Google Chrome Stable Update Fixes Five Vulnerabilities, Including Two Use-After-Free Sandbox Escapes

What Happened

Google released a Stable Channel update for Chrome on desktop that fixes five separate vulnerabilities. Two are use-after-free flaws rated High severity by Chromium: one in the Media component (CVE-2026-106318), reachable via a crafted HTML page, and one in the PDF component (CVE-2026-106204), reachable via a crafted PDF file. Both could allow a remote attacker to execute arbitrary code inside Chrome's sandbox. A third use-after-free in the CSS component (CVE-2026-106269), rated Low severity, could similarly allow sandboxed code execution via a crafted HTML page. Additionally, an information leak in the Payments component (CVE-2026-106334, Low severity) could expose sensitive information via a crafted HTML page when combined with social engineering, and a missing authorization issue affecting Chrome Mobile on iOS (CVE-2026-106387, Medium severity) could similarly expose sensitive information through social engineering and a crafted HTML page.

Technical Cause

Three of the five issues (CVE-2026-106318, CVE-2026-106204, CVE-2026-106269) are classified as use-after-free (CWE-416), a memory safety defect where a program continues to reference memory after it has been freed, which can be abused to achieve arbitrary code execution inside the browser sandbox. CVE-2026-106334 is classified as an information leak (CWE-200), where sensitive data is exposed to an unauthorized actor. CVE-2026-106387 is classified as a missing authorization check (CWE-862), where expected access controls were not enforced, allowing exposure of information on the iOS Chrome Mobile platform.

Why It Matters

The two High-severity use-after-free vulnerabilities (CVE-2026-106318 and CVE-2026-106204) are the most significant in this batch: successful exploitation could let an attacker run arbitrary code inside Chrome's sandbox simply by getting a user to view a crafted HTML page or open a crafted PDF file. While sandbox containment limits the immediate impact, code execution vulnerabilities of this kind are frequently chained with sandbox-escape bugs in real-world attacks. The remaining issues (information leak and missing authorization) carry lower Chromium-assigned severities but still involve exposure of sensitive information and generally require some form of social engineering to succeed.

Who Is Affected

All users running Google Chrome on desktop prior to version 155.0.8059.39 are affected by CVE-2026-106334, CVE-2026-106204, CVE-2026-106269, and CVE-2026-106318. CVE-2026-106387 specifically affects Google Chrome Mobile on iOS prior to the same fixed version.

Affected Versions

Google Chrome versions prior to 155.0.8059.39 are affected across all five vulnerabilities described in this update.

Fixes and Mitigation

Google has released version 155.0.8059.39 of Chrome for desktop, which addresses all five vulnerabilities covered in this advisory. Chrome typically updates automatically; users and administrators should verify that the browser has updated to this version or later via the built-in update mechanism (chrome://settings/help).

Recommended Action

Confirm that Google Chrome has updated to version 155.0.8059.39 or later on all desktop and iOS devices in your environment. Restart the browser if an update is pending, as Chrome updates are not applied until relaunch. Organizations managing Chrome deployments via enterprise policy should verify that the update has propagated across managed fleets.