Chrome 155 Lands With 247 Security Fixes, Four of Them Critical: The IT Briefing
Google’s Chrome 155 release fixes 247 vulnerabilities, including four critical use-after-free bugs. Here is a short briefing for the people who keep browsers updated.
Browsers are the busiest software on most business computers, and this week’s Chrome release is unusually large. Here is the short version for whoever manages updates at your company.
Bottom line
Google released Chrome 155 on Tuesday with fixes for 247 security vulnerabilities. Google hasn’t said any of them are being exploited in the wild, but four are rated critical, so the update deserves a prompt rollout.
Versions to look for
- Windows and macOS: 155.0.8059.39 or 155.0.8059.40
- Linux: 155.0.8059.39
The critical four
All four critical bugs are use-after-free memory errors. They sit in Chrome’s Chromecast, Browser, Navigation and Track components and are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358 and CVE-2026-106347. Google found the first one itself. Researcher Xinyang Ge reported the other three and used AI to find two of them.
The rest of the list
- 53 high-severity flaws, 34 of them reported by outside researchers. Ge reported roughly a dozen of these, many found with AI, and Google won’t reward some of them.
- 190 medium- and low-severity issues, mostly found by Google itself.
- 62 bugs in total came from external researchers. Google has paid about $33,000 in rewards so far and hasn’t disclosed the amounts for nearly 50 of the reports.
Most common bug types
- Incorrect authorization: 41
- Use-after-free: 34
- Missing authorization: 34
- UI misrepresentation: 20
- Information leak: 17
- Uninitialized resource: 16
- Confused deputy: 9
- Improper input validation: 9
Context
Several of the most serious bugs in this release were found with the help of AI tools. Whatever the cause, a release this large is a reminder that a browser one or two versions behind can be missing a long list of known fixes.
Ionut Arghire summarized Google’s advisory for SecurityWeek, including the full breakdown of bug types and rewards.
What this means for your company
- Check, don’t assume. Chrome downloads updates on its own, but they only take effect after a restart. Machines that stay open for weeks can be running old versions.
- Manage browsers centrally. Use your device management or browser management tools to enforce updates and a relaunch deadline, and to report version numbers across the fleet.
- Remember the other Chromium browsers. If staff use other browsers built on the same engine, track those vendors’ updates too.
- Keep extensions under control. A patched browser full of unvetted extensions is still a risk, so maintain an approved list.
Need help keeping browsers and endpoints patched across your whole team? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
