Chrome 155 fixes four critical security vulnerabilities
Google's October 6 Stable update fixes four critical flaws, all of them are use-after-free issues. The release notice does not say they are being exploited.
155.0.8059.39 for Linux and 155.0.8059.39/.40 for Windows and Mac over the coming days and weeks. The October 6 release notice lists 247 security fixes and four Critical CVEs. Google says some vulnerability details may remain restricted while users receive the update; the public record describes CVE-2026-106197 as a Browser use-after-free with potential code execution outside the sandbox. No exploit-in-the-wild claim appears in Google's notice.| CVE | Chrome component | CVE-recorded impact and source |
|---|---|---|
CVE-2026-106382 | Chromecast | Chrome CNA: crafted HTML could let a remote attacker execute code outside the sandbox; user interaction required. CVE record. |
CVE-2026-106197 | Browser | Chrome CNA: crafted HTML could let a remote attacker execute code outside the sandbox; user interaction required. CVE record. |
CVE-2026-106358 | Navigation | Chrome CNA: crafted HTML could let a remote attacker execute code outside the sandbox; user interaction required. CVE record. |
CVE-2026-106347 | Track | Chrome CNA: crafted HTML could let a remote attacker execute code inside the sandbox; user interaction required. CVE record. |
The four Chrome-assigned CVE records identify CWE-416 and affected versions before 155.0.8059.39. Each describes a remote attacker using a crafted HTML page and requires user interaction. The records distinguish the sandbox boundary: three say outside the sandbox; CVE-2026-106347 says inside. Google labels all four Critical in its release notice; CISA ADP separately lists CVE-2026-106347 at CVSS 3.1 8.8 High, so keep the rating source clear.
Verify the Chrome desktop update
Use Menu → Help → About Google Chrome to trigger an update check, then relaunch the browser. Confirm the installed version is 155.0.8059.39 or later on Linux, or 155.0.8059.39/.40 or later on Windows and Mac. Google says the rollout can take days or weeks, so check managed-device reporting after the update window. The public release notice provides no root-cause code or patch diff; this page does not infer one from the CVE titles.