ChromeOS 156 patches two critical and 24 high-severity vulnerabilities

Google has released ChromeOS version 16836.19.0 (M-156) to the stable channel, bundling browser version 156.0.8078.42. The update addresses two critical CVEs—CVE-2026-106347 in Track and CVE-2026-106358 in Navigation—both use-after-free flaws. It also fixes 24 high-severity vulnerabilities across Media, V8, WebRTC, PDF, and other components, plus several medium-severity issues. The release includes third-party security fixes for compromised CA certificates and multiple ARM Mali GPU kernel driver bugs that could allow memory corruption or guest-to-host escapes.

Notable vulnerabilities in M-156

• CVE-2026-106347 (Critical): Use-after-free in Track component, reported 2026-09-30
• CVE-2026-106358 (Critical): Use-after-free in Navigation, reported 2026-09-28
• Kernel-level fixes: ARM Mali driver patches for double-free in kbase_mem_from_umm, page-migration UAF in kbase_vmap_phy_pages on mt8196, and undefined behavior in arc-keymaster allowing guest-to-host indirect calls
• V8 engine: Two high-severity bugs—type confusion (CVE-2026-106240) and race condition (CVE-2026-106255)
• Media component: Five separate use-after-free vulnerabilities (CVE-2026-106383, CVE-2026-106184, CVE-2026-106190, CVE-2026-106423, CVE-2026-106318)
• Third-party CA compromise: Medium-severity fix for compromised third-party certificates affecting TLS for all clients

Why it matters

ChromeOS devices and ChromeOS Flex installations on the stable channel will receive this update automatically. The Mali GPU kernel fixes are particularly relevant for devices with ARM-based SoCs including mt8196, while the CA certificate fix addresses a broad TLS trust issue.