Google shipped Chrome 155 to the stable channel on October 6, 2026, and this Chrome security update patches 247 issues, four of them rated Critical. All four critical bugs are use-after-free flaws, the kind of memory bug that can let an attacker run arbitrary code if a victim loads a malicious page. Two of the four were found by a security researcher at Anthropic who used Claude to help with the work, according to Google’s own Chrome Releases post. Windows and Mac land on build 155.0.8059.39 or .40; Linux gets 155.0.8059.39. Chrome auto-updates for most people, but it only takes effect after a relaunch, so check chrome://version if you’re not sure you’re actually on it.
What This Chrome Security Update Covers
The four critical use-after-free bugs sit in Chromecast (CVE-2026-106382), the core Browser process (CVE-2026-106197), Navigation (CVE-2026-106358), and the Track component (CVE-2026-106347). Google’s advisory doesn’t flag any of the four as actively exploited, and keeps most technical detail restricted until the fix reaches most users, which is standard practice. Past the critical four, the release also closes out dozens of High-severity issues, including several uninitialized-resource bugs in ANGLE (Chrome’s graphics layer) and a type confusion flaw in V8, Chrome’s JavaScript engine.
The Detail Worth Noticing: Claude Helped Find Two of Them
Chrome ships 200-plus fixes most months, so the count alone isn’t the story. What stands out is the credit line on two of the four critical bugs: “Reported by Xinyang Ge (Anthropic), assisted by Claude.” It’s not the first time an AI model has turned up in a vulnerability credit, but seeing it attached to critical findings in one of the most heavily audited codebases on the internet is a real signal that AI-assisted code review is past the experimental stage. It tracks with Anthropic’s own push to put its models to work hunting bugs instead of just writing code, the same instinct behind the open source vulnerability scanner Anthropic released earlier this month.
What to Actually Do About It
- Relaunch Chrome. The update sits inert until you restart the browser.
- Confirm the version at chrome://settings/help; you want 155.0.8059.39/.40 or later.
- Managing Chrome across a team or client fleet? Push the update through your device management policy instead of waiting on each machine’s own auto-update timing.
- If a site or web application you run leans on browser APIs for anything security-adjacent, payment iframes, file uploads, WebAuthn, a quick regression pass against 155 is worth the half hour, given how many of this month’s fixes landed in Autofill, FileSystem, and Core specifically.
