Google Chrome Stable Update Fixes Eight Vulnerabilities, Including Sandbox Escape Risks

What happened

Google released a Stable Channel update for Chrome on desktop that fixes eight separate vulnerabilities: CVE-2026-106352 (incorrect authorization in WebProtect), CVE-2026-106201 (race condition in V8), CVE-2026-106308 (incorrect reference resolution in Autofill, on Android), CVE-2026-106235 (use after free in WebAudio), CVE-2026-106203 (incomplete cleanup in Autofill, on iOS), CVE-2026-106240 (type confusion in V8), CVE-2026-106190 (use after free in Media), and CVE-2026-106341 (type confusion in V8). All eight were disclosed together in the same vendor release.

Technical causes

The vulnerabilities stem from several different underlying weaknesses. CVE-2026-106201 and CVE-2026-106240 and CVE-2026-106341 involve V8 issues: a race condition (CVE-2026-106201) and two instances of type confusion (CVE-2026-106240, CVE-2026-106341), which can allow an attacker to execute arbitrary code inside the browser's sandbox via a crafted HTML page. CVE-2026-106235 and CVE-2026-106190 are use-after-free bugs in WebAudio and Media respectively, which could similarly enable sandboxed code execution. CVE-2026-106352 is an incorrect authorization issue in WebProtect (CWE-863) that could expose sensitive information to an attacker using social engineering. CVE-2026-106308 (on Android) and CVE-2026-106203 (on iOS) are issues in Autofill — incorrect reference resolution and incomplete cleanup, respectively — that could also leak sensitive information via a crafted HTML page combined with social engineering.

Why it matters

Several of these vulnerabilities (CVE-2026-106201, CVE-2026-106235, CVE-2026-106190, CVE-2026-106240, CVE-2026-106341) could allow an attacker to execute arbitrary code within Chrome's sandbox simply by getting a user to visit a crafted HTML page. While sandboxing limits the immediate impact, successful exploitation of sandbox escape primitives is a known stepping stone toward broader compromise when chained with other flaws. The remaining issues (CVE-2026-106352, CVE-2026-106308, CVE-2026-106203) could expose sensitive user information, such as autofill data, to a remote attacker who convinces a victim to interact with malicious content. All eight vulnerabilities share a CVSS base score of 8.8, reflecting high impact on confidentiality, integrity, and availability, combined with low attack complexity and no required privileges, though all require some form of user interaction.

Who is affected

All users running Google Chrome on desktop prior to version 155.0.8059.39 are affected by the core set of vulnerabilities. Two of the issues are platform-specific: CVE-2026-106308 affects Chrome on Android, and CVE-2026-106203 affects Chrome on iOS. Given Chrome's broad installation base, this affects a very large number of individual users and organizations.

Affected versions

Google Chrome versions prior to 155.0.8059.39 are affected by all eight vulnerabilities described in this release. No specific earliest-affected version was disclosed in the available source material.

Fixes and mitigation

Google has fixed all eight vulnerabilities in Chrome version 155.0.8059.39, released through the Stable Channel for desktop. No workarounds beyond updating are mentioned in the available source material.

Recommended action

Update Google Chrome to version 155.0.8059.39 or later as soon as possible. Chrome typically updates automatically, but users and administrators should verify the installed version via the browser's About page and restart the browser to apply the update. Organizations managing Chrome deployments at scale should confirm that managed update policies have pushed this version to all endpoints.