Google has released a major Chrome security update that fixes 247 security vulnerabilities, including four flaws rated critical and 53 rated high severity.
The Stable Channel update brings Chrome to 155.0.8059.39/.40 on Windows and Mac and 155.0.8059.39 on Linux. Google says the release will roll out over the coming days and weeks. Google’s Chrome release notes confirm the scale of the security update, while India’s CERT-In has separately classified the vulnerabilities as critical. CERT-In warns that the broader set of flaws could enable arbitrary code execution, sensitive-information exposure, security-control bypasses or denial-of-service conditions.
Four critical flaws stand out from the 247 fixes
The four critical vulnerabilities are all classified by Google as use-after-free bugs. They affect different Chrome components: Chromecast, Browser, Navigation and Track.
They are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358 and CVE-2026-106347. Google says the Chromecast flaw was reported by Google, while the other three were reported by security researcher Xinyang Ge. Google credits Ge’s work at Anthropic and notes that Claude assisted with the discovery of two of those vulnerabilities.
Not all 247 vulnerabilities carry the same level of risk
The headline number can make the update sound like 247 equally dangerous bugs, but that is not what Google’s advisory says. The four critical issues sit at the top of the severity scale, followed by 53 high-severity vulnerabilities. The remaining fixes are classified as medium or low severity.
The affected areas are broad. Google’s security notes list issues involving browser functionality, Chromecast, Navigation, Track, PDF, WebGL, V8, WebRTC, WebAudio, Storage, Autofill, Fonts and DevTools, among others.
Security researchers also reported vulnerabilities involving type confusion, incorrect authorization, information leaks, uninitialized resources and other memory-safety problems. The breadth of the release is a reminder that a modern browser is effectively a large software platform rather than simply a tool for displaying web pages.
Why Chrome users should install the update promptly
Browsers are exposed to untrusted content by design. A vulnerability that can be triggered through specially crafted web content can therefore become an important attack surface, particularly when it affects core browser components.
However, Google has not said that these vulnerabilities are being exploited in the wild. The Cybersecurity and Infrastructure Security Center and other security advisories likewise report no confirmed exploitation at the time of publication. That distinction matters: the vulnerabilities are serious enough to patch quickly, but there is no evidence in the available advisories that a mass exploitation campaign is underway.
AI-assisted vulnerability research is part of the story
The release also highlights the growing role of AI in security research. Google credits Xinyang Ge of Anthropic, assisted by Claude, for discovering the Navigation and Track vulnerabilities among the critical fixes. Google’s advisory also lists additional high-severity bugs in PDF and Track reported with AI assistance.
That does not mean the vulnerabilities were found or validated entirely by an AI system. Human researchers remain responsible for reporting and working with Google through its security process. But the acknowledgements show that AI-assisted vulnerability discovery is becoming part of the security research pipeline.
Chrome users should check their version now
Chrome users can check for the update by opening Settings > About Google Chrome. Chrome will check for an available update and normally apply it after a relaunch.
For managed devices, security teams should verify that the updated version has reached endpoints rather than assuming that an automatic rollout has completed everywhere. Google says the desktop release is rolling out over the coming days and weeks, so version availability can vary between systems.
Sources: Google Chrome Releases, CERT-In, CybersecurityNews, SecurityWeek.
