Gentoo's Chromium package lags four versions behind upstream with known unpatched flaws, so the maintainers chose removal over negligence. If you're on Gentoo, here's your migration plan — and why your distro's browser packaging policy deserves a second look.

On October 24, 2026, www-client/chromium disappears from Gentoo's main repository. The package was masked on September 24 by developer Sam James (bug #982204), and the removal date is now fixed. If you install or update Gentoo systems, this one deserves your attention — not because Gentoo is special, but because the reasons behind the removal apply to every distribution that ships a web browser.

The uncomfortable facts

Gentoo's Chromium tree is stuck at 151.0.7922.169-r1. Upstream is at 155.0.8059.39. That is four major versions behind, and the mask comment is blunt about what that gap contains: many unfixed vulnerabilities.

This is not laziness. Gentoo packages an enormous amount of software with a small team, and Chromium is arguably the single hardest package in any distribution to maintain. It is a multi-million-line codebase with a rapid release cadence, aggressive upstream toolchain requirements, and a build system that loves to bundle its own copies of everything. Gentoo's core philosophy is the opposite: unbundle system libraries where possible, keep builds consistent with the rest of the tree, and expose configuration through USE flags.

Those two goals collide head-on with Chromium. As the mask comment puts it, keeping the package in the tree is not a matter of supplying an updated ebuild — it is a commitment to keep it current and to find a compromise between user expectations (USE flags, unbundled components) and maintainability. With the release cadence accelerating and the vulnerability backlog growing, the maintainers decided the honest move was removal.

Why this is good news, actually

A distribution quietly shipping a browser with known, unpatched remote-code-execution-class vulnerabilities is worse than a distribution that admits it cannot keep up. Your browser is the single largest attack surface on your machine — it parses hostile input from the entire internet, all day. Running a Chromium four versions behind means running with publicly documented flaws that attackers can aim at.

Gentoo's removal is a security decision disguised as a packaging decision. It is worth asking whether other distros with similarly stale browser packages should follow the example instead of letting the gap quietly widen.

Your migration plan (do it before October 24)

If Chromium is your daily driver on Gentoo, you have maintained alternatives:

  • www-client/firefox — built from source, fully Gentoo-style, and actively maintained.
  • www-client/firefox-bin — Mozilla's official binary. If you compile everything from source but want your browser to stay current with zero build time, this is the pragmatic pick.
  • www-client/google-chrome — the proprietary variant, still maintained in the tree.
  • www-client/seamonkey — the old-school suite, still supported.

Pick one, install it, migrate your profile, and unmerge Chromium before the removal date so you are not caught by a surprise dependency failure during a world update.

The lesson worth stealing

Even if you never touch Gentoo, do this once: check how far behind your distribution's browser package is compared to upstream. Release-monitoring services exist for exactly this. If the gap is more than a version or two, think hard about whether the "pure" packaged browser is worth the exposure — or whether an upstream binary, a Flatpak, or Firefox ESR with a sane update policy is the better trade.

Compiling your own kernel is a hobby. Browsing the web with known vulnerabilities is not one. Gentoo just made that distinction official.

Sources: packages.gentoo.org — www-client/chromium (mask notice, removal date 2026-10-24, bug #982204); LWN coverage, October 2026.