Skip to content
← All distributions

Updated 22:00

Determinate Secure Packages distribution

secure-packages-26.05SupportedFIPS supportedUntil November 2029

Built on Nixpkgs 26.05. Available for use in production environments and covered by our standard service-level agreement (SLA).

Fixed within SLA

479

last 30 days

Fixed within SLA

18

last 7 days

Open

27

not yet fixed but still within SLA

Overdue

0

open

Missed SLA

0

last 30 days

Use this distribution

Customers only

Determinate Secure Packages is available through FlakeHub to organizations with access. Not a customer yet? Get in touch to gain access or schedule a demo.

Email sales@determinate.systems

Standardflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-26.05/0";
}
FIPS variant

FIPS variantflake.nix

{
  inputs.nixpkgs.url = "https://flakehub.com/f/DeterminateSystems/secure-packages-26.05-fips/0";
}

In the FIPS variant, every covered package is compliant with Federal Information Processing Standards (FIPS). Using the FIPS variant has the details.

506 CVEs tracked

CVEStatusSeveritySummaryClock startedDeadlineFixedTime to fix
Fixed within SLAHighUse-after-free in Chrome Payments enables sandbox escape via crafted HTML (pre-151.0.7922.109)Aug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighSkia use-after-free in Chrome for Android pre-151.0.7922.109 enables sandbox escape via crafted HTMLAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighGoogle Chrome Workers input validation flaw allows site isolation bypass before 151.0.7922.109Aug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighChrome <151.0.7922.109 Navigation policy flaw allows renderer sandbox escape via crafted HTMLAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighChrome V8 use-after-free enables sandboxed RCE via crafted HTML pre-151.0.7922.109Aug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighV8 inappropriate implementation allows remote sandboxed RCE via crafted HTML in Chrome <151.0.7922.109Aug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLACriticalCritical use-after-free in Google Chrome Aura on Linux <151.0.7922.109 enables remote sandbox escapeAug 11, 2026Aug 18, 2026Aug 11, 2026same day
Fixed within SLAHighChrome Linux GPU out-of-bounds write allows sandbox escape via crafted HTML pre-151.0.7922.109 High severityAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAMediumChrome Android <151.0.7922.109 GPU uninitialized use leaks memory via crafted HTMLAug 11, 2026Sep 25, 2026Aug 11, 2026same day
Fixed within SLAHighChrome Translate use-after-free enables sandbox RCE via crafted HTML (pre-151.0.7922.109)Aug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighAndroid Chrome <151 WebAPKs: input validation flaw enables local sandbox escape via malicious fileAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighChrome Android <151.0.7922.109 use-after-free in Resources enables sandbox escape via crafted HTMLAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighChrome <151.0.7922.109 GPU use-after-free enables sandbox escape via crafted HTMLAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighRace in Chrome Windows CredentialProvider pre-151.0.7922.109 enables local privilege escalation via malicious fileAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighChrome pre-151.0.7922.109 CrashReporting heap overflow allows sandbox escape from compromised rendererAug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAHighCritical Chrome Android WebGL use-after-free enables sandbox escape after renderer compromise (pre-151.0.7922.109)Aug 11, 2026Aug 26, 2026Aug 11, 2026same day
Fixed within SLAMediumWindows Chrome Updater vulnerability enables local UI spoofing via malicious file (pre-151.0.7922.72)Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLACriticalPre-151.0.7922.72 Chrome for Mac Tint flaw enabled remote sandbox escape via HTMLAug 5, 2026Aug 12, 2026Aug 11, 20266 days
Fixed within SLAMediumDevTools input validation flaw allowed remote attacker to bypass navigation via crafted HTML before 151.0.7922.72Aug 4, 2026Sep 18, 2026Aug 11, 20267 days
