstallAllowlist limited to approved extension IDs, to reduce exposure from the Extensions reference-resolution issue CVE-2026-110156.
- Disable the Chromium built-in password store on shared or privileged workstations using the PasswordManagerEnabled policy set to false until the update is verified, given the Passwords information leak CVE-2026-110146 and the Passwords use-after-free issues CVE-2026-110145 and CVE-2026-110158.
- Alert in EDR on repeated Chromium renderer process crashes and on any child process spawned by chromium outside the expected sandbox helpers, as these are the practical signals of attempted exploitation of the use-after-free and V8 type confusion flaws in this release.
