Google ChromeOS LTS 150 Update Fixes 70 Listed CVEs
Tech GuruQuick Answer
Google is rolling out ChromeOS LTS-150 150.0.7871.287, platform 16700.68.0, with 70 listed security fixes. Inventory the LTS fleet, confirm device eligibility and rollout state, update through supported controls, validate policy and applications, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory ChromeOS and ChromeOS Flex devices on LTS-150, browser and platform versions, update policies, enrollment state, owners, exceptions, and offline systems. Match devices to the LTS channel and exact pre-update versions; do not apply this build number to Stable, Extended Stable, LTC, or other ChromeOS channels. Deploy LTS-150 150.0.7871.287 and platform 16700.68.0 through supported ChromeOS update controls as the staged rollout reaches eligible devices. Confirm the active browser and platform versions after restart, verify enrollment and policy, test authentication, networking, peripherals and critical web applications, and retain fleet and change evidence.
Last verified: 2026-10-27 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ChromeOS and ChromeOS Flex LTS-150 |
|---|---|
| Advisory | ChromeOS LTS-150 150.0.7871.287 / Platform 16700.68.0 |
| CVEs | CVE-2026-102304, CVE-2026-102306, CVE-2026-102308, CVE-2026-102316, CVE-2026-102319, CVE-2026-102324, CVE-2026-103622, CVE-2026-103623, CVE-2026-103629, CVE-2026-106184, CVE-2026-106190, CVE-2026-106200, CVE-2026-106204, CVE-2026-106211, CVE-2026-106233, CVE-2026-106257, CVE-2026-106318, CVE-2026-106329, CVE-2026-106347, CVE-2026-106358, CVE-2026-106383, CVE-2026-106421, CVE-2026-106423, CVE-2026-110136, CVE-2026-110137, CVE-2026-110138, CVE-2026-110141, CVE-2026-110142, CVE-2026-110147, CVE-2026-110148, CVE-2026-110151, CVE-2026-110154, CVE-2026-110157, CVE-2026-110161, CVE-2026-110162, CVE-2026-110163, CVE-2026-110166, CVE-2026-110170, CVE-2026-110171, CVE-2026-110172, CVE-2026-110913, CVE-2026-110915, CVE-2026-110918, CVE-2026-110922, CVE-2026-113072, CVE-2026-113175, CVE-2026-113271, CVE-2026-113279, CVE-2026-113280, CVE-2026-113339, CVE-2026-19175, CVE-2026-79122, CVE-2026-87444, CVE-2026-87474, CVE-2026-87558, CVE-2026-87581, CVE-2026-91709, CVE-2026-91711, CVE-2026-91715, CVE-2026-91731, CVE-2026-91735, CVE-2026-91741, CVE-2026-91746, CVE-2026-95286, CVE-2026-95299, CVE-2026-95318, CVE-2026-95324, CVE-2026-95343, CVE-2026-95348, CVE-2026-95365 |
| Authoritative release date | 2026-10-27 02:10:25.437 UTC |
| Authority revision date | 2026-10-27 02:10:25.438 UTC |
| Affected versions | ChromeOS and ChromeOS Flex devices on the LTS-150 channel before browser version 150.0.7871.287 and platform version 16700.68.0, subject to Google's staged device rollout. |
| Fixed version | ChromeOS LTS-150 150.0.7871.287 (platform 16700.68.0) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Medium to Critical |
| Exploitation status | Google does not state in this LTS bulletin that the listed vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Google began rolling out a ChromeOS LTS-150 build with 70 listed security fixes, including authority-rated Critical, High, and Medium memory-safety, authorization, and input-validation issues.
What To Validate Now
- Inventory. Inventory ChromeOS and ChromeOS Flex devices on LTS-150, browser and platform versions, update policies, enrollment state, owners, exceptions, and offline systems.
- Establish applicability. Match devices to the LTS channel and exact pre-update versions; do not apply this build number to Stable, Extended Stable, LTC, or other ChromeOS channels.
- Remediate. Deploy LTS-150 150.0.7871.287 and platform 16700.68.0 through supported ChromeOS update controls as the staged rollout reaches eligible devices.
- Validate. Confirm the active browser and platform versions after restart, verify enrollment and policy, test authentication, networking, peripherals and critical web applications, and retain fleet and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Google describes a staged rollout and does not provide CVSS scores in the bulletin. Do not force an unsupported channel transition; track devices that have not yet received the approved LTS build.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