Fixed within SLAHighChrome Linux Views use-after-free allows remote heap corruption via crafted HTML, prior to 151.0.7922.72Aug 5, 2026Aug 20, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome Android GPU side-channel leaks cross-origin data via crafted HTML page pre-151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome Cast pre-151.0.7922.72 allows remote cross-origin data leak via crafted HTMLAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome pre-151.0.7922.72 CSS implementation enables UXSS script/HTML injection via crafted pageAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumGetUserMedia flaw leaks cross-origin data via crafted page after renderer compromise in Chrome <151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumCredential Management UI spoofing via crafted HTML in Chrome prior to 151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumInsufficient input validation in Chrome Payments pre-151.0.7922.72 enables UI spoofing from compromised rendererAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome iOS pre-151.0.7922.72: Untrusted input validation flaw enables remote navigation restrictions bypassAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumBlink cross-origin data leak via crafted HTML in Chrome before 151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome DevTools SOP bypass via crafted HTML before 151.0.7922.72; remote attacker, MediumAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAHighInsufficient DevTools input validation in Chrome allows privilege escalation via crafted extension (<151.0.7922.72)Aug 5, 2026Aug 20, 2026Aug 11, 20266 days
Fixed within SLAMediumANGLE uninitialized use in Chrome <151.0.7922.72 enables cross-origin data leak via crafted HTML pageAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAHighChrome Mac Audio use-after-free enables sandbox escape pre-151.0.7922.72 via crafted HTMLAug 5, 2026Aug 20, 2026Aug 11, 20266 days
Fixed within SLAMediumPre-151.0.7922.72 Chrome Loader leaks cross-origin data via crafted HTMLAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome iOS prior to 151.0.7922.72 Omnibox spoofing via crafted HTML (incorrect security UI)Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome Isolated Web Apps allowed remote bypass of navigation restrictions via crafted HTML pre-151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumGoogle Chrome Site Isolation bypass before 151.0.7922.72 via crafted HTML pageAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome Autofill flaw pre-151.0.7922.72 enables remote cross-origin data leak via crafted HTMLAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumReceiver policy bypass in Chrome pre-151.0.7922.72 enables sandbox escape from compromised renderer via crafted HTMLAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumPresentationAPI in Chrome <151.0.7922.72 leaked cross-origin data via crafted HTML pageAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAHighInsufficient input validation in Chrome Variations pre-151.0.7922.72 allows heap corruption by privileged network attackerAug 5, 2026Aug 20, 2026Aug 11, 20266 days
Fixed within SLAMediumGoogle Chrome Cast input validation flaw leaks cross-origin data via crafted HTMLAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumWebGL out-of-bounds read in Chrome pre-151.0.7922.72 allows remote memory disclosureAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumSkia uninitialized use in Chrome <151.0.7922.72 leaks cross-origin data via crafted HTMLAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome Mac Media out-of-bounds read allows sandbox escape after renderer compromise pre-151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumInsufficient untrusted input validation in Chrome Cast enables cross-origin data leak via crafted HTML (pre-151.0.7922.72)Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLACriticalWebSockets input validation flaw enables sandbox escape from compromised renderer in Chrome <151.0.7922.72Aug 5, 2026Aug 12, 2026Aug 11, 20266 days
Fixed within SLAMediumAndroid Chrome WebView untrusted input validation flaw leaks cross-origin data via compromised renderer pre-151.0.7922.72Aug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumFedCM SOP bypass in Chrome prior to 151.0.7922.72 via crafted HTML pageAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome for iOS <151.0.7922.72 cross-origin data leak via crafted HTML pageAug 5, 2026Sep 19, 2026Aug 11, 20266 days
Fixed within SLAMediumChrome iOS <151.0.7922.72 UXSS from insufficient validation of untrusted network inputAug 5, 2026Sep 19, 2026Aug 11, 20266 days

Make CVE remediation our job, not yours.

Tell us what you run. We'll show you what Determinate Secure Packages covers, how the SLA applies, and how to get started.

Email sales@determinate.systems