← All distributions
Updated 09:01
Determinate Secure Packages distribution
secure-packages-25.11Supported
Built on Nixpkgs 25.11. Available for use in production environments and covered by our standard service-level agreement (SLA).
Fixed in the last 30 days
550
Fixed in the last 7 days
280
In progress
120
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-25.11/0";
}670 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | Critical | ANGLE out-of-bounds write enables remote code execution outside sandbox in Chrome <154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Medium | Chrome Downloads improper state validation before 154.0.8037.57 enables system access restriction bypass via crafted HTML | Oct 9, 2026 | |
| Fixed | Critical | WebGL out-of-bounds write in Chrome Android <154.0.8037.57 allows remote code execution outside sandbox | Oct 9, 2026 | |
| Fixed | Medium | Chrome Android confused-deputy let co-installed app access sensitive data via social engineering pre-154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Medium | Chrome Networking info leak via crafted HTML pre-154.0.8037.57; low-severity remote data exposure | Oct 9, 2026 | |
| Fixed | High | Chrome Bluetooth cleanup flaw allows bypass of system access restrictions via crafted HTML pre-154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Critical | ANGLE use-after-free in Chrome <154.0.8037.57 allows RCE outside sandbox via HTML | Oct 9, 2026 | |
| Fixed | Low | Chrome pre-154.0.8037.57 GPU uninitialized resource lets compromised renderer read memory outside sandbox via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | iOS Chrome <154.0.8037.57 UI misrepresentation enables address bar spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome Android GPU out-of-bounds write enables sandbox escape RCE via crafted HTML (pre-154.0.8037.57) Critical | Oct 9, 2026 | |
| Fixed | Medium | Remote UI spoofing in Chrome Android Payments via crafted HTML before 154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <154.0.8037.57 missing navigation auth enables crafted HTML address bar spoofing | Oct 9, 2026 | |
| Fixed | High | Use-after-free in Chrome Printing pre-154.0.8037.57 allows code execution outside sandbox via crafted HTML | Oct 9, 2026 | |
| Fixed | Critical | Chrome Video buffer overflow prior to 154.0.8037.57 enables RCE outside sandbox via crafted HTML | Oct 9, 2026 | |
| Fixed | Low | MediaCapture improper authorization in Chrome <154.0.8037.57 allows extension-based cross-origin data access | Oct 9, 2026 | |
| Fixed | Low | Chrome Performance unchecked return allows local memory read before 154.0.8037.57 | Oct 9, 2026 | |
| Fixed | High | High-severity Chrome Aura use-after-free pre-154.0.8037.57 enables local code execution outside sandbox | Oct 9, 2026 | |
| Fixed | High | Chrome <154.0.8037.57 HID authorization flaw let compromised renderer bypass access restrictions via crafted HTML | Oct 9, 2026 | |
| Fixed | Critical | Chrome Fullscreen use-after-free enables RCE outside sandbox pre-154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Low | Chrome Passwords info leak pre-154.0.8037.57 allows cross-origin data exfiltration via crafted HTML under renderer compromise | Oct 9, 2026 | |
| Fixed | Critical | Chrome <154.0.8037.57 Fonts non-heap free bug allows code execution outside sandbox via crafted HTML. | Oct 9, 2026 | |
| Fixed | Critical | Use-after-free in Chrome AdFilter enables RCE outside sandbox via crafted HTML (pre-154.0.8037.57) | Oct 9, 2026 | |
| Fixed | Medium | UI misrepresentation allows UI spoofing in iOS Chrome <154.0.8037.57 via crafted HTML | Oct 9, 2026 | |
| Fixed | Low | Chrome pre-154.0.8037.57 Metrics integer overflow allows renderer-compromised read outside sandbox via HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome ExtensionsMenu UI misrepresentation enables remote UI spoofing pre-154.0.8037.57 via crafted HTML, social engineering | Oct 9, 2026 | |
| Fixed | High | V8 type confusion in Chrome <154.0.8037.57 allows sandboxed RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chromoting UI spoofing via crafted traffic in Chrome <154.0.8037.57 (Low severity) | Oct 9, 2026 | |
| Fixed | High | Out-of-bounds write in Chrome V8 enables sandboxed RCE via crafted HTML (pre-154.0.8037.57) | Oct 9, 2026 | |
| Fixed | Medium | Chrome SmartCard cleanup bug enables social-engineered HTML to bypass system access restrictions | Oct 9, 2026 | |
| Fixed | Low | Android Chrome WebAPK authorization bug lets co-installed apps read cross-origin data pre-154.0.8037.57 | Oct 9, 2026 | |
| Fixed | High | Missing authorization in Chrome Extensions enabled site isolation bypass pre-154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Medium | Chrome DevTools missing authorization enables system access bypass via socially engineered crafted traffic (pre-154.0.8037.57) | Oct 9, 2026 | |
| Fixed | Critical | Pre-154.0.8037.57 Chrome GPU use-after-free enables remote code execution outside sandbox via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome Browser use-after-free allows local arbitrary code execution outside sandbox pre-154.0.8037.57 | Oct 9, 2026 | |
| Fixed | Medium | Chrome <154.0.8037.57 Contextual Tasks auth flaw allows web origin policy bypass via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Missing Core authorization in Mac Chrome pre-154.0.8037.57 enables cross-origin data exfiltration via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | iOS Chrome <154.0.8037.57 information leak via local attacker with physical access | Oct 9, 2026 | |
| Fixed | Medium | Chrome pre-154.0.8037.57 UI misrepresentation allows remote spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome GPU uninitialized resource enables remote out-of-sandbox memory read via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome <154.0.8037.57 Safe Browsing auth flaw enabled remote access restrictions bypass via crafted traffic | Oct 9, 2026 | |
| Fixed | Medium | iOS Chrome <154.0.8037.57 SecurityIndicators UI bug allows address bar spoofing | Oct 9, 2026 | |
| Fixed | Medium | Chrome NFC missing authorization pre-154.0.8037.57 lets compromised renderer bypass system access via HTML | Oct 9, 2026 | |
| Fixed | Medium | Incorrect Scroll authorization pre-154.0.8037.57 enables cross-origin data theft via crafted page | Oct 9, 2026 | |
| Fixed | Medium | UI misrepresentation in iOS Chrome <154.0.8037.57 enables remote HTML-based UI spoofing | Oct 9, 2026 | |
| Fixed | Medium | Missing Navigation authorization lets compromised renderer bypass site isolation in Chrome <154.0.8037.57 | Oct 9, 2026 | |
| Fixed | High | Google Chrome <154.0.8037.57 Bindings type confusion enables sandboxed remote code execution via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Android Chrome WebView missing authorization pre-154.0.8037.57 allows compromised renderer to bypass web origin policy | Oct 9, 2026 | |
| Fixed | Critical | Critical ANGLE buffer overflow in Chrome Android <154.0.8037.57 enables sandbox-escape remote code execution | Oct 9, 2026 | |
| Fixed | Critical | Tint buffer overflow in Chrome for Android allows sandbox escape RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome Platform use-after-free allows sandbox RCE via crafted HTML (pre-154.0.8037.57) | Oct 9, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.