ChromeOS M-156 update closes 12 critical Chrome browser vulnerabilities and dangerous kernel flaws

On 20 October 2026, Google released the ChromeOS M-156 update (version 16836.19.0, browser 156.0.8078.42) for the stable channel, according to the official advisory. The update fixes 12 critical vulnerabilities in the Chrome browser component, dozens of high-severity vulnerabilities, as well as dangerous kernel-level flaws in the Mali drivers and the arc-keymaster component that can lead to kernel memory corruption and escape from the guest environment. ChromeOS and ChromeOS Flex users are advised to apply the update immediately.

Critical browser vulnerabilities

The update fixes 12 vulnerabilities that Google has rated as Critical. The vast majority of them belong to the use after free class — one of the most dangerous types of flaws that allow an attacker to seize control of the program’s execution flow. The critical vulnerabilities affect a wide range of browser components:

• CVE-2026-106347 — use after free in Track
• CVE-2026-106358 — use after free in Navigation
• CVE-2026-110151 — use after free in Media
• CVE-2026-110148 — use after free in SVG
• CVE-2026-110161 — use after free in Network
• CVE-2026-110136 — use after free in PDF
• CVE-2026-110149 — use after free in Browser
• CVE-2026-110922 — use after free in Prerender
• CVE-2026-113271 — use after free in Accessibility
• CVE-2026-113303 — memory corruption in WebRTC
• CVE-2026-113280 — memory corruption in Paint
• CVE-2026-113072 — memory corruption in CSS

According to NVD, for CVE-2026-110151 and CVE-2026-110148, a remote attacker can execute arbitrary code inside the sandbox via a specially crafted HTML page. The CISA-ADP CVSS 3.1 score for both vulnerabilities is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It is worth noting that Google classifies these vulnerabilities as Critical on Chromium’s own severity scale, whereas CISA-ADP assigns them a High rating — these are different rating systems and should not be conflated.

In addition to the critical issues, the update includes more than 50 High-severity vulnerabilities, including use after free in V8, WebRTC, Media, PDF, DOM, Passwords, Canvas, as well as type confusion in V8 (CVE-2026-106240, CVE-2026-110140), memory corruption in V8, SVG, Core, Dawn, ServiceWorker, and authorization errors in FileSystem and Updater.

Kernel-level and third-party component vulnerabilities

Special attention should be paid to the fixes that go beyond the browser code and affect ChromeOS system components:

• arc-keymaster — an undefined behavior bug (fall-off-end UB) in the CrosKeyFactory::GetOperationFactory function allows an arbitrary indirect call from the guest environment into the host (guest-to-host). Severity: High.
• mali_kbase — double free of the dma_buf_attachment structure in the kbase_mem_from_umm error-handling path leads to kernel memory corruption. Severity: High.
• Mali (mt8196) — use after free during page migration in kbase_vmap_phy_pages allows an unprivileged user to corrupt kernel memory on devices with the mt8196 chip. Severity: High.
• Third-party CA certificates — compromise of third-party certification authority certificates results in TLS compromise for all clients. Severity: Medium.

Vulnerabilities in the Mali drivers and arc-keymaster are particularly dangerous: they allow an attacker who has gained initial access via a browser exploit to potentially break out of the sandbox and obtain control at the kernel or host system level. This turns the exploitation chain from limited code execution within the sandbox into full device compromise.

Impact assessment

The scope of this update is one of the largest for ChromeOS in 2026. Twelve critical vulnerabilities in a single release is an unusual situation. Previously, we analyzed the Chrome 153 update with five critical vulnerabilities, which was already considered significant.

The highest risk is for organizations using ChromeOS in educational institutions and corporate environments, where Chromebook devices are deployed at scale and may be updated with delays. Devices based on the mt8196 chip are additionally vulnerable due to the Mali driver flaw. Available data does not contain any information about active exploitation of the listed vulnerabilities; however, the absence of such information does not mean that exploitation is not occurring.

Recommendations

1. Immediately update ChromeOS to version 16836.19.0 (browser 156.0.8078.42) via the stable channel. For managed device fleets, initiate a forced update via the Google Admin console.
2. Check the current version on each device: Settings → About ChromeOS. Make sure the browser version is not lower than 156.0.8078.42.
3. For mt8196 devices — prioritize updating due to the Mali driver vulnerability that allows unprivileged kernel memory corruption.
4. Review the Android security bulletin for October 2026 — the ChromeOS update also includes those fixes.

Given the 12 critical browser vulnerabilities that allow remote code execution via malicious HTML pages and three kernel-level flaws capable of leading to full device compromise, this update should not be postponed. Administrators of managed ChromeOS fleets should trigger a forced update to version 16836.19.0 within hours, not days.