Google ChromeOS 156 Stable Update Fixes 117 Listed CVEs
Tech GuruQuick Answer
Google released ChromeOS and ChromeOS Flex stable platform 16836.19.0 with browser 156.0.8078.42, 117 listed CVEs, and additional operating-system security fixes. Inventory managed devices, stage the update, restart, verify both versions and policy state, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory ChromeOS and ChromeOS Flex platform and browser versions; stage platform 16836.19.0 through the supported channel; restart devices; verify enrollment, policy, platform and browser versions, and critical workflows; monitor the rollout; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ChromeOS and ChromeOS Flex stable channel |
|---|---|
| Advisory | ChromeOS Stable 16836.19.0 |
| CVEs | CVE-2026-106181, CVE-2026-106184, CVE-2026-106190, CVE-2026-106200, CVE-2026-106204, CVE-2026-106211, CVE-2026-106226, CVE-2026-106227, CVE-2026-106228, CVE-2026-106233, CVE-2026-106234, CVE-2026-106235, CVE-2026-106240, CVE-2026-106244, CVE-2026-106248, CVE-2026-106255, CVE-2026-106257, CVE-2026-106266, CVE-2026-106268, CVE-2026-106269, CVE-2026-106278, CVE-2026-106286, CVE-2026-106301, CVE-2026-106318, CVE-2026-106329, CVE-2026-106346, CVE-2026-106347, CVE-2026-106349, CVE-2026-106357, CVE-2026-106358, CVE-2026-106379, CVE-2026-106383, CVE-2026-106393, CVE-2026-106411, CVE-2026-106421, CVE-2026-106423, CVE-2026-110136, CVE-2026-110137, CVE-2026-110138, CVE-2026-110139, CVE-2026-110140, CVE-2026-110141, CVE-2026-110142, CVE-2026-110143, CVE-2026-110145, CVE-2026-110146, CVE-2026-110147, CVE-2026-110148, CVE-2026-110149, CVE-2026-110151, CVE-2026-110153, CVE-2026-110154, CVE-2026-110155, CVE-2026-110157, CVE-2026-110158, CVE-2026-110159, CVE-2026-110160, CVE-2026-110161, CVE-2026-110162, CVE-2026-110163, CVE-2026-110164, CVE-2026-110166, CVE-2026-110167, CVE-2026-110168, CVE-2026-110169, CVE-2026-110170, CVE-2026-110171, CVE-2026-110172, CVE-2026-110913, CVE-2026-110914, CVE-2026-110915, CVE-2026-110916, CVE-2026-110917, CVE-2026-110918, CVE-2026-110919, CVE-2026-110920, CVE-2026-110921, CVE-2026-110922, CVE-2026-112993, CVE-2026-113000, CVE-2026-113012, CVE-2026-113019, CVE-2026-113020, CVE-2026-113040, CVE-2026-113058, CVE-2026-113068, CVE-2026-113072, CVE-2026-113086, CVE-2026-113093, CVE-2026-113095, CVE-2026-113097, CVE-2026-113098, CVE-2026-113104, CVE-2026-113154, CVE-2026-113160, CVE-2026-113161, CVE-2026-113175, CVE-2026-113179, CVE-2026-113181, CVE-2026-113192, CVE-2026-113206, CVE-2026-113212, CVE-2026-113222, CVE-2026-113253, CVE-2026-113271, CVE-2026-113274, CVE-2026-113279, CVE-2026-113280, CVE-2026-113303, CVE-2026-113309, CVE-2026-113310, CVE-2026-113318, CVE-2026-113322, CVE-2026-113324, CVE-2026-113336, CVE-2026-113338, CVE-2026-113339 |
| Authoritative release date | 2026-10-21 00:56:18.403 UTC |
| Authority revision date | 2026-10-21 00:56:18.403 UTC |
| Affected versions | ChromeOS and ChromeOS Flex stable-channel devices before platform version 16836.19.0 and browser version 156.0.8078.42. |
| Fixed version | ChromeOS platform version 16836.19.0 with browser version 156.0.8078.42 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by Google; no exploitation claim is inferred. |
What Changed
Google released the M156 ChromeOS stable-channel build with 117 listed CVEs and additional third-party operating-system security fixes involving a compromised CA, arc-keymaster, and Mali components.
What To Validate Now
- Inventory. Identify ChromeOS and ChromeOS Flex devices, management organizational unit, platform and browser versions, update policy, pending restart state, owner, and critical kiosk or application dependencies.
- Establish applicability. Match each stable-channel device to platform version 16836.19.0 and browser 156.0.8078.42. Keep this scope separate from desktop and Android Chrome because the platform and CVE sets differ.
- Remediate. Deploy platform version 16836.19.0 through the supported ChromeOS update and management channel, allowing staged rollout and restart according to operational requirements.
- Validate. Confirm both platform and browser versions after restart, verify enrollment and policy, test representative sign-in, kiosk, peripheral, network, and recovery workflows, and retain console and device evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
This ChromeOS release has a distinct platform build and CVE set from the desktop and Android Chrome release. Test kiosk, peripheral, network, enrollment, and recovery dependencies before broad rollout. Google did not publish CVSS base scores or state exploitation in the release post.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
