Stable Channel Update for ChromeOS / ChromeOS Flex
Google Chrome Releases ·
M-156, ChromeOS version 16836.19.0 (Browser version 156.0.8078.42) has rolled out to ChromeOS devices on the Stable channel.
If you find new issues, please let us know one of the following ways:
File a bug
Visit our ChromeOS communities
General: Chromebook Help Community
Beta Specific: ChromeOS Beta Help Community
Report an issue or send feedback on Chrome
Interested in switching channels? Find out how.
Andy Wu
Google ChromeOS
N/A
Medium Fixes Compromised 3rd-party CA certificates results in compromised TLS for all clients
High Fixes arc-keymaster: fall-off-end UB in CrosKeyFactory::GetOperationFactory allows guest-to-host wild indirect call
High Fixes mali_kbase: double-free of dma_buf_attachment in kbase_mem_from_umm error path allows kernel memory corruption
High Fixes mali: page-migration UAF in kbase_vmap_phy_pages allows unprivileged kernel memory corruption on mt8196
Android Security fixes can be found here
[$TBD] [568422505 ] High CVE-2026-106200 Use after free in Track on 2026-10-01
[$TBD] [567936270 ] Critical CVE-2026-106347 Use after free in Track on 2026-09-30
[$TBD] [567910530 ] High CVE-2026-106204 Use after free in PDF on 2026-09-30
[$TBD] [567873463 ] High CVE-2026-106421 Use after free in PDF on 2026-09-30
[$TBD] [567447106 ] High CVE-2026-106383 Use after free in Media on 2026-09-29
[$TBD] [567538973 ] High CVE-2026-106349 Use after free in V8 on 2026-09-29
[$TBD] [567379988 ] High CVE-2026-106184 Uninitialized resource in Media on 2026-09-29
[$TBD] [567177599 ] High CVE-2026-106240 Type confusion in V8 on 2026-09-28
[$TBD] [567160164 ] Critical CVE-2026-106358 Use after free in Navigation on 2026-09-28
[$TBD] [567160162 ] High CVE-2026-106357 Use after free in WebRTC on 2026-09-28
[$1000.0] [566824998 ] High CVE-2026-106190 Use after free in Media on 2026-09-27
[$TBD] [566347711 ] High CVE-2026-106423 Use after free in Media on 2026-09-26
[$TBD] [566404364 ] High CVE-2026-106346 Improper state validation in DevTools on 2026-09-26
[$TBD] [566111249 ] High CVE-2026-106318 Use after free in Media on 2026-09-25
[$TBD] [566136674 ] High CVE-2026-106411 Use after free in Parser on 2026-09-25
[$TBD] [565774991 ] High CVE-2026-106278 Use after free in Select on 2026-09-24
[$TBD] [565797213 ] High CVE-2026-106233 Use after free in Metrics on 2026-09-24
[$TBD] [565742178 ] Low CVE-2026-106269 Use after free in CSS on 2026-09-24
[$TBD] [565742177 ] High CVE-2026-106268 Use after free in WebRTC on 2026-09-24
[$TBD] [565674529 ] High CVE-2026-106257 Use after free in HTML on 2026-09-24
[$1000.0] [565612897 ] High CVE-2026-106235 Use after free in WebAudio on 2026-09-23
[$TBD] [564085088 ] High CVE-2026-106234 Use after free in Network on 2026-09-20
[$500.0] [563673584 ] High CVE-2026-106248 Use after free in Bindings Reported by [] on 2026-09-19
[$TBD] [562043997 ] High CVE-2026-106329 Incorrect authorization in FileSystem on 2026-09-15
[$TBD] [562002095 ] High CVE-2026-106211 Use after free in TabStrip on 2026-09-15
[$TBD] [561987051 ] High CVE-2026-106379 Uninitialized resource in Skia on 2026-09-15
[$TBD] [561891645 ] High CVE-2026-106227 Use after free in Core on 2026-09-15
[$TBD] [559793873 ] High CVE-2026-106393 Use after free in Storage Reported by [Xinyang Ge ] on 2026-09-10
[$TBD] [559780376 ] High CVE-2026-106255 Race condition in V8 on 2026-09-10
[$TBD] [523750306 ] Medium CVE-2026-106301 Confused deputy in Contextual Tasks on 2026-06-13
[$TBD] [520573237 ] Medium CVE-2026-106226 Improper input validation in Compositing on 2026-06-05
[$TBD] [517689673 ] Medium CVE-2026-106228 Confused deputy in Google Lens on 2026-05-28
