Google Chrome Stable Update Fixes Eight Vulnerabilities, Including Multiple Use-After-Free Flaws

What happened

Google released a Stable Channel update for Chrome on desktop that fixes eight vulnerabilities. According to the vendor advisory, these include four use-after-free (CWE-416) issues in V8, Streaming, Fonts, Parser, and Media components, as well as authorization-related issues (CWE-863, CWE-862) in Bluetooth and Autofill. Chromium rated the individual issues as High, Medium, or Low severity depending on the component affected.

Technical cause

The vulnerabilities fall into two categories. Use-after-free issues (CVE-2026-106349 in V8, CVE-2026-106283 in Streaming, CVE-2026-106373 in Fonts on Windows, CVE-2026-106411 in the Parser, and CVE-2026-106423 in Media) occur when memory is accessed after it has been freed, which can be leveraged to execute arbitrary code inside Chrome's sandbox via a crafted HTML page. Separately, incorrect or missing authorization checks (CVE-2026-106314 in Bluetooth, CVE-2026-106249 in Autofill on Android, and CVE-2026-106225 in Autofill) could allow a remote attacker to obtain sensitive information, also via a crafted HTML page. Some of these issues reportedly require social engineering to be triggered, per the vendor description.

Why it matters

All eight vulnerabilities carry a CVSS base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network-based attack vectors, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability once triggered. User interaction (visiting a crafted page) is required in all cases. The use-after-free issues are of particular concern because they are described as enabling arbitrary code execution inside the sandbox, which is a step toward full system compromise if chained with a sandbox escape.

Who is affected

All users running Google Chrome on desktop prior to version 155.0.8059.39 are affected. One issue (CVE-2026-106373) is specific to Chrome on Windows, and another (CVE-2026-106249) is specific to Chrome on Android. The remaining issues affect Chrome generally, per the vendor description.

Affected versions

Chrome versions prior to 155.0.8059.39 are affected by these vulnerabilities, according to the vendor advisory.

Fixes and mitigation

Google has fixed all eight vulnerabilities in Chrome version 155.0.8059.39. The fix is distributed through Chrome's standard update mechanism as part of the Stable Channel release.

Recommended action

Update Chrome to version 155.0.8059.39 or later as soon as possible. Chrome typically updates automatically, but users and administrators should verify the installed version via the browser's 'About Chrome' menu and restart the browser to complete the update. Organizations managing Chrome deployments at scale should confirm that managed update policies are not blocking this release.