A Debian security tracker page is not glamorous, but the version table says a lot if you run Chromium from stable packages. The scrape shows bookworm and trixie security at 148.0.7778.215 while sid has 149.0.7827.53, and hundreds of listed Chromium CVEs still mark stable releases vulnerable. Worth clicking for the boring question that matters after every browser advisory, which repo actually crossed the fixed-version line.