Key points
- The update addresses four critical use-after-free vulnerabilities in Chrome components.
- Four high-severity fixes resolve authorization and resource initialization issues.
- Patches are rolling out for Windows, Mac, and Linux versions of Chrome 155.
Google has released a new Stable channel update for the Chrome desktop browser, addressing a batch of security vulnerabilities that could allow attackers to compromise user systems. The update, version 155.0.8059.39 for Windows, Mac, and Linux (with .40 for Mac), includes fixes for 24 identified security flaws. Google states that the update will roll out to users over the coming days and weeks.
By the numbers
- 24: Total security fixes included in this Chrome Stable update.
- 4: Critical severity vulnerabilities, all classified as use-after-free errors.
- 4: High severity vulnerabilities involving authorization and resource handling.
What the figures mean
The four critical vulnerabilities are all use-after-free bugs, a common class of memory safety error where code attempts to access memory that has already been freed. These specific flaws were found in the Chromecast component, the Browser core, the Navigation system, and the Track component. According to the advisory, these issues were reported by researchers including Google itself and Xinyang Ge of Anthropic, with some reports assisted by Claude.
In addition to the critical bugs, the update resolves four high-severity issues. These include incorrect authorization flaws in SiteIsolation and Core components, and an uninitialized resource issue in ANGLE, a graphics library used by Chrome. These high-severity fixes were reported by researchers Avadhut Mahamuni, JonathanBouman, and OGINOME Tomohito. Google notes that access to detailed bug information may remain restricted until a majority of users have updated, particularly if the bugs affect third-party libraries shared by other projects.
What should you do?
Managed service providers and IT administrators should prioritize updating Chrome to version 155.0.8059.39 or higher on all Windows, Mac, and Linux endpoints. Because the update rolls out gradually, organizations with strict security policies should verify that devices have received the patch. Google has not confirmed any active exploitation of these specific vulnerabilities in the wild, but the critical nature of use-after-free bugs means they can often be leveraged for remote code execution. Users should also check for updates on the Extended Stable channel, which has been updated to version 152.0.7977.158, and the Early Stable channel, which is testing version 156.0.8078.12.
Frequently asked questions
Which Chrome versions are affected by this update?
The update affects Chrome Stable versions prior to 155.0.8059.39 on Windows, Mac, and Linux, as well as Extended Stable versions prior to 152.0.7977.158.
Are there any critical vulnerabilities in this patch?
Yes, there are four critical use-after-free vulnerabilities in the Chromecast, Browser, Navigation, and Track components.
How quickly will the update reach users?
Google states the update will roll out over the coming days and weeks to Stable channel users.
