Google Fixes 3 High-Severity ChromeOS LTS Flaws: Update Now

Google released ChromeOS LTS‑144 version 144.0.7559.261 on August 27, 2026, with fixes for three high-severity security vulnerabilities. Chromebook users and administrators should allow the update to install and restart affected devices. The release is rolling out to most ChromeOS devices on the Long-Term Support channel, so availability may not be simultaneous everywhere.

Google’s announcement identifies the new platform build as 16503.94.0 and lists high-severity issues affecting CORS handling, media memory safety, and validation of untrusted input. Google did not say in the release note that these three vulnerabilities were being actively exploited, so claims of a confirmed zero-day attack would be premature.

What the August 27 ChromeOS LTS update fixes

The official ChromeOS LTS‑144 release announcement highlights these vulnerabilities:

• CVE‑2026‑76033: an inappropriate implementation in CORS, rated High by Google.
• CVE‑2026‑12462: a use-after-free vulnerability in Media, rated High.
• CVE‑2026‑12025: insufficient validation of untrusted input, rated High.

“High” is Google’s Chromium security severity rating. It signals that the issue deserves prompt remediation, but the short release note does not provide a complete exploit scenario for each flaw. Google often restricts detailed bug information until most users have received a fix, reducing the value of those details to attackers during rollout.

Who needs this update?

The named release applies specifically to the ChromeOS Long-Term Support channel. LTS is mainly used on enrolled devices managed by schools, companies, healthcare organizations, public-sector teams, kiosks, and other fleets that prioritize feature stability.

Google explains that LTS devices receive a stable feature set for six months while continuing to get targeted security fixes. It is not the normal channel for most personal Chromebooks. Consumer devices are usually on the Stable channel and may show a different, newer version number.

You should take action if:

• your Chromebook or Chromebox is on LTS‑144;
• you manage ChromeOS devices for a school or organization;
• an update notification is waiting for a restart;
• your device has not restarted recently;
• your organization delays or stages ChromeOS updates.

Do not switch a personal Chromebook from Stable to LTS merely to obtain the number in this article. Install the newest version offered on your device’s assigned channel.

How to update a personal Chromebook

1. Connect the Chromebook to a trusted Wi‑Fi or Ethernet network.
2. Save open work.
3. Select the time at the bottom-right of the screen.
4. Select Settings.
5. At the bottom-left, select About ChromeOS.
6. Under Google ChromeOS, select Check for updates.
7. Allow the update to download.
8. Select Restart when prompted.

ChromeOS normally checks for and downloads updates automatically, but the security fixes do not fully take effect until the device restarts. Google’s official Chromebook update guide confirms that a restart completes installation.

If your device is on LTS‑144, return to About ChromeOS after restarting and check for 144.0.7559.261 or a later approved build. A later build on the same channel should include the fixes. Stable-channel users should simply verify that ChromeOS says it is up to date.

How administrators should deploy the security update

For managed fleets, first identify which organizational units use LTS or LTC and which versions are actually installed. In the Google Admin console, review the ChromeOS update policy under:

Devices → Chrome → Settings → Device settings

Google recommends keeping automatic updates enabled. Administrators can use staged rollout controls to reduce compatibility risk, but a long delay also extends exposure to already disclosed vulnerabilities.

A practical rollout plan

1. Inventory: identify devices still on LTS‑144 builds older than 144.0.7559.261.
2. Pilot: update a small, representative group of devices and test required web apps, extensions, printers, scanners, and kiosk workflows.
3. Expand: deploy to the remaining fleet after the short validation window.
4. Enforce restart: remind users that a downloaded update is not complete until reboot.
5. Verify: check version-compliance reporting and investigate devices that remain behind.

Administrators should not disable auto-updates as a permanent compatibility strategy. Google’s ChromeOS update-management documentation states that LTS devices continue receiving security fixes between larger feature releases.

Why these vulnerability types matter

CORS implementation flaw

Cross-Origin Resource Sharing, or CORS, controls when a website can request resources from another origin. A security implementation error can weaken the browser boundary that normally separates data belonging to different sites.

The release note does not disclose the precise conditions for CVE‑2026‑76033. Users should not try to test it with proof-of-concept pages or untrusted scripts. Updating is the correct response.