[$TBD] [502475175 ] Medium CVE-2026-106244 Incorrect authorization in Permissions on 2026-04-14
[$TBD] [501914204 ] Medium CVE-2026-106266 Confused deputy in Contextual Tasks on 2026-04-12
[$TBD] [497350668 ] Medium CVE-2026-106181 Incorrect reference resolution in DevTools on 2026-03-28
[$TBD] [497148613 ] Medium CVE-2026-106286 Confused deputy in Omnibox on 2026-03-28
[$TBD] [570675082 ] High CVE-2026-110171 Use after free in Media on 2026-10-06
[$TBD] [570638834 ] Critical CVE-2026-110151 Use after free in Media on 2026-10-06
[$TBD] [570461696 ] High CVE-2026-110167 Use after free in Media on 2026-10-06
[$TBD] [570167922 ] High CVE-2026-110155 Buffer overflow in PDFium on 2026-10-05
[$TBD] [570167920 ] High CVE-2026-110154 Use after free in Canvas on 2026-10-05
[$TBD] [570047270 ] High CVE-2026-110157 Use after free in SVG on 2026-10-05
[$TBD] [570050934 ] Critical CVE-2026-110148 Use after free in SVG on 2026-10-05
[$TBD] [570050928 ] High CVE-2026-110147 Use after free in PDF on 2026-10-05
[$TBD] [568899705 ] High CVE-2026-110138 Use after free in ShapeDetection on 2026-10-02
[$TBD] [568895734 ] High CVE-2026-110141 Observable discrepancy in Media on 2026-10-02
[$TBD] [568831102 ] High CVE-2026-110163 Use after free in DOM on 2026-10-02
[$TBD] [568826881 ] Critical CVE-2026-110161 Use after free in Network on 2026-10-02
[$TBD] [568719364 ] Critical CVE-2026-110136 Use after free in PDF on 2026-10-02
[$TBD] [568730794 ] High CVE-2026-110164 Use after free in DOM on 2026-10-02
[$TBD] [568719352 ] High CVE-2026-110172 Use after free in Media on 2026-10-02
[$TBD] [568437149 ] Critical CVE-2026-110149 Use after free in Browser on 2026-10-01
[$TBD] [568010382 ] High CVE-2026-110168 Use after free in V8 on 2026-10-01
[$TBD] [568037533 ] High CVE-2026-110139 Use after free in Media on 2026-09-30
[$TBD] [567088929 ] Medium CVE-2026-110169 Use after free in V8 on 2026-09-28
[$TBD] [566496747 ] High CVE-2026-110166 Buffer overflow in Animation on 2026-09-26
[$TBD] [565742182 ] High CVE-2026-110153 Use after free in Media on 2026-09-24
[$5000.0] [564573066 ] High CVE-2026-110159 Incorrect authorization in Updater on 2026-09-21
[$TBD] [562243925 ] High CVE-2026-110145 Use after free in Passwords Reported by [Xinyang Ge ] on 2026-09-15
[$TBD] [562242421 ] High CVE-2026-110158 Use after free in Passwords Reported by [Xinyang Ge ] on 2026-09-15
[$TBD] [562038980 ] High CVE-2026-110140 Type confusion in V8 on 2026-09-15
[$TBD] [561997899 ] High CVE-2026-110137 Use after free in WebRTC on 2026-09-15
[$5000.0] [561039723 ] High CVE-2026-110146 Information leak in Passwords Reported by [Hoyong Jin] on 2026-09-13
[$TBD] [554531101 ] High CVE-2026-110143 Use of uninitialized variable in ThirdParty lmza_sdk on 2026-08-29
[$TBD] [553525515 ] Medium CVE-2026-110142 Use after free in FileSystem on 2026-08-27
[$TBD] [552510359 ] High CVE-2026-110160 Missing authorization in ReadingMode on 2026-08-25
[$1000.0] [540499008 ] High CVE-2026-110162 Use after free in Desktop on 2026-07-29
[$TBD] [496308073 ] High CVE-2026-110170 Use after free in Bindings on 2026-03-25
[$TBD] [569659194 ] High CVE-2026-110920 Memory corruption in V8 on 2026-10-04
[$TBD] [569286602 ] High CVE-2026-110921 Use after free in V8 on 2026-10-04
[$TBD] [569038297 ] High CVE-2026-110917 Memory corruption in SVG on 2026-10-03
[$TBD] [568937999 ] High CVE-2026-110918 Memory corruption in Core on 2026-10-02
[$TBD] [568831769 ] High CVE-2026-110919 Use after free in V8 on 2026-10-02
[$TBD] [568719351 ] Critical CVE-2026-110922 Use after free in Prerender on 2026-10-02
[$TBD] [567638392 ] High CVE-2026-110913 Memory corruption in DOM on 2026-09-29
