ChromeOS 16836.30.0 Fixes Nine Browser Vulnerabilities
Tech GuruQuick Answer
Google's ChromeOS Stable update moves devices to 16836.30.0 with Chrome 156.0.8078.77 and fixes nine browser CVEs. Inventory managed and unmanaged devices, complete rollout and restart, validate policy and critical apps, and retain fleet evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory ChromeOS and ChromeOS Flex devices, platform and browser versions, update-channel policy, restart state, kiosk and managed-session use, owners, and devices outside normal management. Confirm the platform and browser build on each device; do not assume that a downloaded update is active before restart or that the same platform build applies to every channel and hardware family. Deploy ChromeOS 16836.30.0 with Chrome 156.0.8078.77 through supported update controls and require a restart where needed to activate the new build. Verify active platform and browser versions, policy and extension enforcement, login, kiosk, printing and critical web applications, monitor deployment exceptions, and retain fleet compliance evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ChromeOS and ChromeOS Flex Stable channel with Chrome browser 156.0.8078.77 |
|---|---|
| Advisory | ChromeOS Stable 16836.30.0 / Chrome 156.0.8078.77 |
| CVEs | CVE-2026-118307, CVE-2026-118309, CVE-2026-118331, CVE-2026-118332, CVE-2026-118339, CVE-2026-118343, CVE-2026-118346, CVE-2026-118349, CVE-2026-118358 |
| Authoritative release date | 2026-10-28 19:45:30.211 UTC |
| Authority revision date | 2026-10-28 19:45:30.211 UTC |
| Affected versions | ChromeOS and ChromeOS Flex Stable devices before platform version 16836.30.0 and browser version 156.0.8078.77. |
| Fixed version | ChromeOS 16836.30.0 with Chrome 156.0.8078.77 |
| CVSS base score | Not provided by the authority |
| CVSS severity | High to Critical |
| Exploitation status | Google does not state in this release notice that the listed vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Google released ChromeOS 16836.30.0 with nine listed browser security fixes, including a critical FileAPI input-validation flaw and eight high-severity memory-safety or validation issues.
What To Validate Now
- Inventory. Inventory ChromeOS and ChromeOS Flex devices, platform and browser versions, update-channel policy, restart state, kiosk and managed-session use, owners, and devices outside normal management.
- Establish applicability. Confirm the platform and browser build on each device; do not assume that a downloaded update is active before restart or that the same platform build applies to every channel and hardware family.
- Remediate. Deploy ChromeOS 16836.30.0 with Chrome 156.0.8078.77 through supported update controls and require a restart where needed to activate the new build.
- Validate. Verify active platform and browser versions, policy and extension enforcement, login, kiosk, printing and critical web applications, monitor deployment exceptions, and retain fleet compliance evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Google rolls Stable updates progressively. Avoid unsupported channel changes, track devices that miss rollout or restart deadlines, and use compensating browser controls only until the supported update is active.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
