VULNpocalypse
MediumVulnerabilityPatch available

HKCERT reports multiple ChromeOS vulnerabilities, update to 16836.32.0

HKCERT reports multiple ChromeOS vulnerabilities fixed in version 16836.32.0; check your ChromeOS devices and apply the vendor update.

Published
Fixed in
ChromeOS 16836.32.0 (Browser version 156.0.8078.93), per HKCERT
Exploitation
Not confirmed. HKCERT says a remote attacker could exploit some of these flaws, but its bulletin does not report exploitation in the wild.

Live scores

CVE-2026-79235
EPSS
0.005
low predicted chance of attack
VEDAS
0.969
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121076
EPSS
0.003
low predicted chance of attack
VEDAS
0.916
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121135
EPSS
0.003
low predicted chance of attack
VEDAS
0.917
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121141
EPSS
0.001
low predicted chance of attack
VEDAS
0.917
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121184
EPSS
0.004
low predicted chance of attack
VEDAS
0.913
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121201
EPSS
0.004
low predicted chance of attack
VEDAS
0.914
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121208
EPSS
0.004
low predicted chance of attack
VEDAS
0.923
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121213
EPSS
0.003
low predicted chance of attack
VEDAS
0.920
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121233
EPSS
0.004
low predicted chance of attack
VEDAS
0.921
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-121241
EPSS
0.003
low predicted chance of attack
VEDAS
0.920
strong exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to HKCERT, multiple vulnerabilities were identified in ChromeOS. In its bulletin of 9 November 2026, rated Medium Risk, HKCERT says a remote attacker could exploit some of these vulnerabilities to trigger data manipulation, security restriction bypass, sensitive information disclosure and remote code execution on the targeted system HKCERT: ChromeOS Multiple Vulnerabilities.

HKCERT names Google Chrome as the source of the information and points to the vendor’s stable channel update post for ChromeOS for details. This advisory relies only on the HKCERT bulletin; it has not been checked against the vendor post.

HKCERT lists these identifiers: CVE-2026-79235, CVE-2026-121076, CVE-2026-121135, CVE-2026-121141, CVE-2026-121184, CVE-2026-121201, CVE-2026-121208, CVE-2026-121213, CVE-2026-121233 and CVE-2026-121241.

Not confirmed in the source: which CVE maps to which impact, per-CVE severity scores, whether any of the flaws is exploited in the wild, and who found them.

Am I affected?

According to HKCERT, affected systems are ChromeOS versions prior to 16836.32.0 (Browser version 156.0.8078.93). If your ChromeOS devices run that version or a later one, they are not in the affected range described by HKCERT. HKCERT’s bulletin does not describe other products or platforms as affected.

What to do now

  1. Check the ChromeOS version on your managed or personal devices and compare it with 16836.32.0 (Browser version 156.0.8078.93).
  2. Apply the fixes issued by the vendor. HKCERT advises visiting the vendor’s website for details before installing and refers to the Chrome Releases stable channel update for ChromeOS.
  3. Restart devices if the update requires it so the new version is active.
  4. Track the vendor post and the NVD pages linked above for per-CVE details, which HKCERT’s bulletin does not provide.

Sources