Install Chrome 155 or 152 on Windows, Mac, Linux to Fix Critical Buffer Overflow and Use-After-Free Vulnerabilities
Google released new Chrome desktop builds for Windows, Mac, and Linux that fix dozens of security issues, including several rated critical severity.
Key points
- The Extended Stable channel updated to version 152.0.7977.167 for Windows and Mac, containing 28 security fixes.
- The Stable channel updated to version 155.0.8059.79 or .80 for Windows and Mac, and 155.0.8059.79 for Linux, with 37 fixes.
- Both updates address multiple critical vulnerabilities, including buffer overflows and use-after-free errors in various browser components.
Google has released updated versions of its Chrome web browser for desktop computers to address a large number of security vulnerabilities. The Extended Stable channel now runs version 152.0.7977.167 on Windows and Mac systems, while the Stable channel has moved to version 155.0.8059.79 or .80 on Windows and Mac, and 155.0.8059.79 on Linux. These updates roll out over the coming days and weeks, as stated in the official advisories from Google Chrome Releases.
In plain English
The Extended Stable update includes 28 security fixes, according to the release notes. Several of these issues are rated critical, which means they pose a high risk if exploited. The Stable channel update contains 37 security fixes, also including multiple critical-rated flaws. Both updates address problems that could allow attackers to compromise the browser, though specific details on how the flaws work remain restricted until most users have updated.
The background
The critical vulnerabilities in the Stable channel include a buffer overflow in the ANGLE graphics library, reported by Zhenpeng Lin at depthfirst on September 30, 2026. Other critical issues involve use-after-free errors in the browser core, PDF viewer, network stack, SVG rendering, and media handling, reported by researchers including Xinyang Ge and Google engineers in early October 2026. The Extended Stable channel also lists five critical CVEs, such as CVE-2026-106347 and CVE-2026-110136, alongside numerous high-severity fixes like CVE-2026-106184 and CVE-2026-110170.
What changes now
Google is keeping details about many of these bugs restricted to prevent immediate exploitation by attackers who have not yet patched their systems. This policy applies especially when flaws exist in third-party libraries used by other projects that have not yet issued fixes. Users should ensure their browsers are set to update automatically to receive these patches. The updates address a wide range of issues, from high-severity problems in desktop components to critical flaws in core browser functions, ensuring better protection against potential attacks.
Key terms explained
A buffer overflow occurs when a program writes more data to a memory buffer than it can hold, potentially allowing attackers to execute arbitrary code. Use-after-free errors happen when a program continues to use memory after it has been freed, which can lead to unpredictable behavior or code execution. Critical severity indicates a vulnerability that could allow remote code execution or significant system compromise without user interaction. Teams usually monitor vendor advisories to prioritize patching these high-risk issues quickly across their environments.
What to do and how to stay safe: Google Chrome
- Check your Chrome version by clicking the three-dot menu, selecting Help, and choosing About Google Chrome to see if you are running the latest build.
- Enable automatic updates in Chrome settings to ensure you receive security patches as soon as they are released by the vendor.
- Review your system’s update logs to confirm that the new versions have been successfully installed on all managed devices.
- Monitor vendor security pages for any additional advisories or changes to the disclosure timeline for these specific vulnerabilities.
Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many security fixes are in the latest Chrome Stable update?
The Stable channel update includes 37 security fixes, according to the official advisory from Google Chrome Releases.
Are there any critical vulnerabilities in the Extended Stable update?
Yes, the Extended Stable update addresses five critical vulnerabilities, including CVE-2026-106347 and CVE-2026-110136.
Why are some bug details restricted?
Google restricts access to bug details until a majority of users have updated to prevent attackers from exploiting unpatched systems.
