cyber.hendryadrian.com
Vulnerability & Exploit · malwarebytes.com

Google Updates Chrome and ChromeOS to Fix Critical Security Flaws

· Original article ↗

Summary

Google released Chrome and ChromeOS updates that include 247 security fixes, including four critical issues. The article details three high-impact Chrome flaws and explains how to install the updates.

Key points

  • Google's October 6 desktop Chrome update includes 247 security fixes, four rated Critical.
  • The update brings Chrome to version 155.0.8059.39 on Linux and 154.0.8037.39/.40 on Windows and Mac.
  • CVE-2026-106197 is a critical use-after-free in the Browser module that could allow remote code execution outside the sandbox via crafted HTML.
  • CVE-2026-106358 is a critical Navigation use-after-free that could also enable remote code execution outside the sandbox.
  • CVE-2026-106240 is a High-rated V8 type confusion flaw that could permit code execution inside the sandbox.
  • Users can check for Chrome updates through About Google Chrome; Chromebook users can check for and install ChromeOS updates through device settings.

Article Details

Vulnerability Types
  • Use-after-free
  • Type confusion
Severity
CVE-2026-106197 and CVE-2026-106358 are rated Critical; CVE-2026-106240 is rated High.
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Update Chrome to the latest version through Chrome settings or the Help menu and relaunch the browser.
  • Connect the Chromebook to the internet, then restart it to complete the ChromeOS update.

CVE

CVE-2026-106197CVE-2026-106197: This is a use-after-free vulnerability in the Browser module, rated critical. This is a strong priority candidate because of its location in browser functionality rather than a specialist feature.CVE-2026-106240CVE-2026-106240: A type confusion vulnerability in V8, Chrome’s JavaScript engine. This one is rated High but does offer a remote attacker after successful exploitation to execute arbitrary code inside the sandbox via aCVE-2026-106358CVE-2026-106358: Another use-after-free vulnerability, this time in Navigation, also rated critical. Navigation is central to ordinary browsing, making this a potentially broadly exposed flaw if attacker-controlled

Vendors

GoogleGoogle has released updates for the Chrome browser and the ChromeOS operating system.

Products

ChromeOSGoogle has released updates for the Chrome browser and the ChromeOS operating system.Google ChromeGoogle has released updates for the Chrome browser and the ChromeOS operating system.V8CVE-2026-106240: A type confusion vulnerability in V8, Chrome’s JavaScript engine. This one is rated High but does offer a remote attacker after successful exploitation to execute arbitrary code inside the sandbox via a

Related Articles