ChromeOS: multiple vulnerabilities

Chrome

ChromeOS version 16836.30.0 fixes multiple vulnerabilities, including use after free and improper input validation issues.

Do this now

Update Chrome to 156.0.8078.73 to fix the use-after-free and input validation vulnerabilities.

Fix it

Upgrade to Chrome 156.0.8078.73

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 21:17 UTC
Fixed in: 156.0.8078.73
Identifiers: CVE-2026-118307
CVE-2026-118309
CVE-2026-118331
CVE-2026-118332
CVE-2026-118339
CVE-2026-118343
CVE-2026-118346
CVE-2026-118349
CVE-2026-118358
CVSS: 9.6
Source: news
On the menu as: Chrome

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## ChromeOS: multiple vulnerabilities
Severity: critical. Patch status: patched.
Affected: Chrome
Fixed in: 156.0.8078.73
Ids: CVE-2026-118307, CVE-2026-118309, CVE-2026-118331, CVE-2026-118332, CVE-2026-118339, CVE-2026-118343, CVE-2026-118346, CVE-2026-118349, CVE-2026-118358

ChromeOS version 16836.30.0 fixes multiple vulnerabilities, including use after free and improper input validation issues.

## Steps
1. Search the repo, its CI and infra config for Chrome. If present, report the version in use and whether it's affected.
2. Fix by release line: Chrome: 156.0.x → 156.0.8078.73.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Chrome 156.0.x | fixed | 156.0.8078.73 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-118307") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: http://chromereleases.googleblog.com/2026/10/stable-channel-update-for-chromeos_01748991111.html
https://pwned.coffee/i/chromeos-multiple-vulnerabilities-2

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Chrome 156.0.8078.73 to before 156.0.8078.73 156.0.8078.73 CVE record (CNA) checked 28 Oct
Score: CVSS 9.6 (critical). CVSS 3.1 9.6 (CISA ADP) for CVE-2026-118309
Last checked: 28 Oct 2026, 23:18 UTC

Product	Affected	Fixed in	Source
Chrome	156.0.8078.73 to before 156.0.8078.73	156.0.8078.73	CVE record (CNA) checked 28 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

feeds.feedburner.com: Stable Channel Update for ChromeOS / ChromeOS Flex

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee