Chrome 155 Patches 247 Vulnerabilities, Four Critical

Google on Tuesday released Chrome 155, a security update that fixes 247 vulnerabilities in the browser’s Windows, macOS and Linux versions.

The update addresses four critical use-after-free flaws affecting Chrome’s Chromecast, Browser, Navigation and Track components. They are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358 and CVE-2026-106347.

Google discovered the first vulnerability. Security researcher Xinyang Ge reported the other three and used artificial intelligence to identify two of them. Google has not disclosed the bounties awarded for those reports.

Chrome 155 also fixes 53 high-severity vulnerabilities. External researchers reported 34 of them, including about a dozen attributed to Ge. Several of Ge’s reports were produced with the help of artificial intelligence. Google will not pay a bounty for some of the reports.

The remaining 190 vulnerabilities have medium or low severity ratings. Google’s internal security teams found most of them. External researchers reported 62 of the vulnerabilities addressed in the update.

Google has disclosed about $33,000 in bounty payments for the release. The company has not published the rewards for almost 50 reports.

The patched issues include 41 incorrect-authorization flaws, 34 use-after-free vulnerabilities, 34 missing-authorization defects, 20 cases of misleading user interfaces, 17 information leaks, 16 uninitialized-resource flaws, nine confused-deputy vulnerabilities and nine cases of improper input validation.

Google’s advisory does not report any exploitation of the vulnerabilities in the wild. Chrome 155 is rolling out as versions 155.0.8059.39 and 155.0.8059.40 for Windows and macOS, and version 155.0.8059.39 for Linux.