# CERT-FR flags Chrome multi-vulnerability patch

Published: 2026-10-28 · Severity: routine
Canonical: https://vorant.io/reports/be3055c4-4460-5dc3-b287-530dc9a324f2/cert-fr-flags-chrome-multi-vulnerability-patch
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advises patching Google Chrome before version 156.0.8078.73/74 to fix numerous unspecified security vulnerabilities.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1398

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR (the French national CERT) has issued an advisory summarizing a Google Chrome stable channel security update released on 27 October 2026, covering dozens of vulnerabilities affecting Chrome versions prior to 156.0.8078.73 on Linux and Windows, and prior to 156.0.8078.74 on macOS. Google's own bulletin does not specify the nature or severity of the flaws beyond CVE assignment, so CERT-FR lists the risk as 'non spécifié par l'éditeur' (unspecified by the vendor).

The advisory enumerates over 50 CVE identifiers (CVE-2026-118304 through CVE-2026-118359, with some gaps) associated with this release, none of which are described in detail in the public advisory. No indication of active exploitation in the wild is provided in this bulletin. Defenders should treat this as a standard browser security update and apply patches through normal update channels.

As this is a routine vendor-driven Chrome stable channel update relayed by a national CERT, the recommended action is straightforward: ensure all Chrome installations are updated to the fixed versions as soon as possible via standard patch management processes, consistent with the cadence of regular browser security releases.

## Mentioned in this report

- Vulnerabilities: CVE-2026-118304, CVE-2026-118305, CVE-2026-118306, CVE-2026-118307, CVE-2026-118308, CVE-2026-118309, CVE-2026-118310, CVE-2026-118311, CVE-2026-118312, CVE-2026-118313, CVE-2026-118314, CVE-2026-118315, CVE-2026-118316, CVE-2026-118317, CVE-2026-118318, CVE-2026-118319, CVE-2026-118320, CVE-2026-118321, CVE-2026-118322, CVE-2026-118327, CVE-2026-118328, CVE-2026-118329, CVE-2026-118330, CVE-2026-118331, CVE-2026-118332, CVE-2026-118333, CVE-2026-118334, CVE-2026-118335, CVE-2026-118336, CVE-2026-118337, CVE-2026-118338, CVE-2026-118339, CVE-2026-118340, CVE-2026-118341, CVE-2026-118342, CVE-2026-118343, CVE-2026-118344, CVE-2026-118345, CVE-2026-118346, CVE-2026-118347

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1398

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/be3055c4-4460-5dc3-b287-530dc9a324f2/cert-fr-flags-chrome-multi-vulnerability-patch.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup