ChromeOS 16805.33.0 fixes 106 Chrome bugs, five of them Critical

ChromeOS 16805.33.0 fixes 106 Chrome bugs, five of them Critical

9 October 2026: Google has moved the ChromeOS and ChromeOS Flex Stable channel to OS version 16805.33.0, built on Chrome 154.0.8037.151, and the release post lists 106 security fixes in the browser. Counting the list, 5 are rated Critical, 44 High, 37 Medium and 20 Low. The post does not say that any of them is being exploited.

Not yet independently verified. The counts are ours, taken from the list in Google's post, which repeats the same list twice on the page. Google shows a reward for 11 of the 106 browser fixes, marks the other 95 as to be decided, and gives no exploitation status for any fix. We will update this when it can be confirmed, and remove this note.

Five Critical bugs, four of them use-after-free

Four of the five Critical entries are use-after-free flaws. CVE-2026-95310 sits in AdFilter and CVE-2026-95356 in WindowDialog; the post credits Xinyang Ge for both, with report dates of 15 and 12 September. CVE-2026-95313, in Fullscreen, is credited to WinD39 (Huynh Dinh Vu) and was reported on 26 August. CVE-2026-95339, in ServiceWorker, was reported on 18 August and is one of the few entries that already has a reward attached: $2,500.

The fifth Critical flaw is not a use-after-free but an out-of-bounds write in WebGL, CVE-2026-103628, reported on 20 August.

Ten High flaws in the V8 engine

The High group is led by V8, the JavaScript engine, which appears ten times: seven type confusions, one out-of-bounds write, one buffer overflow and one race condition. Most of the rest are memory-safety faults in components every Chromebook runs. Views has four use-after-free entries, the GPU stack has three uninitialised-resource entries, Bluetooth has two use-after-free entries, and single entries cover WebAudio, PDFium, HID, FedCM, Chromecast, DevTools and Aura. The High list also holds a cross-site scripting flaw in WebUI and a missing-authorisation flaw in Extensions.

Two third-party fixes outside the browser

Apart from the Chrome list, the post names two High fixes from third parties. The first is a use-after-free write in the mali_kbase GPU driver, in delete_hoarded_chunks, which lets code in the GPU process corrupt kernel memory. The second is a StartArcVm field, wayland_server, that was not validated and could weaken the crosvm sandbox, the virtual machine boundary behind Android apps on Chromebooks.

Android security fixes are not itemised; the post gives them a separate link.

Eleven rewards named, ninety-five still to be decided

The post's section for bugs found through the ChromeOS Vulnerability Rewards Program reads N/A for this release. In the browser list, 11 of the 106 entries show a reward, worth $20,500 together, and the other 95 show $TBD. The two largest are $5,000 each, for missing authorisation in Extensions (CVE-2026-95301) and cross-site scripting in WebUI (CVE-2026-102329). A use-after-free in WebAudio, reported by HoneyBee on 10 September, earned $1,000. Report dates run back as far as 10 June 2025, for a Low-rated ExtensionsMenu bug that earned $500.

Getting managed fleets onto the build

The post says the update is for most ChromeOS devices. It gives no device list and does not mention the long-term support or Extended Stable channels, so a fleet pinned to either should read its own channel's notes rather than assume this build applies.

For administrators the questions are practical ones. Check that the auto-update policy lets devices take Stable releases, that no pinned target version holds managed Chromebooks and Flex machines below 16805.33.0, and that devices have been restarted, since an update only applies after a reboot. Schools with carts of devices that rarely restart are the likeliest to lag.

Our mobile device management software category lists eight products for managing fleets like these.

Google dated the post 9 October 2026 and signed it Alon Bajayo, Google ChromeOS.

Company profile on TrustList: Google

Related on TrustList:

• Google stops paying bounties for flaws in Go, Angular and other OSS
• Seven countries tie old exploited flaws to China's Integrity Tech
• SonicWall SMA1000 CVSS 10 flaw now seeing exploitation attempts

Sources

• Chrome Releases: Stable Channel Update for ChromeOS / ChromeOS Flex, 9 October 2026