# ChromeOS 156 patches two critical and 24 high-severity vulnerabilities

> **Key takeaway:** ChromeOS stable channel update M-156 fixes two critical use-after-free bugs in Track and Navigation, plus multiple high-severity kernel and browser vulnerabilities.

**Published:** 2026-10-21T00:56:18.403000+00:00 
**Source:** Google Chromium Engineering Releases 
**Category:** bigtech-foss 
**Canonical URL:** https://fosswire.org/news/chromeos-156-patches-two-critical-and-24-high-severity-vulne.html 

## Summary
Google has released ChromeOS version 16836.19.0 (M-156) to the stable channel, bundling browser version 156.0.8078.42. The update addresses two critical CVEs—CVE-2026-106347 in Track and CVE-2026-106358 in Navigation—both use-after-free flaws. It also fixes 24 high-severity vulnerabilities across Media, V8, WebRTC, PDF, and other components, plus several medium-severity issues. The release includes third-party security fixes for compromised CA certificates and multiple ARM Mali GPU kernel driver bugs that could allow memory corruption or guest-to-host escapes.

## Notable vulnerabilities in M-156
- **CVE-2026-106347 (Critical)**: Use-after-free in Track component, reported 2026-09-30
- **CVE-2026-106358 (Critical)**: Use-after-free in Navigation, reported 2026-09-28
- **Kernel-level fixes**: ARM Mali driver patches for double-free in `kbase_mem_from_umm`, page-migration UAF in `kbase_vmap_phy_pages` on mt8196, and undefined behavior in `arc-keymaster` allowing guest-to-host indirect calls
- **V8 engine**: Two high-severity bugs—type confusion (CVE-2026-106240) and race condition (CVE-2026-106255)
- **Media component**: Five separate use-after-free vulnerabilities (CVE-2026-106383, CVE-2026-106184, CVE-2026-106190, CVE-2026-106423, CVE-2026-106318)
- **Third-party CA compromise**: Medium-severity fix for compromised third-party certificates affecting TLS for all clients

## Why it matters
ChromeOS devices and ChromeOS Flex installations on the stable channel will receive this update automatically. The Mali GPU kernel fixes are particularly relevant for devices with ARM-based SoCs including mt8196, while the CA certificate fix addresses a broad TLS trust issue.