qt6-webengine uses a bundled version of chromium, for the current release cycle of qt6-webengine it is on the v130.x branch of chromium. This package is not used by any browsers, it is used by things such as rssguard which need a web engine but do not ship their own (Because that would be dumb) gtk apps have their own equivalent.
I am following a rss feed of commits to this bundled version of chromium v130.x so I know when it needs updating for a CVE or bugfix. However because these fixes usually come from a newer major version of chromium like v140.x its not something that happens instantly when a new version of chromium is released.
I have been updating it soon as I get the rss feed notification for a new fix but... they haven't finished porting back all the CVEs addressed in the latest version, so the next day I end up doing it again for another CVE.
Example, these CVEs were addressed across the two latest qt6-webengine updates I pushed but came from this single upstream chromium release. I just didn't give them enough time to backport all of them to v130.x so I updated it twice.
- CVE-2025-10890
- CVE-2025-10892
- CVE-2025-10891
https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_23.html
In future I will reference the chromium release blog to get an idea if all the CVEs had been addressed before updating. It is not quick to build even on a 12c/24t cpu and waiting a day to get all of them is fine.
