# CERT-FR Flags Multiple Chrome Vulnerabilities

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/1931bb71-f380-5573-a486-0d7e99a4b994/cert-fr-flags-multiple-chrome-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advises patching Google Chrome due to numerous unspecified vulnerabilities fixed in versions 157.0.8103.78/79 and Extended Stable 156.0.8078.100.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1498

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR issued an advisory summarizing a Google Chrome stable channel security update addressing a large number of vulnerabilities (over 80 CVEs referenced). The vendor bulletin does not specify the exact nature of the security impact for each flaw, but CERT-FR notes that exploitation could allow an attacker to trigger an unspecified security issue, which in the context of browser vulnerabilities typically encompasses memory corruption, sandbox escape, or information disclosure risks.

Affected systems include Chrome Extended Stable prior to version 156.0.8078.100 for Windows and Mac, and standard Chrome channel prior to 157.0.8103.78 for Windows/Linux and 157.0.8103.79 for Mac. No in-the-wild exploitation is indicated in this advisory. Defenders should apply the vendor's update through normal browser update mechanisms as soon as possible, consistent with standard Chrome patch cadence, and verify managed/enterprise Chrome deployments are updated to the fixed versions referenced in Google's stable and extended-stable channel release blogs dated 11 November 2026.

## Mentioned in this report

- Vulnerabilities: CVE-2026-126840, CVE-2026-126841, CVE-2026-126842, CVE-2026-126843, CVE-2026-126844, CVE-2026-126845, CVE-2026-126846, CVE-2026-126847, CVE-2026-126848, CVE-2026-126849, CVE-2026-126850, CVE-2026-126851, CVE-2026-126852, CVE-2026-126853, CVE-2026-126854, CVE-2026-126855, CVE-2026-126856, CVE-2026-126857, CVE-2026-126858, CVE-2026-126859, CVE-2026-126860, CVE-2026-126861, CVE-2026-126862, CVE-2026-126863, CVE-2026-126864, CVE-2026-126865, CVE-2026-126866, CVE-2026-126867, CVE-2026-126868, CVE-2026-126869, CVE-2026-126870, CVE-2026-126871, CVE-2026-126872, CVE-2026-126873, CVE-2026-126874, CVE-2026-126875, CVE-2026-126876, CVE-2026-126877, CVE-2026-126878, CVE-2026-126879

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1498

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1931bb71-f380-5573-a486-0d7e99a4b994/cert-fr-flags-multiple-chrome-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup