Chrome 155 Fixes 247 Security Flaws, and AI Found Some of the Worst

Google's Chrome 155 security update, released on 6 October 2026, is a big one: 247 security fixes in a single release. That alone is a good reason to restart your browser today. The more interesting story is who, or what, found some of them. A noticeable share of the most serious bugs were reported with help from AI tools.

The numbers

According to Google's Stable Channel Update for Desktop, Chrome moved to version 155.0.8059.39/.40 on Windows and Mac and 155.0.8059.39 on Linux, rolling out "over the coming days/weeks". The release notes list 247 security fixes.

SecurityWeek's breakdown by Ionut Arghire adds useful context:

• 4 critical flaws, all use-after-free bugs, in the Chromecast, Browser, Navigation and Track components.
• 53 high-severity flaws, 34 of them reported by external researchers.
• 190 medium and low issues, most found by Google itself.
• 62 bugs in total came from external researchers, with roughly US$33,000 in bounties disclosed so far and amounts still to be announced for almost 50 reports.
• The most common bug types were incorrect authorisation (41), use-after-free (34) and missing authorisation (34).

Importantly, Google made no mention of any of these being exploited in the wild. This is a "patch promptly" release, not a "drop everything" emergency.

Where AI comes in

Read through Google's list of credits and one name keeps appearing: Xinyang Ge (Anthropic), assisted by Claude. Twelve of the fixes carry that exact credit, including two of the four critical bugs: a use-after-free in Navigation (CVE-2026-106358) and one in Track (CVE-2026-106347). The other ten are rated high and cover areas such as Media, WebRTC, V8, PDF and the HTML parser. Xinyang Ge is also credited, without the Claude note, on a third critical bug and several others.

Two more high-severity bugs are credited to OpenAI Codex Security: a use-after-free in HTML (CVE-2026-106257) and a type confusion in V8 (CVE-2026-106240). There's also a low-severity V8 issue credited to Tencent KeenLab's CodeBuddy Security.

SecurityWeek reports that many of the researcher's findings were AI-assisted and that Google won't pay bounties for some of them. Google's release notes don't explain that decision, so I won't guess at the reasons.

Why this matters

Browser vendors have used automated bug-finding for years. Google's own notes credit tools such as AddressSanitizer, libFuzzer and AFL. What's new is AI models showing up by name next to critical memory-safety bugs in a codebase Google already fuzzes heavily.

That cuts both ways:

• Defenders win when AI-assisted researchers report bugs through bounty programs and they get fixed before anyone abuses them, which is exactly what happened here.
• The patch gap matters more. If AI makes finding bugs cheaper, it does so for attackers as well. Once a fix ships, the time between "patch available" and "exploit attempted" is the window you control. Updating quickly closes it.
• Expect bigger release notes. 247 fixes is a lot for one release. If AI-assisted discovery keeps scaling, more security fixes per release may become normal, and that's a good thing as long as people actually install them.

How to update Chrome now

Desktop (Windows, Mac, Linux): open the Chrome menu (the three dots), go to Help > About Google Chrome, let it download the update, then click Relaunch. Check the version number reads 155 or later. Chrome reopens your tabs, so there's little reason to put this off.

Android and iPhone: update Chrome from the Play Store or App Store. Mobile versions roll out on their own schedule, so if the update isn't there yet, check again in a day or two.

Other Chromium browsers: Edge, Brave, Vivaldi and Opera are built on Chromium and usually pick up these fixes in their own updates. Check each browser's About page.

Managed fleets: if you look after machines for a small business, check your update policy isn't holding Chrome back on an older version. Make sure staff actually relaunch the browser, because a downloaded update doesn't protect anyone until Chrome restarts.

The habit that matters

Browsers are the front door to everything else: email, banking, admin panels, your NAS. The same patch-quickly habit applies to the servers and devices behind them. If you self-host, schedule time after each DSM or OS update to re-check your configuration; my guide to Synology SSH hardening on DSM 7 shows what to look at.

Watch the quick version

This story is covered on Riff's AI Headlines, a YouTube channel for fast, sourced AI and cybersecurity news. Subscribe to Riff's AI Headlines on YouTube so you hear about the next big patch early.