Google Chrome Stable Update Fixes 24 Security Flaws, Including Four Critical Use-After-Free Bugs
The latest Chrome desktop update addresses 24 vulnerabilities, including critical use-after-free errors in the Browser, Navigation, and Track components.
Key points
- Google released Chrome 155.0.8059.39/40 for Windows, Mac, and Linux with 24 security fixes.
- Four critical CVEs were patched, including CVE-2026-106382 in Chromecast and CVE-2026-106197 in the Browser.
- Researchers Xinyang Ge and others reported the critical flaws, with some assisted by AI tools.
Google has released a stable channel update for Chrome on Windows, Mac, and Linux that patches 24 security vulnerabilities. The update, version 155.0.8059.39 for Linux and 155.0.8059.39/.40 for Windows and Mac, is currently rolling out to users over the coming days and weeks.
At a glance
- Publisher
- Google Chrome Releases
- CVEs
- See advisory
The release includes four critical severity fixes and several high-severity patches. The critical vulnerabilities are all use-after-free errors located in different components of the browser. CVE-2026-106382 affects Chromecast, while CVE-2026-106197 is in the Browser component. Two other critical flaws, CVE-2026-106358 and CVE-2026-106347, were found in the Navigation and Track components, respectively.
Context and Background
The critical flaws were reported by security researchers between July and September 2026. Google reported the Chromecast vulnerability (CVE-2026-106382) on July 15, 2026. Xinyang Ge reported the Browser vulnerability (CVE-2026-106197) on September 11, 2026.
Notably, the reports for the Navigation and Track vulnerabilities involved assistance from artificial intelligence tools. Xinyang Ge, affiliated with Anthropic, reported CVE-2026-106358 on September 28, 2026, and CVE-2026-106347 on September 30, 2026, with both reports noting assistance from Claude.
In addition to the critical fixes, the update addresses several high-severity issues. These include incorrect authorization flaws in SiteIsolation (CVE-2026-102322) and Core (CVE-2026-106327), as well as an uninitialized resource in ANGLE (CVE-2026-106245). These high-severity bugs were reported by Avadhut Mahamuni, JonathanBouman, and OGINOME Tomohito between June and August 2026.
Who is affected
The update targets desktop users of Chrome on Windows, Mac, and Linux. Google’s advisory notes that access to detailed bug information may remain restricted until a majority of users have updated their browsers. Restrictions may also remain in place if the underlying bug exists in a third-party library that other projects depend on but have not yet fixed.
Separately, Google has updated the Extended Stable channel to version 152.0.7977.158 for Windows and Mac. This channel is designed for users who require longer-term stability. Additionally, an early stable release (version 156.0.8078.12/.13) has been rolled out to a small percentage of Windows and Mac users to test future changes before wider distribution.
What should you do?
Users should update their Chrome browsers to the latest stable version to mitigate these risks. The update is rolling out automatically, but users can manually check for updates within the browser settings. Google advises that if users encounter new issues after updating, they should file a bug report or seek assistance through the community help forum.
What to do and how to stay safe: Google Chrome
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many security fixes are in the latest Chrome stable update?
The latest stable update for Chrome includes 24 security fixes, comprising four critical and several high-severity vulnerabilities.
Which critical vulnerabilities were fixed in this release?
The release fixes CVE-2026-106382 (Chromecast), CVE-2026-106197 (Browser), CVE-2026-106358 (Navigation), and CVE-2026-106347 (Track).
Did AI assist in reporting any of these vulnerabilities?
Yes, the reports for CVE-2026-106358 and CVE-2026-106347 were submitted by Xinyang Ge with assistance from Claude.
