Chrome 155 Update Fixes 247 Vulnerabilities, Including Four Critical Flaws

Summary

Google’s Chrome 155 update fixes 247 vulnerabilities, including four critical use-after-free flaws. The update is rolling out for Windows, macOS, and Linux; Google reported no known exploitation in the wild.

Key points

The update addresses 247 vulnerabilities: four critical, 53 high-severity, and 190 medium- or low-severity issues.
All four critical flaws are use-after-free vulnerabilities affecting Chrome’s Chromecast, Browser, Navigation, and Track components.
The critical flaws are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347.
External researchers reported 62 vulnerabilities fixed in the update; Google said it paid roughly $33,000 in bug bounty rewards, with some amounts still undisclosed.
Researcher Xinyang Ge reported about a dozen flaws, many identified using AI; Google will not reward the researcher for some reports.
Chrome 155.0.8059.39/.40 is rolling out for Windows and macOS, and 155.0.8059.39 for Linux.
Google did not report any of the vulnerabilities as exploited in the wild.

Article Details

Vulnerability Types: Use-after-free
Incorrect authorization
Missing authorization
UI misrepresentation
Information leak
Uninitialized resource
Confused deputy
Improper input validation
Severity: Four critical-severity vulnerabilities; 53 high-severity vulnerabilities; the remaining 190 are medium- and low-severity.
Affected Versions: Chrome 155
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: available