Google Chrome Update Fixes Eight Vulnerabilities, Including Multiple Sandbox Escape Risks

What happened

Google released a Stable Channel update for Chrome on desktop that fixes eight separate vulnerabilities. Five are use-after-free, type confusion, or improper state validation issues in core browser components (Track, Select, DevTools, GarbageCollection, Media, and V8) that Chromium rates as High or Medium severity and that could allow a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The remaining issues affect Chrome on Android and involve incorrect authorization and information leaks in the Transactions Platform and Passwords components, rated Low severity by Chromium, which could allow a remote attacker to obtain sensitive information via a crafted HTML page.

Technical cause

The vulnerabilities fall into several distinct categories. CVE-2026-106200 (Track), CVE-2026-106278 (Select), CVE-2026-106291 (GarbageCollection), and CVE-2026-106335 (Media) are use-after-free issues (CWE-416), where memory is accessed after it has been freed, potentially allowing an attacker to execute arbitrary code inside the sandbox. CVE-2026-106346 (DevTools) is an improper state validation issue (CWE-754) that could also enable code execution inside the sandbox. CVE-2026-106374 (V8) is a type confusion vulnerability (CWE-843) in Chrome's JavaScript engine, also potentially leading to sandboxed code execution. CVE-2026-106371 (Transactions Platform, Android) is an incorrect authorization issue (CWE-863), and CVE-2026-106256 (Passwords, Android) is an information leak (CWE-200); both could expose sensitive information to a remote attacker via a crafted HTML page. All issues share the same CVSS vector, indicating network-based attack access with low attack complexity, no privileges required, and user interaction required.

Why it matters

Several of these vulnerabilities could allow an attacker to execute arbitrary code within Chrome's sandbox simply by getting a user to visit a crafted web page, which Chromium's own severity ratings classify as High or Medium. While sandbox escape typically requires chaining with an additional vulnerability to fully compromise a system, successful exploitation of memory corruption bugs like use-after-free and type confusion can still lead to information disclosure, crashes, or further compromise. The two Android-specific issues could expose sensitive information, including password-related data, to an attacker without requiring high privileges.

Who is affected

All users running Google Chrome on desktop prior to version 155.0.8059.39 are affected by the core vulnerabilities. Two of the eight issues (CVE-2026-106371 and CVE-2026-106256) specifically affect Chrome on Android prior to the same fixed version.

Affected versions

All versions of Google Chrome prior to 155.0.8059.39 are affected. The fact package does not specify the exact starting version range for each vulnerability, so users on any version older than the fixed release should treat themselves as potentially affected.

Fixes and mitigation

Google has fixed all eight vulnerabilities in Chrome version 155.0.8059.39. Chrome typically applies this update automatically, but users and administrators should verify their browser version and restart Chrome to complete the update if it has not already been applied.

Recommended action

Verify that Chrome has updated to version 155.0.8059.39 or later by checking the browser's About page, and restart the browser to apply the update if needed. Organizations managing Chrome deployments via enterprise policy should confirm the update has propagated across managed devices, including Android devices affected by the two Android-specific issues.