Google Chrome Stable Update Fixes Eight Vulnerabilities, Including Critical-Severity Use-After-Free

What happened

Google released a Stable channel update for Chrome on desktop that fixes eight distinct vulnerabilities across multiple Chrome components. The issues include use-after-free bugs (CVE-2026-106421, CVE-2026-106315, CVE-2026-106347), race conditions (CVE-2026-106207, CVE-2026-106255), incorrect authorization issues (CVE-2026-106350, CVE-2026-106212), and an incorrect comparison bug in font handling (CVE-2026-106252). All eight vulnerabilities are described as exploitable via a crafted HTML page.

Technical causes

The vulnerabilities stem from several distinct root causes across different Chrome components. Three are use-after-free issues (CWE-416) affecting the PDF component, Modularization, and Track functionality. Two are race conditions (CWE-367 and CWE-362) in the V8 JavaScript engine. Two involve incorrect authorization (CWE-863) in the Browser and Autofill components, which could allow a remote attacker to obtain sensitive information. The remaining issue is an incorrect comparison (CWE-697) in font handling. Each vulnerability requires a crafted HTML page to be processed by the browser; the Autofill-related issue additionally notes a social engineering element.

Why it matters

Several of these vulnerabilities, including the use-after-free and race condition issues, could allow a remote attacker to execute arbitrary code inside Chrome's sandbox simply by getting a user to visit a crafted HTML page or interact with such content. While Chromium assigns differing internal severity ratings to each issue (ranging from Low to Critical), all eight carry the same CVSS base score of 8.8 in this fact package, reflecting high potential impact on confidentiality, integrity, and availability if successfully exploited.

Who is affected

Any user running a version of Google Chrome on desktop prior to 155.0.8059.39 is potentially affected. Chrome is one of the most widely used web browsers globally, meaning the pool of potentially affected systems is very large.

Affected and fixed versions

The fact package does not specify a lower bound for affected Chrome versions; all eight advisories simply state that versions prior to 155.0.8059.39 are affected. Chrome 155.0.8059.39 contains the fix for all eight vulnerabilities listed in this briefing.

Fixes and mitigation

Google has released Chrome 155.0.8059.39 for desktop, which includes fixes for all eight vulnerabilities covered in this briefing. Chrome typically updates automatically in the background; users and administrators should confirm the update has been applied rather than assume it has.

Recommended action

Verify that Chrome is running version 155.0.8059.39 or later by checking the browser's About page, which will trigger an update check if one has not already occurred. Restart the browser after updating to ensure the fix is applied. Organizations managing Chrome deployments via enterprise policy should confirm that the update has been pushed to all managed endpoints.