CERT-FR flags Chrome multi-vulnerability patch
CERT-FR advises patching Google Chrome before version 156.0.8078.73/74 to fix numerous unspecified security vulnerabilities.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR (the French national CERT) has issued an advisory summarizing a Google Chrome stable channel security update released on 27 October 2026, covering dozens of vulnerabilities affecting Chrome versions prior to 156.0.8078.73 on Linux and Windows, and prior to 156.0.8078.74 on macOS. Google's own bulletin does not specify the nature or severity of the flaws beyond CVE assignment, so CERT-FR lists the risk as 'non spécifié par l'éditeur' (unspecified by the vendor).
The advisory enumerates over 50 CVE identifiers (CVE-2026-118304 through CVE-2026-118359, with some gaps) associated with this release, none of which are described in detail in the public advisory. No indication of active exploitation in the wild is provided in this bulletin. Defenders should treat this as a standard browser security update and apply patches through normal update channels.
As this is a routine vendor-driven Chrome stable channel update relayed by a national CERT, the recommended action is straightforward: ensure all Chrome installations are updated to the fixed versions as soon as possible via standard patch management processes, consistent with the cadence of regular browser security releases.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1398
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs