Chrome 155 Fixes 4 Critical Use-After-Free Bugs in Browser, Navigation, Track, Chromecast

Google has released a security update for the Chrome Stable channel, addressing a batch of 24 vulnerabilities across desktop platforms. The most significant issues are four critical use-after-free bugs, a class of memory corruption error that can allow attackers to execute arbitrary code or compromise user data. These flaws reside in core browser components including the Browser engine, Navigation module, Track system, and Chromecast integration.

Root cause

Use-after-free vulnerabilities occur when a program continues to use memory after it has been freed, leading to unpredictable behavior and potential exploitation. In this release, the critical bugs were reported by researchers including Xinyang Ge, who was assisted by Anthropic’s Claude for two of the findings. One critical flaw in Chromecast was reported by Google internally. The other high-severity issues involve incorrect authorization logic in SiteIsolation and Core, as well as an uninitialized resource in the ANGLE graphics library.

Attack path

Exploiting these critical use-after-free bugs could potentially allow a malicious website or compromised extension to take control of the browser process. Given that four of the 24 fixes are rated critical, the risk of remote code execution is significant if users browse with older versions. The incorrect authorization flaws in SiteIsolation could weaken the browser’s sandboxing mechanisms, allowing cross-site data leakage or privilege escalation within the browser context.

Affected versions

The update rolls out as version 155.0.8059.39 for Linux and Windows, and 155.0.8059.40 for Mac. Earlier versions of Chrome 155 are vulnerable. Additionally, Google released an Extended Stable update to version 152.0.7977.158 for Windows and Mac, and an Early Stable update to version 156.0.8078.12/.13 for a small percentage of users.

Mitigation

• Update Chrome to version 155.0.8059.39 or later on all desktop platforms.
• Ensure the Extended Stable channel is updated to 152.0.7977.158 if used in your organization.
• Verify that automatic updates are enabled to receive future security patches promptly.

Background: Use-after-free vulnerabilities

A use-after-free vulnerability occurs when software accesses memory after it has been freed. This creates dangling pointers that attackers can manipulate to execute arbitrary code. Fixing it requires strict memory management and adopting languages that prevent these errors at compile time.

Read the full guide: Use-After-Free Vulnerabilities: How Memory Errors Become Hacks

What to do and how to stay safe: Google Chrome

• Check your organization’s Chrome deployment status to ensure all endpoints have received the 155.0.8059.39 update.
• Review SiteIsolation policies to ensure they are correctly configured, as this component had an authorization flaw.
• Monitor browser crash logs for unusual activity that might indicate exploitation attempts of memory safety issues.
• Once the vendor provides an update for any third-party libraries mentioned, apply those patches to maintain overall system security.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific components are affected by the critical bugs?

The critical use-after-free bugs affect the Browser, Navigation, Track, and Chromecast components.

Is there a fix for the Extended Stable channel?

Yes, the Extended Stable channel has been updated to version 152.0.7977.158 for Windows and Mac.

How many security fixes are in this update?

This update includes 24 security fixes, comprising four critical and 20 high-severity vulnerabilities.