EN PT-BR
← Voltar ao feed
high

CERT-FR flags 200+ Chrome 156 and 110 Edge 156 vulnerabilities with overlapping CVE ranges; no exploitation reported

2 fonte(s) · 2 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 6 dias

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 27/10/2026 00:00; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ cert.ssi.gouv.fr ↗

The French CERT-FR published two advisories on the same wave of browser vulnerabilities. Advisory CERTFR-2026-AVI-1357 (21 October 2026) covers Google Chrome and relies on the Google stable channel bulletin of 20 October 2026. It lists CVE-2026-112992 through CVE-2026-113201, though the list is truncated in the source text (cert.ssi.gouv.fr). Advisory CERTFR-2026-AVI-1371 (23 October 2026) covers Microsoft Edge versions before 156.0.4314.42. It lists 110 CVEs (CVE-2026-112992 to CVE-2026-113101), each tied to a Microsoft security bulletin dated 22 October 2026 (cert.cyber.gouv.fr). For both browsers, the vendors do not specify the impact. CERT-FR only says an attacker could cause an unspecified security problem. Neither source mentions active exploitation, attribution, proof-of-concept code or CVSS scores.

Entenda a falha

A vulnerabilidade

CERT-FR reports two overlapping waves of browser flaws. Advisory CERTFR-2026-AVI-1357 covers Google Chrome, listing CVE-2026-112992 through CVE-2026-113201 (over 200 CVEs, though the source list is truncated). Affected versions are Chrome earlier than 156.0.8078.47 on Windows and Linux and earlier than 156.0.8078.48 on Mac. Advisory CERTFR-2026-AVI-1371 covers Microsoft Edge earlier than 156.0.4314.42, with 110 CVEs (CVE-2026-112992 to CVE-2026-113101). The vendors do not specify the component, flaw class, attack conditions or impact; CERT-FR says only that an attacker could cause an unspecified security problem. No CVSS scores are given, so no CVE can be ranked by severity. Fixes are Chrome 156.0.8078.47/.48 and Edge 156.0.4314.42 or later.

Como foi descoberta

The articles do not say who found these flaws or how. CERT-FR published the Chrome advisory on 21 October 2026, relying on the Google Chrome stable channel bulletin of 20 October 2026. It published the Edge advisory on 23 October 2026, pointing to one Microsoft MSRC bulletin per CVE, each dated 22 October 2026. The story reports no active exploitation or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 00:15.

Detalhes técnicos

  • Chrome (cert.ssi.gouv.fr): affected versions are earlier than 156.0.8078.47 on Windows and Linux, and earlier than 156.0.8078.48 on Mac.
  • Microsoft Edge (cert.cyber.gouv.fr): affected versions are earlier than 156.0.4314.42. Each CVE links to its own MSRC update-guide entry dated 22 October 2026.
  • The Edge CVE range (CVE-2026-112992 to CVE-2026-113101) starts at the same identifier as the Chrome range (CVE-2026-112992 to CVE-2026-113201). The Chrome range is wider, at over 200 CVEs against 110 for Edge.
  • Vulnerability classes, severities and CVSS scores are not stated in either advisory.

Remediação

  • Update Chrome to 156.0.8078.47 (Windows, Linux) or 156.0.8078.48 (Mac), or later (cert.ssi.gouv.fr).
  • Update Microsoft Edge to 156.0.4314.42 or later (cert.cyber.gouv.fr).
  • Refer to the Google Chrome security bulletin of 20 October 2026 and the Microsoft security bulletins of 22 October 2026 for the patches.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 22/10/2026 21:00 · coletado 26/10 14:01

    CERT-FR flags 110 vulnerabilities in Microsoft Edge fixed in version 156.0.4314.42

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1371 on multiple vulnerabilities in Microsoft Edge, affecting versions earlier than 156.0.4314.42. The advisory lists 110 CVEs (CVE-2026-112992 to CVE-2026-113101), each tied to a Microsoft security bulletin dated 22 October 2026. The vendor does not specify the impact, and the advisory only says an attacker could cause an unspecified security problem. It reports no active exploitation and gives no CVSS scores or per-CVE details.

    Technical Details

    • Affected product: Microsoft Edge versions before 156.0.4314.42.
    • Impact: unspecified by the vendor.
    • Each CVE links to its own MSRC update-guide entry, dated 22 October 2026.

    Remediation

    • Update Microsoft Edge to version 156.0.4314.42 or later, following the Microsoft security bulletins as CERT-FR directs.
  2. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR flags over 200 vulnerabilities fixed in Google Chrome 156 for Windows, Linux and Mac

    ler a análise desta fonte

    The French CERT-FR published advisory CERTFR-2026-AVI-1357 on 21 October 2026 on multiple vulnerabilities in Google Chrome. The advisory relies on the Google stable channel bulletin of 20 October 2026 and lists CVE-2026-112992 through CVE-2026-113201 (the list is truncated in the source text). The vendor does not specify the impact, and CERT-FR only says an attacker could cause an unspecified security problem. The article does not mention active exploitation, attribution or proof-of-concept code.

    Technical Details

    • Affected: Chrome versions earlier than 156.0.8078.47 on Windows and Linux.
    • Affected: Chrome versions earlier than 156.0.8078.48 on Mac.
    • The vulnerability classes, severities and CVSS scores are not stated in the article.

    Remediation

    • Update Chrome to 156.0.8078.47 (Windows, Linux) or 156.0.8078.48 (Mac) or later.
    • Refer to the Google Chrome security bulletin of 20 October 2026 for the patches.