Key points
- Four critical use-after-free vulnerabilities are patched in Chrome 155.
- Affected components include Chromecast, Browser, Navigation, and Track.
- The update also fixes twenty high-severity issues including authorization flaws.
Google has released Chrome 155.0.8059.39 for Windows, Mac, and Linux to address twenty-four security vulnerabilities. The update includes four critical use-after-free bugs and twenty high-severity fixes, with the Extended Stable channel also receiving an update to version 152.0.7977.158 for Windows and Mac.
What happened
The Stable channel update for desktop platforms resolves four critical use-after-free vulnerabilities, which can potentially allow an attacker to execute arbitrary code. According to the advisory, CVE-2026-106382 affects Chromecast functionality, while CVE-2026-106197 impacts the Browser component. The remaining two critical flaws, CVE-2026-106358 and CVE-2026-106347, reside in the Navigation and Track components respectively. All four critical issues were reported by researcher Xinyang Ge, with some reports assisted by Claude from Anthropic.
In addition to the critical memory safety issues, the patch addresses twenty high-severity vulnerabilities. These include incorrect authorisation flaws in Site Isolation and Core components, as well as an uninitialised resource issue in ANGLE. The advisory notes that access to specific bug details may remain restricted until a majority of users have updated, particularly if the vulnerabilities exist in third-party libraries shared by other projects.
Why it matters
Use-after-free vulnerabilities are significant because they allow attackers to manipulate memory after it has been freed, potentially leading to remote code execution. For security operations teams, the presence of four critical flaws in a single release highlights the ongoing complexity of browser security. The involvement of AI assistance in discovering some of these bugs suggests a shifting landscape in vulnerability research. The high-severity authorisation issues in Site Isolation are also notable, as they could potentially allow attackers to bypass sandboxing mechanisms.
What happens next
Organisations should prioritise deploying Chrome 155.0.8059.39 across their Windows, Mac, and Linux fleets. Administrators should verify that the Extended Stable channel has also been updated to 152.0.7977.158 where applicable. Monitoring for any further advisories regarding the third-party library restrictions mentioned in the release notes is advisable.
Background: Sandboxing
Sandboxing is a security technique that runs untrusted software in an isolated, restricted environment. It prevents malicious code from accessing real data or system resources. By observing behaviour rather than just signatures, it detects new threats that traditional scanners miss, offering a critical layer of defence against unknown malware.
Read the full guide: Sandboxing: How Isolated Execution Stops Malware Before It Runs
What to do and how to stay safe: Google Chrome
- Verify that all endpoints have successfully installed Chrome 155.0.8059.39 or the latest available build.
- Review endpoint logs for any signs of exploitation attempts targeting the affected components before the patch is applied.
- Ensure that browser extension policies are up to date to minimise the attack surface associated with third-party code.
- Monitor vendor announcements for any updates regarding the restricted bug details or third-party library fixes.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritise Fixes That Matter
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Chrome versions are affected by the four critical use-after-free vulnerabilities?
Versions prior to 155.0.8059.39 on Windows, Mac, and Linux are affected.
Are there any critical vulnerabilities in the Extended Stable channel?
The source material does not specify critical vulnerabilities for the Extended Stable update to 152.0.7977.158.
Who reported the critical use-after-free bugs in this update?
All four critical bugs were reported by Xinyang Ge, with some assistance from Claude.