Use-after-free in Media

A use-after-free occurs when software continues using memory after that memory has been released. This class of bug can cause crashes and, under some conditions, may be developed into a path for unintended code execution.

That description explains the vulnerability class, not a confirmed outcome for every attack. Google’s note lists CVE‑2026‑12462 as High but does not announce active exploitation.

Insufficient validation of untrusted input

Browsers constantly process untrusted material from websites, downloads, media, and network responses. When input validation is incomplete, specially crafted data may reach code paths that assumed the data was safe.

CVE‑2026‑12025 is also rated High in the LTS update. The practical defense for end users is the patched ChromeOS build, combined with caution around unfamiliar pages and downloads.

What to do while the update is still rolling out

If Check for updates does not offer the new build immediately:

• restart the Chromebook and check again;
• use a stable Wi‑Fi or Ethernet connection;
• keep the device powered and connected long enough to download the update;
• avoid opening unexpected attachments or installing unfamiliar extensions;
• ask the administrator whether a staged rollout or version pin is delaying it;
• verify that the device is still within its Auto Update Expiration period.

Do not download unofficial ChromeOS update packages from third-party websites. ChromeOS updates should arrive through the operating system or an authorized management policy.

Until the patch lands, reduce exposure by limiting browsing to necessary sites and avoiding unsolicited files, media, and links. Our guide to checking whether a browser extension is safe is especially relevant on managed Chromebooks, where a risky extension can access browsing data across many users.

How to check whether your Chromebook still receives updates

1. Open Settings.
2. Select About ChromeOS.
3. Select Additional details.
4. Find the Update schedule section.

Google says this page shows when the device will receive its final automatic update. An end-of-support Chromebook may continue to turn on and browse the web, but it no longer receives the same OS and browser security maintenance.

Some eligible older devices can opt into extended updates, although feature trade-offs may apply. For unsupported devices without an extension path, moving sensitive work to supported hardware is safer than relying indefinitely on an outdated browser.

How this affects ChromeOS Flex

ChromeOS and ChromeOS Flex have related release processes, but a named Chromebook build does not prove that every Flex device has the same version at the same moment. Check About ChromeOS on the specific device and install the latest update offered for its channel.

Organizations running Flex on repurposed hardware should also verify hardware certification and update status. Do not assume that installing a current browser separately replaces an outdated operating-system security layer.

Should schools and businesses wait before deploying?

A short pilot can be reasonable for organizations with critical web apps, kiosk deployments, exams, healthcare workflows, or specialized peripherals. Waiting indefinitely is not.

The balanced approach is to test quickly on representative hardware, review essential apps, then expand the rollout. If a compatibility issue appears, document it and work through official support channels rather than leaving the entire fleet unpatched.

Schools should consider devices used by staff with administrative access first, followed by shared student devices and kiosks. Businesses should prioritize systems handling email, identity administration, customer data, financial tools, or remote access.

Additional protection does not replace the update

A VPN can protect traffic between a device and the VPN server, but it cannot repair a memory-safety or browser-validation flaw. Always‑On VPN is still useful on mobile devices and untrusted networks—our Android Always‑On VPN guide explains the difference—but patching remains essential.

Likewise, phishing awareness helps prevent malicious navigation but cannot guarantee that a trusted-looking page is harmless. Inspect unexpected QR codes and links using the steps in our QR-code safety checklist.

ChromeOS LTS‑144 update checklist

• Install version 144.0.7559.261 or a later approved LTS‑144 build.
• Restart the device to finish installation.
• Verify the installed version under About ChromeOS.
• Keep automatic updates enabled.
• Review managed version pins and staged-rollout policies.
• Check the device’s update-expiration date.
• Do not sideload updates from unofficial websites.
• Continue treating unexpected links, downloads, and extensions cautiously.

Bottom line

Google’s August 27, 2026 ChromeOS LTS update is a meaningful security release for managed Chromebooks and Chromeboxes. It moves LTS‑144 to version 144.0.7559.261 and includes fixes for three highlighted high-severity vulnerabilities: CVE‑2026‑76033, CVE‑2026‑12462, and CVE‑2026‑12025.

There is no need to panic or claim a confirmed active attack that Google has not reported. The correct response is straightforward: check for updates, restart, verify the version, and make sure organizational policies are not leaving devices behind.