Key points
- Chrome 155.0.8059.39/.40 updates Windows, Mac, and Linux.
- Four critical use-after-free vulnerabilities are patched.
- Additional high-severity flaws in SiteIsolation and Core are fixed.
Google has released a security update for the Chrome Stable channel, addressing 24 identified security vulnerabilities. The update, version 155.0.8059.39 for Linux and 155.0.8059.39/.40 for Windows and Mac, is currently rolling out to users over the coming days and weeks. This release is critical for system administrators managing desktop environments, as it resolves four critical memory safety issues that could allow remote code execution.
The most severe flaws in this update are classified as critical. These include CVE-2026-106382, a use-after-free bug in Chromecast reported by Google; CVE-2026-106197, a use-after-free error in the Browser component reported by Xinyang Ge; CVE-2026-106358, a use-after-free issue in Navigation reported by Xinyang Ge with assistance from Claude; and CVE-2026-106347, a use-after-free flaw in Track, also reported by Xinyang Ge with AI assistance. These memory corruption bugs pose significant risks if exploited by malicious websites or downloads.
Security Context and Severity
Beyond the critical memory safety issues, the update includes several high-severity fixes. CVE-2026-102322 addresses incorrect authorization in SiteIsolation, reported by Avadhut Mahamuni. This flaw could potentially allow attackers to bypass sandboxing mechanisms. Other high-severity patches include CVE-2026-106245, an uninitialized resource in ANGLE reported by JonathanBouman, and CVE-2026-106327, an incorrect authorization issue in Core reported by OGINOME Tomohito. Each of these high-severity bugs carries a reward of $2,000, indicating their potential impact on user security.
Google notes that access to detailed bug information may remain restricted until a majority of users have updated. This restriction also applies if the bug exists in a third-party library used by other projects that have not yet applied fixes. This policy aims to prevent widespread exploitation before patches are widely deployed.
Who Is Affected
This update applies to desktop users on Windows, Mac, and Linux running the Chrome Stable channel. Organizations relying on Chrome for enterprise operations should prioritize this update due to the presence of critical use-after-free vulnerabilities. The Extended Stable channel has also seen an update to version 152.0.7977.158 for Windows and Mac, though the detailed security fixes for that specific build are not listed in the current advisory summary provided. Early Stable releases for version 156 are also being tested with a small percentage of users.
Next steps
System administrators should verify that their managed Chrome installations are receiving the 155.0.8059 update. For those on the Extended Stable channel, ensure devices are updated to 152.0.7977.158. Users can check their current version by navigating to the Chrome menu and selecting "About Chrome." If a new issue is discovered after updating, Google encourages users to file a bug report or seek assistance via the community help forum.
What to do and how to stay safe: Google Chrome
- Verify patch signatures before installation to prevent supply chain attacks.
- Test patches in an isolated environment that mirrors production dependencies.
- Maintain a documented rollback procedure for every emergency deployment.
Emergency patching requires verification, testing, and controlled rollout to avoid introducing new failures. Always maintain a tested rollback plan before applying any critical update.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the new version number for Chrome Stable?
The Stable channel has been updated to 155.0.8059.39 for Linux and 155.0.8059.39/.40 for Windows and Mac.
How many critical vulnerabilities are fixed in this update?
This update fixes four critical use-after-free vulnerabilities in Chrome components including Browser, Navigation, Track, and Chromecast.
Are there any high-severity fixes in this release?
Yes, the update includes high-severity fixes for incorrect authorization in SiteIsolation and Core, as well as an uninitialized resource in ANGLE.
