Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Stable mirror frozen since Aug 25 keeps default Chromium on 151 while 152.0.7977.82 fixes an in-the-wild exploit (CVE-2026-85046)
Reported by JohnAtl · filed Sep 7, 2026Closed upstream on 2026-09-21 by bjarneo via an automated message, as a duplicate of #9064 (R-1235). GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
System details
Omarchy 4.0.1-1 (stable channel), chromium 151.0.7922.173-1 from extra via stable-mirror.omarchy.org
What's wrong?
stable-mirror.omarchy.org has been frozen at its 2026-08-25 sync (see also #9064). Arch extra published chromium 152.0.7977.82-1 on 2026-09-03. That Chrome release ships 12 security fixes, and Google states: "Google is aware that an exploit for CVE-2026-85046 exists in the wild" (type confusion in V8, remote code execution inside the sandbox via a crafted HTML page). The 2026-09-01 release 152.0.7977.75 (26 fixes, two Critical) is missing as well.
chromium is in install/omarchy-base.packages, so every stable-channel install is in this position.
The manual's Security page says security fixes are "quickly available for install using omarchy-update". The Updates page says the stable mirror runs one month behind. For a browser zero-day those two statements cannot both hold.
Steps to recreate
curl -s https://stable-mirror.omarchy.org/lastsync | xargs -I{} date -d @{}
# Tue Aug 25 06:59:54 AM EDT 2026
pacman -Si chromium | grep Version
# 151.0.7922.173-1
checkupdates | grep chromium
# (nothing)Upstream: https://archlinux.org/packages/extra/x86_64/chromium/ shows 152.0.7977.82-1, updated 2026-09-03 21:47 UTC.
Expected: security releases for widely exposed packages (browser, kernel, TLS libraries) reach the stable mirror promptly, or the manual states the real exposure window so users can choose a channel accordingly.
Actual: no Chromium update is visible on the stable channel four days after an actively exploited fix shipped.
Ask: an out-of-band resync (or a chromium-only push) now, and a stated policy for fast-tracking security updates on the stable mirror.
References:
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
- https://www.cve.org/CVERecord?id=CVE-2026-85046
- https://omarchy.org/manual/security/
- https://omarchy.org/manual/updates/
View raw text
### System details
Omarchy 4.0.1-1 (stable channel), chromium 151.0.7922.173-1 from `extra` via stable-mirror.omarchy.org
### What's wrong?
`stable-mirror.omarchy.org` has been frozen at its 2026-08-25 sync (see also #9064). Arch `extra` published `chromium 152.0.7977.82-1` on 2026-09-03. That Chrome release ships 12 security fixes, and Google states: "Google is aware that an exploit for CVE-2026-85046 exists in the wild" (type confusion in V8, remote code execution inside the sandbox via a crafted HTML page). The 2026-09-01 release 152.0.7977.75 (26 fixes, two Critical) is missing as well.
`chromium` is in `install/omarchy-base.packages`, so every stable-channel install is in this position.
The manual's Security page says security fixes are "quickly available for install using omarchy-update". The Updates page says the stable mirror runs one month behind. For a browser zero-day those two statements cannot both hold.
**Steps to recreate**
```
curl -s https://stable-mirror.omarchy.org/lastsync | xargs -I{} date -d @{}
# Tue Aug 25 06:59:54 AM EDT 2026
pacman -Si chromium | grep Version
# 151.0.7922.173-1
checkupdates | grep chromium
# (nothing)
```
Upstream: https://archlinux.org/packages/extra/x86_64/chromium/ shows 152.0.7977.82-1, updated 2026-09-03 21:47 UTC.
**Expected**: security releases for widely exposed packages (browser, kernel, TLS libraries) reach the stable mirror promptly, or the manual states the real exposure window so users can choose a channel accordingly.
**Actual**: no Chromium update is visible on the stable channel four days after an actively exploited fix shipped.
**Ask**: an out-of-band resync (or a chromium-only push) now, and a stated policy for fast-tracking security updates on the stable mirror.
References:
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
- https://www.cve.org/CVERecord?id=CVE-2026-85046
- https://omarchy.org/manual/security/
- https://omarchy.org/manual/updates/
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.