Chrome 155’s new update fixed 247 security vulnerabilities

Google released a new security update to the stable channel of the Chrome browser on October 6, 2026. Version 155.0.8059.39 is being distributed as 155.0.8059.39/.40 on Windows and Mac, and as 155.0.8059.39 on Linux. According to the release notes published on the Chrome Releases blog, the update contains a total of 247 security fixes. Of the fixes, 4 are critical, 53 are high, 122 are medium, and 68 are low severity.

Which components contain the critical bugs

All four vulnerabilities marked as critical are use-after-free bugs. CVE-2026-106382 is in the Chromecast component, CVE-2026-106197 in the browser core, CVE-2026-106358 in the Navigation component, and CVE-2026-106347 in the Track component. In NVD records, the CVSS score of some of these vulnerabilities reaches up to 9.6.

Notable high-risk vulnerabilities

A significant portion of the 53 high-severity vulnerabilities are concentrated in the graphics and media layers. The uninitialized resource bugs in the ANGLE component were listed as CVE-2026-106245, CVE-2026-106258, and CVE-2026-106215, while the type confusion bug in the same component was listed as CVE-2026-106293. The integer overflow in WebGL was recorded as CVE-2026-106239, the bug in the Dawn component as CVE-2026-106231, and the bug in Skia as CVE-2026-106379.

The race condition bugs in the JavaScript engine are tracked as CVE-2026-106255 and CVE-2026-106207, while the type confusion on the V8 side is tracked as CVE-2026-106240. Bugs allowing unauthorized access in the autofill and password components were also closed in this package. The search path bug in the Windows-specific CredentialProvider component appears in the NVD record with a CVSS score of 8.6. The authorization bug in Chrome for iOS, CVE-2026-106323, and the autofill bugs in the Android version were also fixed in the same update.

What users should do

Chrome updates are downloaded automatically in the background, but the browser must be closed and reopened for the new version to take effect. Those who want to check the version manually can follow the Help and About Chrome steps from the menu in the upper right; this screen checks for the update immediately. On Windows, macOS, and Linux the update arrives automatically, while on Android and iOS the Chrome app must be updated through the store. Google’s release notes do not contain any statement that these vulnerabilities are being actively exploited; the company keeps bug details restricted until most users have received the update.

Source: Chrome Releases · NVD