CERT-FR: Chrome 156 and Edge 156 security updates fix about 20 and 25 vulnerabilities, no exploitation reported
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 07/11/2026 00:00; os links antigos trazem para cá.
Fontes: cert.cyber.gouv.fr ×2 ↗
The French CERT-FR published two advisories on Chromium-based browsers. The first, CERTFR-2026-AVI-1422 (cert.cyber.gouv.fr), covers Google Chrome and is based on the Google stable channel bulletin of 29 October 2026. The second, CERTFR-2026-AVI-1466 (cert.cyber.gouv.fr), published on 5 November 2026, relays Microsoft bulletins of 4 November 2026 for Microsoft Edge, which affect 25 CVEs. Both advisories say that updated versions fix the flaws: Chrome 156.0.8078.79/80 and Edge 156.0.4314.58. Neither advisory gives CVSS scores, technical details or any mention of exploitation in the wild. CERT-FR describes the impact for Chrome only as an unspecified security issue. For Edge it adds a breach of data confidentiality. The Chrome CVE count in the advisory does not match its own CVE ranges (see Conflicting Reports).
Entenda a falha
A vulnerabilidade
CERT-FR published two advisories on Chromium-based browsers. CERTFR-2026-AVI-1422 covers Google Chrome before 156.0.8078.79 on Linux and Windows and before 156.0.8078.80 on Mac, with CVE-2026-119260 to CVE-2026-119272 and CVE-2026-76024 to CVE-2026-76031. CERTFR-2026-AVI-1466 covers Microsoft Edge before 156.0.4314.58 with 25 CVEs, which also include CVE-2026-118309, CVE-2026-118314, CVE-2026-118321 and CVE-2026-122518. The impact is unspecified for Chrome. For Edge it is a breach of data confidentiality plus an unspecified security issue. The advisories give no CVSS scores, bug classes, components or prerequisites, so the CVEs cannot be ranked by severity. The fixed versions are the ones named above.
Como foi descoberta
The CERT-FR advisories say only that multiple vulnerabilities were discovered in Chrome and in Edge, without naming who found them or how they were reported. The Chrome advisory is based on the Google stable channel bulletin of 29 October 2026. The Edge advisory relays Microsoft bulletins of 4 November 2026, and CERT-FR published it on 5 November 2026. Neither advisory mentions exploitation in the wild. The Chrome advisory states 20 CVEs, but its ranges add up to 21 identifiers, so the Google bulletin should be checked for the authoritative list.
Explicação gerada por IA a partir da matéria e dos artigos, em 07/11/2026 00:15.
Detalhes técnicos
- Chrome (CERTFR-2026-AVI-1422): versions prior to 156.0.8078.79 on Linux and Windows, and prior to 156.0.8078.80 on Mac, are affected. The impact is unspecified by the vendor. The CVEs referenced are CVE-2026-119260 to CVE-2026-119272 and CVE-2026-76024 to CVE-2026-76031 (cert.cyber.gouv.fr).
- Microsoft Edge (CERTFR-2026-AVI-1466): versions before 156.0.4314.58 are affected. There are 25 CVEs, linked to the MSRC Update Guide entries. The page does not describe bug classes or components. The impact is given as a breach of data confidentiality plus an unspecified security issue, with no prerequisites stated (cert.cyber.gouv.fr).
- The sources do not say whether the Edge CVEs overlap with the Chrome CVEs, and they do not report exploitation in the wild for either browser.
Remediação
- Update Chrome to 156.0.8078.79 or later on Linux and Windows, and to 156.0.8078.80 or later on Mac, as described in the Google Chrome security bulletin of 29 October 2026 (cert.cyber.gouv.fr).
- Update Microsoft Edge to 156.0.4314.58 or later. CERT-FR refers readers to the Microsoft security bulletins for the fixes (cert.cyber.gouv.fr).
Relatos divergentes
- The Chrome advisory (cert.cyber.gouv.fr) states 20 CVEs, but the ranges it lists (CVE-2026-119260 to CVE-2026-119272 and CVE-2026-76024 to CVE-2026-76031) add up to 21 identifiers. The sources do not resolve this. Check the Google bulletin of 29 October 2026 for the authoritative list.
Linha do tempo
-
CERT-FR: 25 vulnerabilities in Microsoft Edge fixed in version 156.0.4314.58 (Microsoft bulletins of 4 November 2026)
ler a análise desta fonte ocultar
The CERT-FR advisory CERTFR-2026-AVI-1466 relays Microsoft security bulletins dated 4 November 2026 for Microsoft Edge. It covers 25 CVEs affecting Edge versions before 156.0.4314.58. CERT-FR says the flaws let an attacker breach data confidentiality and cause a security issue the vendor did not specify. The advisory gives no CVSS scores, no technical detail, no prerequisites and no mention of exploitation in the wild.
Technical Details
The CERT-FR page lists the CVEs and links to the MSRC Update Guide entries, but it does not describe the bug classes or components. The impact is given only as "atteinte à la confidentialité des données" and an unspecified security issue.
Remediation
Update Microsoft Edge to 156.0.4314.58 or later. CERT-FR refers readers to the Microsoft bulletins (msrc.microsoft.com) for the fixes.
-
CERT-FR: Multiple vulnerabilities in Google Chrome fixed in 156.0.8078.79/80 (20 CVEs)
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1422 on multiple vulnerabilities in Google Chrome, based on the Google stable channel bulletin of 29 October 2026. The advisory says the flaws allow an attacker to cause a security issue that the vendor has not specified. It lists 20 CVEs, from CVE-2026-119260 to CVE-2026-119272 and from CVE-2026-76024 to CVE-2026-76031. It gives no CVSS scores, no technical details and no mention of exploitation in the wild.
Technical Details
- Affected: Chrome versions prior to 156.0.8078.79 on Linux and Windows, and prior to 156.0.8078.80 on Mac.
- Impact: not specified by the vendor.
- CVEs referenced: CVE-2026-119260 to CVE-2026-119272 and CVE-2026-76024 to CVE-2026-76031.
Remediation
- Update Chrome to 156.0.8078.79 or later on Linux and Windows, and to 156.0.8078.80 or later on Mac, as described in the Google Chrome security bulletin of 29 October 2026.