# ChromeOS 156 stable release patches nine security flaws including seven High-severity bugs

> **Key takeaway:** Google's ChromeOS M-156 stable channel update resolves nine security vulnerabilities, seven rated High severity, spanning WebXR, WebGL, Media, CacheStorage, Images, Navigation, and Animation subsystems.

**Published:** 2026-11-07T00:52:58.867000+00:00 
**Source:** Google Chromium Engineering Releases 
**Category:** bigtech-foss 
**Canonical URL:** https://fosswire.org/news/chromeos-156-stable-release-patches-nine-security-flaws-incl.html 

## Summary
Google has promoted ChromeOS milestone 156 to the Stable channel, delivering version 16836.32.0 with browser version 156.0.8078.93 for ChromeOS and ChromeOS Flex devices. The release contains security fixes for nine tracked vulnerabilities, including seven High-severity issues: use-after-free bugs in WebXR, WebGL, Navigation, and Animation; out-of-bounds reads in Media; type confusion in CacheStorage; and an uninitialized resource flaw in Images. Two additional Medium and Low severity issues in Platform and Editing were also addressed. ChromeOS Flex, Google's distribution for repurposing older x86 hardware, receives the same fixes in parallel.

The update arrives through the standard ChromeOS automatic update mechanism. Users and administrators managing fleets of Chromebooks or ChromeOS Flex installations should verify devices have received version 16836.32.0. The security bulletin does not disclose whether any of the High-severity issues are under active exploitation, though the concentration of memory-safety bugs in web-exposed components (WebXR, WebGL, Media) suggests potential attack vectors through malicious web content.

## Security fixes in ChromeOS 156 stable
- **WebXR use-after-free (CVE-2026-121076):** High-severity memory corruption in the WebXR subsystem, which handles virtual and augmented reality sessions in the browser; use-after-free conditions in this path could enable remote code execution through crafted XR content.
- **Media out-of-bounds reads (CVE-2026-121208, CVE-2026-121184):** Two distinct bugs in the Media pipeline, one High and one Medium severity, involving out-of-bounds memory access during media processing; these could lead to information disclosure or crashes when handling malformed audio/video streams.
- **WebGL use-after-free (CVE-2026-79235):** High-severity vulnerability in the WebGL graphics API implementation, exploitable through malicious shader or canvas content to corrupt renderer process memory.
- **CacheStorage type confusion (CVE-2026-121233):** High-severity bug in the CacheStorage API used by Progressive Web Apps and service workers for offline resource caching; type confusion here could bypass security checks or cause memory corruption.
- **Images uninitialized resource (CVE-2026-121213):** High-severity flaw where image decoding left resources uninitialized, potentially leaking memory contents or causing undefined behavior during image rendering.
- **Navigation and Animation use-after-free (CVE-2026-121241, CVE-2026-121201):** Two additional High-severity memory safety issues in page navigation transitions and CSS/JS animation handling, both exploitable for renderer compromise.
- **Platform and Editing fixes (CVE-2026-121135, CVE-2026-121141):** Medium and Low severity issues in the underlying platform layer and text editing subsystem, with the latter involving improper input validation.

## Why it matters
ChromeOS's Linux container (Crostini) and developer mode rely on the same browser security boundary, making these renderer and media pipeline fixes relevant to developers running Linux applications on Chromebooks. For ChromeOS Flex deployments extending hardware lifespans with lightweight Linux-based systems, timely security maintenance demonstrates Google's continued commitment to the open-source Chromium-derived platform as an alternative to traditional desktop operating systems. Enterprise administrators managing ChromeOS fleets should prioritize this update given the concentration of High-severity web-exposed vulnerabilities that could serve as entry points for broader system compromise.