ChromeOS / ChromeOS Flex: Stable channel update fixes critical and high kernel/browser vulnerabilities (CVE-2026-106200)
Severity: high · Patch status: patched · Since 2026-10-20 · CVE-2026-106181, CVE-2026-106184, CVE-2026-106190, CVE-2026-106200, CVE-2026-106204, CVE-2026-106211, CVE-2026-106226, CVE-2026-106227, CVE-2026-106228, CVE-2026-106233, CVE-2026-106234, CVE-2026-106235, CVE-2026-106240, CVE-2026-106244, CVE-2026-106248, CVE-2026-106255, CVE-2026-106257, CVE-2026-106266, CVE-2026-106268, CVE-2026-106269
Google rolled out ChromeOS 16836.19.0 (browser 156.0.8078.42) to the Stable channel on 2026-10-20/21, fixing multiple vulnerabilities. These include a critical CVE (ID truncated in source), a high use-after-free in Track (CVE-2026-106200), a high arc-keymaster fall-off-end UB allowing guest-to-host wild indirect calls, a high malikbase double-free of dmabufattachment enabling kernel memory corruption, and a high mali page-migration UAF (kbasevmapphypages) allowing unprivileged kernel memory corruption on mt8196, plus a medium fix for compromised 3rd-party CA certificates affecting TLS. Android and Chrome browser security fixes are also included. No in-the-wild exploitation is reported. All ChromeOS and ChromeOS Flex devices on Stable should receive the update automatically.
What to do
- Ensure managed ChromeOS/ChromeOS Flex devices have updated to version 16836.19.0 (browser 156.0.8078.42) or later
- Verify fleet update status via the Google Admin console and force reboots where updates are pending
- Review whether any devices use affected MediaTek mt8196 hardware and prioritize them
- Confirm TLS trust chains are unaffected by the compromised 3rd-party CA certificate issue
- Monitor Chrome Releases for follow-up stable or extended stable updates
Fixed versions
- ChromeOS 16836.19.0 (browser 156.0.8078.42)
Sources
All live incidents on Threat Watch