Chrome 155 Update Patches 247 Vulnerabilities

What it is

Chrome 155 is a security release from Google, rolled out on a Tuesday in October 2026, that fixes 247 vulnerabilities. Four are critical use-after-free bugs: CVE-2026-106382, CVE-2026-106197, CVE-2026-106358 and CVE-2026-106347. Google found one of the four. Xinyang Ge reported the other three and used AI to identify two of the defects.

Preconditions / Affected

The fixed builds differ by platform:

• Windows and macOS: 155.0.8059.39/.40
• Linux: 155.0.8059.39 only

Google's advisory does not say any of the bugs were exploited in the wild.

What to do

Update Chrome to the build above for your platform. The advisory gives no workaround or detection guidance, so patching is the only stated action.

Breakdown of the fixes

• Severity: 4 critical, 53 high, and 190 medium or low. Google found most of the 190 itself.
• External reports: Outside researchers reported 62 of the bugs, including 34 of the 53 high-severity ones.
• Weakness types: incorrect authorization (41), use-after-free (34), missing authorization (34), UI misrepresentation (20), information leak (17), uninitialized resource (16), confused deputy (9) and improper input validation (9).
• Ge's high-severity reports: About a dozen, many found with AI.

Caveats

Google paid roughly $33,000 in bounties but has not disclosed the amounts for almost 50 of the external reports, including the critical ones. Google also will not reward Ge for some of the AI-found bugs. The page does not say which component each CVE belongs to, which bug Google found itself, or what an attacker would need to trigger any of them.