← All distributions
Updated 09:01
Determinate Secure Packages distribution
secure-packages-26.05SupportedFIPS supportedLTS
Built on Nixpkgs 26.05. Available for use in production environments and covered by our standard service-level agreement (SLA). This distribution receives 60 months of long-term support (LTS), through May 2031, with optional extended support after that.
Fixed in the last 30 days
457
Fixed in the last 7 days
205
In progress
413
Use this distribution
Customers onlyDeterminate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.
Standardflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-26.05/0";
}FIPS variant
FIPS variantflake.nix
{
inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-26.05-fips/0";
}The FIPS variant is the package set with Federal Information Processing Standards (FIPS) mode enabled. Using the FIPS variant has the details.
870 CVEs tracked
| CVE | Status | Severity | Summary | Fixed |
|---|---|---|---|---|
| Fixed | Medium | Chrome <155.0.8059.39 UI use-after-free lets compromised renderer spoof UI elements | Oct 9, 2026 | |
| Fixed | High | Chrome Media use-after-free allows sandbox remote code execution via crafted HTML (pre-155.0.8059.39) | Oct 9, 2026 | |
| Fixed | Medium | Chrome Android fullscreen UI bug allowed address bar spoofing before 155.0.8059.39 | Oct 9, 2026 | |
| Fixed | Medium | UI spoofing vulnerability in Chromoting on macOS Chrome prior to 155.0.8059.39 | Oct 9, 2026 | |
| Fixed | High | Use-after-free in Chrome Modularization before 155.0.8059.39 allows sandbox RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 Bluetooth authorization bug leaks data via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome Android pre-155.0.8059.39 incorrect authorization lets local co-installed app exfiltrate data via social engineering | Oct 9, 2026 | |
| Fixed | Medium | Missing SignIn authorization in Chrome <155.0.8059.39 enables crafted extension data theft via social engineering | Oct 9, 2026 | |
| Fixed | Medium | Clickjacking in Chrome PermissionElement pre-155.0.8059.39 enables UI spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | FontAccess use-after-free enables origin policy bypass by renderer-compromised attacker (Chrome <155.0.8059.39) | Oct 9, 2026 | |
| Fixed | High | Chrome iOS pre-155 Selection authorization flaw exposes sensitive data via crafted HTML (Low severity) | Oct 9, 2026 | |
| Fixed | High | Android Chrome Autofill reference resolution bug leaks sensitive data via crafted HTML (pre-155.0.8059.39) | Oct 9, 2026 | |
| Fixed | Medium | Mobile Chrome on Android <155.0.8059.39 allows remote UI spoofing via crafted HTML. | Oct 9, 2026 | |
| Fixed | Medium | ANGLE out-of-bounds read in Google Chrome <155.0.8059.39 via crafted HTML enables outside-sandbox memory read | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 Autofill AI bug leaks data via compromised renderer, crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Google Chrome pre-155.0.8059.39 PermissionElement UI misrepresentation enables remote spoofing via crafted HTML and social engineering | Oct 9, 2026 | |
| Fixed | Medium | CacheStorage race in Chrome <155.0.8059.39 leads to out-of-sandbox memory read | Oct 9, 2026 | |
| Fixed | Critical | Use-after-free in Chrome Tabs on Mac <155.0.8059.39 allows sandbox escape RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 Unbounded Element auth bug allows UI spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | High | ANGLE type confusion in Chrome <155.0.8059.39 enables sandbox escape RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Buffer overflow in Chrome Fonts pre-155.0.8059.39 allows renderer sandbox escape RCE via crafted HTML page | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 GarbageCollection use-after-free allows sandboxed RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 WebAppInstalls UI misrepresentation enables social-engineering system access bypass via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome Streaming use-after-free allows remote sandboxed RCE via crafted HTML (pre-155.0.8059.39) | Oct 9, 2026 | |
| Fixed | Medium | Chrome pre-155.0.8059.39 WebOTP UI misrepresentation allows remote UI spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | Critical | Use-after-free in Tint enables RCE outside sandbox via crafted HTML, Chrome <155.0.8059.39 | Oct 9, 2026 | |
| Fixed | High | Pre-155 iOS Chrome Passwords reference-resolution flaw enables sandbox escape arbitrary code execution from compromised renderer | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 Select use-after-free enables sandboxed RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome Animation info leak pre-155.0.8059.39 allows remote cross-origin data exfiltration via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Payments UI spoofing vulnerability in Chrome pre-155.0.8059.39 via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 WebAppInstalls auth flaw allows UI spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 CSS use-after-free allows remote sandboxed code execution via HTML | Oct 9, 2026 | |
| Fixed | High | WebRTC use-after-free in Chrome <155.0.8059.39 enables sandbox RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome 'File' UI spoofing pre-155.0.8059.39 via crafted HTML and social engineering | Oct 9, 2026 | |
| Fixed | Medium | Chrome <155.0.8059.39 WebAuthn missing authorization enables UI spoofing via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome GetUserMedia cleanup bug allows UI spoofing via crafted page from compromised renderer pre-155.0.8059.39 | Oct 9, 2026 | |
| Fixed | Medium | Chrome DevTools auth flaw pre-155.0.8059.39 enables cross-origin data leak via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Google Chrome HTML use-after-free allows sandboxed RCE via crafted page (pre-155.0.8059.39) | Oct 9, 2026 | |
| Fixed | High | Remote info leak in Chrome Android Passwords <155.0.8059.39 via crafted HTML social engineering | Oct 9, 2026 | |
| Fixed | High | Chrome V8 race condition before 155.0.8059.39 enables sandboxed code execution via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome Android <155.0.8059.39 info leak via co-installed app enables local attacker access to sensitive data | Oct 9, 2026 | |
| Fixed | Medium | Chrome Extensions auth bug before 155.0.8059.39 lets remote attacker access cross-origin data | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 Fonts comparison bug enables sandboxed RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | Medium | Chrome Chromoting UI misrepresentation enables remote UI spoofing via crafted traffic on macOS pre-155.0.8059.39 | Oct 9, 2026 | |
| Fixed | Medium | Missing Actor authorization in Chrome <155.0.8059.39 enables crafted HTML social engineering bypass of system restrictions | Oct 9, 2026 | |
| Fixed | High | Chrome Android Autofill auth flaw exposes sensitive data via crafted HTML pre-155.0.8059.39 | Oct 9, 2026 | |
| Fixed | High | Chrome <155.0.8059.39 Bindings use-after-free enables sandbox RCE via crafted HTML | Oct 9, 2026 | |
| Fixed | High | Chrome ANGLE buffer overflow before 155.0.8059.39 enables code execution outside sandbox via HTML | Oct 9, 2026 | |
| Fixed | Medium | Incorrect authorization enables address bar spoofing via crafted HTML in Chrome <155.0.8059.39 | Oct 9, 2026 | |
| Fixed | Medium | ANGLE uninitialized resource in Chrome <155.0.8059.39 enables remote cross-origin data exfiltration via crafted HTML | Oct 9, 2026 |
Make CVE remediation our job, not yours.
Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.