ChromeOS: multiple vulnerabilities

Chrome

ChromeOS LTS update fixes multiple security issues, including integer overflow, buffer overflow, and memory corruption vulnerabilities.

Do this now

Upgrade ChromeOS to 156.0.8078.47, 155.0.8059.84, or 154.0.8037.97, or apply the fix listed under Fix it (+2 more lines in Fix it).

Fix it

Chrome

On 151.xUpgrade to Chrome 151.0.7922.109
On 153.xUpgrade to Chrome 153.0.8010.47
On 154.xUpgrade to Chrome 154.0.8037.97
On 155.xUpgrade to Chrome 155.0.8059.84
On 156.xUpgrade to Chrome 156.0.8078.47

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 03:18 UTC
Fixed in: 156.0.8078.47
155.0.8059.84
154.0.8037.97
153.0.8010.47
151.0.7922.109
Identifiers: CVE-2026-103629
CVE-2026-110138
CVE-2026-110148
CVE-2026-110154
CVE-2026-110166
CVE-2026-110171
CVE-2026-110915
CVE-2026-110918
CVE-2026-113072
CVE-2026-113271
CVE-2026-113279
CVE-2026-19175
CVE-2026-87474
CVE-2026-87558
CVE-2026-87581
CVE-2026-91735
CVE-2026-95318
CVSS: 9.6
Source: news
On the menu as: Chrome

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## ChromeOS: multiple vulnerabilities
Severity: critical. Patch status: patched.
Affected: Chrome
Fixed in: 156.0.8078.47, 155.0.8059.84, 154.0.8037.97, 153.0.8010.47, 151.0.7922.109
Ids: CVE-2026-103629, CVE-2026-110138, CVE-2026-110148, CVE-2026-110154, CVE-2026-110166, CVE-2026-110171, CVE-2026-110915, CVE-2026-110918, CVE-2026-113072, CVE-2026-113271, CVE-2026-113279, CVE-2026-19175, CVE-2026-87474, CVE-2026-87558, CVE-2026-87581, CVE-2026-91735, CVE-2026-95318

ChromeOS LTS update fixes multiple security issues, including integer overflow, buffer overflow, and memory corruption vulnerabilities.

## Steps
1. Search the repo, its CI and infra config for Chrome. If present, report the version in use and whether it's affected.
2. Fix by release line: Chrome: 156.0.x → 156.0.8078.47; 155.0.x → 155.0.8059.84; 154.0.x → 154.0.8037.97; 153.0.x → 153.0.8010.47; 151.0.x → 151.0.7922.109.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Chrome 156.0.x | fixed | 156.0.8078.47 | — |
| Chrome 155.0.x | fixed | 155.0.8059.84 | — |
| Chrome 154.0.x | fixed | 154.0.8037.97 | — |
| Chrome 153.0.x | fixed | 153.0.8010.47 | — |
| Chrome 151.0.x | fixed | 151.0.7922.109 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-103629") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: http://chromereleases.googleblog.com/2026/10/long-term-support-channel-update-for_0661547040.html
https://pwned.coffee/i/chromeos-multiple-vulnerabilities

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Chrome 156.0.8078.47 to before 156.0.8078.47 156.0.8078.47 CVE record (CNA) checked 27 Oct
Chrome 155.0.8059.79 to before 155.0.8059.84 155.0.8059.84 CVE record (CNA) checked 27 Oct
Chrome 154.0.8037.57 to before 154.0.8037.97 154.0.8037.97 CVE record (CNA) checked 27 Oct
Chrome 153.0.8010.36 to before 153.0.8010.47 153.0.8010.47 CVE record (CNA) checked 27 Oct
Chrome 151.0.7922.109 to before 151.0.7922.109 151.0.7922.109 CVE record (CNA) checked 27 Oct
Score: CVSS 9.6 (critical). CVSS 3.1 9.6 (CISA ADP) for CVE-2026-113072
Last checked: 27 Oct 2026, 04:17 UTC

Product	Affected	Fixed in	Source
Chrome	156.0.8078.47 to before 156.0.8078.47	156.0.8078.47	CVE record (CNA) checked 27 Oct
Chrome	155.0.8059.79 to before 155.0.8059.84	155.0.8059.84	CVE record (CNA) checked 27 Oct
Chrome	154.0.8037.57 to before 154.0.8037.97	154.0.8037.97	CVE record (CNA) checked 27 Oct
Chrome	153.0.8010.36 to before 153.0.8010.47	153.0.8010.47	CVE record (CNA) checked 27 Oct
Chrome	151.0.7922.109 to before 151.0.7922.109	151.0.7922.109	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

feeds.feedburner.com: Long Term Support Channel Update for ChromeOS

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee