Google Chrome Stable Update Fixes Eight High-Severity Vulnerabilities

What happened

Google published a Chrome Stable Channel update bundling fixes for eight separate vulnerabilities across different browser components: Tint (CVE-2026-106281), FileSystem (CVE-2026-106329), Navigation (CVE-2026-106358), Chromecast (CVE-2026-106382), Search on Android (CVE-2026-106241), Mobile on iOS (CVE-2026-106414), Media (CVE-2026-106401), and Chrome Tabs on Mac (CVE-2026-106298). Chromium's own severity ratings for these issues range from Medium to Critical. All advisories describe exploitation via a crafted HTML page.

Technical causes

The vulnerabilities stem from several distinct weaknesses: use-after-free conditions (CWE-416) in Tint, Navigation, Chromecast, and Chrome Tabs components (CVE-2026-106281, CVE-2026-106358, CVE-2026-106382, CVE-2026-106298); incorrect authorization (CWE-863) in FileSystem and Search (CVE-2026-106329, CVE-2026-106241); improper input validation (CWE-20) in the iOS Mobile component (CVE-2026-106414); and an out-of-bounds write (CWE-787) in Media (CVE-2026-106401). Each is described as potentially allowing a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page, with several requiring social engineering or user interaction to trigger.

Why it matters

Each of these eight CVEs carries a CVSS base score of 9.6, reflecting network-exploitable, low-complexity attack paths with high impact on confidentiality, integrity, and availability, and a scope change indicating potential sandbox escape. Several are rated Critical or High by Chromium's internal severity scale, meaning successful exploitation could allow code execution outside Chrome's security sandbox. Given Chrome's extremely large install base, unpatched installations represent a broad attack surface, even though no exploitation has been observed so far.

Who is affected

All users running Google Chrome on desktop prior to version 155.0.8059.39 are affected by the core set of vulnerabilities. Some issues are platform-specific: CVE-2026-106241 affects Chrome on Android, CVE-2026-106414 affects Chrome on iOS, and CVE-2026-106298 affects Chrome on Mac. Organizations managing Chrome deployments across desktop and mobile platforms should treat this as affecting their full fleet.

Affected versions

All versions of Google Chrome prior to 155.0.8059.39 are affected by one or more of these vulnerabilities. The fact package does not specify a lower bound for affected version ranges.

Fixes and mitigation

Google has released Chrome version 155.0.8059.39 for desktop, which resolves all eight vulnerabilities described in this briefing. The fix was announced via Google's official Chrome Releases (Stable) blog.

Recommended action

Update Google Chrome to version 155.0.8059.39 or later as soon as possible. Chrome typically updates automatically on relaunch; users and administrators should verify via chrome://settings/help and restart the browser to apply the update. Enterprises managing Chrome through policy should prioritize rollout given the number and severity of fixed issues.