Google Ships Chrome 155.0.8059.39 Patching 4 Critical Use-After-Free Bugs Across Windows, Mac, Linux

Google has released a stable update for Chrome on desktop platforms, addressing a batch of security vulnerabilities that could allow attackers to compromise user systems. The new version, 155.0.8059.39 for Linux and 155.0.8059.39/.40 for Windows and Mac, includes fixes for 24 distinct security flaws. Among these are four rated as critical severity, all stemming from use-after-free errors in different parts of the browser’s architecture.

In plain English

A use-after-free vulnerability occurs when a program tries to access memory that has already been freed or deleted. In the context of a web browser, this can allow an attacker to execute arbitrary code by tricking the browser into processing malicious data. This update targets four specific instances of this error type. One critical flaw, CVE-2026-106382, exists in Chromecast functionality. Another, CVE-2026-106197, is located in the Browser component itself. The third critical issue, CVE-2026-106358, affects Navigation, while the fourth, CVE-2026-106347, is found in the Track component.

In addition to the critical bugs, the patch resolves three high-severity issues. These include incorrect authorization flaws in SiteIsolation (CVE-2026-102322) and Core (CVE-2026-106327), as well as an uninitialized resource issue in ANGLE (CVE-2026-106245). ANGLE is a library that translates OpenGL ES calls to DirectX, Metal, or Vulkan, meaning this flaw could potentially impact graphics rendering security.

The background

The vulnerabilities were reported by various security researchers and organizations over several months. Xinyang Ge, associated with Anthropic and assisted by Claude, reported three of the critical use-after-free bugs in late September 2026. Google reported the Chromecast flaw in July 2026. Other researchers, including Avadhut Mahamuni, JonathanBouman, and OGINOME Tomohito, contributed to identifying the high-severity authorization and resource issues between June and August 2026.

Google’s official advisory notes that access to detailed bug information may remain restricted until a majority of users have updated their browsers. This restriction also applies if the vulnerability exists in a third-party library used by other projects that have not yet issued their own fixes.

What changes now

The update is currently rolling out to users over the coming days and weeks. Organizations managing Chrome deployments should verify that their endpoints are receiving version 155.0.8059.39 or higher. For users on the Extended Stable channel, a separate update to version 152.0.7977.158 is also available for Windows and Mac. Additionally, a small percentage of users are receiving an early stable release of version 156.0.8078.12/.13, though this is distinct from the main security patch cycle for version 155.

What to do and how to stay safe: Google Chrome

• Verify that your Chrome browser is updated to version 155.0.8059.39 or later by checking the "About Chrome" section in settings.
• Review network logs for any unusual outbound traffic from endpoints running older Chrome versions, particularly those interacting with Chromecast or complex web applications.
• Ensure that endpoint protection policies enforce automatic updates for Chrome to prevent exposure to known critical vulnerabilities.
• Monitor internal security dashboards for any attempts to exploit use-after-free conditions or authorization bypasses in browser components.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which operating systems are affected by this Chrome update?

The update applies to Windows, Mac, and Linux desktop environments.

Are there any critical vulnerabilities in this release?

Yes, there are four critical use-after-free vulnerabilities fixed in this update.

Who reported the security flaws addressed in Chrome 155?

The flaws were reported by Google, Xinyang Ge (Anthropic), Avadhut Mahamuni, JonathanBouman, and OGINOME Tomohito.