Google announced the availability of Chrome version 155, a security‑focused release that addresses a total of 247 vulnerabilities. Among the fixes are four flaws classified as Critical, all of which have been resolved before any known exploitation. The update is being distributed to users of Windows, macOS and Linux, with rollout expected to continue over the next several days and weeks.
Critical Use‑After‑Free Bugs and Their Scope
The four Critical vulnerabilities share a common technical characteristic: they are all “use‑after‑free” bugs. In a use‑after‑free scenario, a program continues to reference memory that has already been released, creating an opportunity for crashes, memory corruption, or the execution of malicious code. Google’s release notes identify the specific components affected by each bug: a Chromecast‑related issue (CVE‑2026‑106382), a generic browser flaw (CVE‑2026‑106197), a navigation‑related problem (CVE‑2026‑106358) and a tracking‑module defect (CVE‑2026‑106347). The first of these was discovered internally by Google, while the remaining three were reported by Xinyang Ge, a technical staff member at Anthropic, who also uncovered more than ten additional High‑severity flaws.
Beyond the Critical category, Chrome 155 resolves 53 High‑severity, 122 Medium‑severity and 68 Low‑severity vulnerabilities. The comprehensive nature of the patch set reflects Google’s ongoing effort to harden the browser against a broad spectrum of attack vectors, ranging from privilege escalation to information leakage.
Recent Threat Landscape and Historical Context
Google has not indicated that any of the four Critical bugs have been weaponised in the wild, but the broader threat environment for Chrome remains active. Earlier in the year, the company addressed a critical vulnerability in Pixel smartphones (CVE‑2026‑58704) that enabled remote, zero‑click access to devices. In September, Google also patched CVE‑2026‑85046, a flaw in the V8 JavaScript engine that was already being exploited, marking the sixth known Chrome zero‑day used by attackers that year. Subsequent reports suggested a seventh exploit surfaced shortly thereafter.
A September campaign highlighted the practical risk of such flaws. Four espionage groups employed the BlueMoon exploit kit to chain together Chrome and Windows zero‑day vulnerabilities, targeting organisations in the United States and Southeast Asia. While the current Chrome 155 release does not appear to be linked to active exploitation, the historical pattern underscores the importance of timely patch deployment.
Chrome 155 follows a significant update released only weeks earlier. Chrome 154 addressed 108 vulnerabilities, including 11 classified as Critical. By contrast, the new release more than doubles the total number of fixes, though a higher count does not automatically translate to a more dangerous release. The real risk associated with each flaw depends on factors such as exploit complexity, user exposure and whether threat actors are actively leveraging the vulnerability.
For end users and enterprise administrators, the update process remains largely automated. Chrome typically checks for and applies updates in the background, but a browser restart is required for the new version to become active. In managed environments, IT teams can control rollout timing through standard update policies. The version numbers to look for are 155.0.8059.39 or 155.0.8059.40 on Windows and macOS, and 155.0.8059.39 on Linux. Users can verify their current version by opening Chrome, selecting the menu, and navigating to Help → About Google Chrome, where the browser will initiate any pending update and prompt for a restart if needed.
Security professionals are advised to confirm that the Chrome 155 patches have reached all corporate devices, especially given the large volume of fixes and the ongoing prevalence of Chrome‑targeted attacks. While the sheer number of addressed flaws signals a robust response, each vulnerability’s severity rating provides guidance on prioritisation. Critical use‑after‑free bugs, for instance, demand immediate attention because of their potential to enable arbitrary code execution if left unpatched.
Overall, Chrome 155 represents Google’s most extensive security effort for the browser to date in 2026, aiming to close gaps across a wide range of components and to stay ahead of a threat landscape that has repeatedly demonstrated interest in Chrome’s code base. Users who keep their browsers up to date will benefit from the strengthened defenses, while organisations should continue to monitor patch compliance as part of broader cybersecurity hygiene.
Be First to Comment