Chrome's 247 October 6 security fixes take effect only after a browser relaunch
Google's October 6 Chrome desktop update fixes 247 security flaws, four of them rated Critical. The fixes apply when Chrome relaunches, so a browser nobody closes keeps running the vulnerable build until someone restarts it.
The Watch · Security desk
What happened
- CVE-2026-106197, a Critical use-after-free in Chrome's Browser module, lets a remote attacker run arbitrary code outside the sandbox through a crafted HTML page.
- A second Critical use-after-free, CVE-2026-106358, sits in Navigation and offers the same out-of-sandbox code execution from a crafted page.
- The V8 JavaScript engine bug, CVE-2026-106240, is a type confusion rated High that gives a remote attacker code execution inside the sandbox.
- Google pushed Android build 155.0.8059.39 the same day to a small share of users and described it as stability and performance improvements.
- ChromeOS was updated as well; Chromebooks fetch the update when they connect and need a restart to finish installing it.
Why it matters
- Who has to decide decision Anyone pushing a forced relaunch outside the normal change window has to justify it on bug class and reach, the only risk evidence published so far.
- Who's exposed exposure An extension that blocks the updater is a failure path separate from users who never close Chrome, so a relaunch prompt alone may leave some machines on the old build.
- What it limits constraint With two of the four Critical bugs undescribed, triage cannot rank them against the Browser and Navigation flaws, so the release gets patched as one unit.
Next story · Security · 2d ago
XBOW built a Windows Chrome exploit chain in six days with about $40,000 of AI computeConfirmed4 publishers
Malwarebytes wrote that Chrome flaws allowing code execution outside the browser sandbox can turn a visit to a malicious or compromised website into code running on the underlying operating system, "often without requiring additional exploitation steps" [10]. A use-after-free happens when a program touches memory after it has been freed. The result can be a crash or, in some cases, code the attacker chose [14].
The firm ranked the bugs partly by where they sit. It called the Browser-module bug "a strong priority candidate" because it is in general browser functionality [3]. Navigation is central to ordinary browsing, and Malwarebytes described the second bug as possibly broadly exposed if attacker-controlled pages or redirects can reach the vulnerable path [4].
The V8 type confusion is rated High, and its code execution stays inside the sandbox [8]. Malwarebytes still counted it among three likely high-impact fixes, writing that a flaw in the JavaScript engine is "always a plausible candidate for attacks delivered through malicious web content" [13][9].
The write-up reports none of the 247 flaws as exploited in the wild and ties none to an actor. It describes only two of the four Critical bugs [5][15]. On that record this is patch-cycle work with no external deadline [5].
Chrome's updater is the default path, but Malwarebytes notes that a browser that is never closed falls behind on updates [6]. The manual route ends at the same step: open About Google Chrome, let it check, then click Relaunch to apply the build [7]. Inventory checks need more than one version string. Malwarebytes lists 155.0.8059.39 for Linux and 154.0.8037.39 or .40 for Windows and Mac [16].
What to watch
- A report that any of the four Critical CVEs is under active exploitation; that would set a deadline the current record lacks.
- Published details for the two Critical bugs Malwarebytes did not describe, including their component and whether they reach outside the sandbox.
- A security fix list for Android build 155.0.8059.39 as its rollout widens past the initial small percentage of users.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On October 6, Google released a Stable Channel Update for Desktop for Chrome that includes 247 security fixes, four of them rated Critical.
- [2]
CVE-2026-106197 is a use-after-free vulnerability in Chrome's Browser module, rated Critical; exploitation would allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
- [3]
Malwarebytes called CVE-2026-106197 "a strong priority candidate" because of its location in browser functionality rather than a specialist feature.
- [4]
CVE-2026-106358 is a use-after-free in Navigation, rated Critical, that lets a remote attacker execute arbitrary code outside the sandbox via a crafted HTML page; Malwarebytes said Navigation is central to ordinary browsing, making it a potentially broadly exposed flaw if attacker-controlled pages or redirects can reach the vulnerable path.
- [5]
Malwarebytes' write-up does not report any of the fixed flaws as exploited in the wild and does not attribute them to any threat actor.
- [6]
Automatic updating is the easiest option, but users can lag behind on updates if they never close the browser or if something goes wrong, such as an extension preventing the update.
- [7]
To update manually, open About Google Chrome from the settings or Help menu; Chrome checks for updates, and if one is available, clicking Relaunch applies it.
- [8]
CVE-2026-106240 is a type confusion vulnerability in V8, Chrome's JavaScript engine, rated High; successful exploitation lets a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page.
- [9]
Malwarebytes wrote that a flaw in the JavaScript engine is "always a plausible candidate for attacks delivered through malicious web content."
- [10]
Malwarebytes wrote that Chrome vulnerabilities enabling remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, "often without requiring additional exploitation steps."
- [11]
On the same day, Google released Chrome 155.0.8059.39 for Android to a small percentage of users; it may not be on Google Play for everyone yet, and Google says it includes stability and performance improvements.
- [12]
Google also released a ChromeOS update; a Chromebook checks for and downloads updates when it connects to the internet, and a restart completes the update.
- [13]
Malwarebytes identified three of the fixed vulnerabilities as likely high-impact flaws: CVE-2026-106197, CVE-2026-106358 and CVE-2026-106240.
- [14]
A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed, which can cause crashes or, in some cases, allow an attacker to run their own code.
- [15]
Two of the four Critical bugs in the October 6 release are not described in the Malwarebytes write-up.
- [16]
The October 6 desktop update brings Chrome to version 155.0.8059.39 for Linux and versions 154.0.8037.39/.40 for Windows and Mac.
Sources
2 independent publishers whose own reporting we read for this story.
- malwarebytes.comUpdate Chrome and ChromeOS to fix critical security issues
1 article · October 7, 2026
- securityweek.comChrome 155 Update Patches 247 Vulnerabilities - SecurityWeek
2 articles · October 7, 2026
Topics and entities
Topics
- Browser security
- AI Vulnerability Discovery and Exploitation
- Use-after-free vulnerabilities
- Patch And Redeploy Latency