[$TBD] [563194341 ] Medium CVE-2026-110914 Memory corruption in Workers on 2026-09-18
[$TBD] [556272421 ] Medium CVE-2026-110915 Use after free in Compositing on 2026-09-02
[$TBD] [501886301 ] Medium CVE-2026-110916 Improper input validation in Desktop on 2026-04-12
[$TBD] [574041825 ] Critical CVE-2026-113303 Memory corruption in WebRTC on 2026-10-15
[$TBD] [572893186 ] High CVE-2026-112993 Use after free in Input on 2026-10-12
[$2000.0] [572862424 ] High CVE-2026-113339 Use after free in SVG on 2026-10-12
[$TBD] [572695599 ] High CVE-2026-113179 Use after free in Paint on 2026-10-12
[$TBD] [572598342 ] High CVE-2026-113000 Memory corruption in Paint on 2026-10-11
[$TBD] [572237007 ] High CVE-2026-113212 Memory corruption in PDF on 2026-10-10
[$TBD] [571618833 ] Critical CVE-2026-113271 Use after free in Accessibility on 2026-10-08
[$TBD] [570740320 ] Critical CVE-2026-113280 Memory corruption in Paint on 2026-10-06
[$TBD] [570715681 ] Low CVE-2026-113274 Use after free in ReadingMode on 2026-10-06
[$TBD] [570638836 ] Critical CVE-2026-113072 Memory corruption in CSS on 2026-10-06
[$TBD] [570203091 ] High CVE-2026-113160 Use after free in Turbolev on 2026-10-05
[$TBD] [570093145 ] Critical CVE-2026-113279 Memory corruption in Accessibility on 2026-10-05
[$TBD] [570167919 ] High CVE-2026-113095 Out of bounds read in Focus on 2026-10-05
[$TBD] [570003644 ] High CVE-2026-113019 Use after free in Turbolev on 2026-10-05
[$TBD] [569408568 ] High CVE-2026-113181 Use after free in Navigation on 2026-10-04
[$TBD] [569127861 ] High CVE-2026-113154 Memory corruption in Canvas on 2026-10-04
[$TBD] [569286604 ] High CVE-2026-113336 Memory corruption in Compositing on 2026-10-04
[$TBD] [568945639 ] High CVE-2026-113161 Use after free in WebRTC on 2026-10-02
[$TBD] [568906040 ] High CVE-2026-113040 Improper input validation in Proxy on 2026-10-02
[$TBD] [568822820 ] High CVE-2026-113175 Improper input validation in FileSystem on 2026-10-02
[$TBD] [568831768 ] High CVE-2026-113309 Out of bounds read in Media on 2026-10-02
[$TBD] [568831099 ] High CVE-2026-113192 Memory corruption in V8 on 2026-10-02
[$TBD] [568215670 ] High CVE-2026-113012 Improper input validation in GPU on 2026-10-01
[$TBD] [567673405 ] Medium CVE-2026-113086 Improper input validation in Input on 2026-09-29
[$TBD] [567612004 ] High CVE-2026-113093 Memory corruption in DisplayLocking on 2026-09-29
[$TBD] [567175125 ] High CVE-2026-113338 Use after free in Turbolev on 2026-09-28
[$TBD] [566687517 ] High CVE-2026-113310 Out of bounds read in Bluetooth on 2026-09-27
[$TBD] [566136673 ] High CVE-2026-113318 Memory corruption in ServiceWorker on 2026-09-25
[$2000.0] [566091009 ] High CVE-2026-113222 Use after free in V8 on 2026-09-25
[$TBD] [565838017 ] High CVE-2026-113020 Improper input validation in Date on 2026-09-24
[$TBD] [563357593 ] High CVE-2026-113324 Use after free in GPU on 2026-09-18
[$TBD] [553117109 ] High CVE-2026-113253 Use after free in Canvas on 2026-08-26
[$2000.0] [551059870 ] High CVE-2026-113058 Use after free in WebUI on 2026-08-22
[$2000.0] [548989584 ] High CVE-2026-113098 Memory corruption in CacheStorage on 2026-08-19
[$TBD] [536639352 ] High CVE-2026-113322 Memory corruption in Dawn on 2026-07-19
[$TBD] [535749304 ] High CVE-2026-113104 Memory corruption in Frames on 2026-07-16
[$3000.0] [526039697 ] High CVE-2026-113097 Use after free in FileSystem on 2026-06-20
[$TBD] [517407917 ] Medium CVE-2026-113206 Memory corruption in Omnibox on 2026-05-28
[$2000.0] [40942045] Medium CVE-2026-113068 Use after free in Input Reported by [Hafiizh (https://www.linkedin.com/in/hafiizh-7aa6bb31/) ] on 2023-11-12