Google Patches Critical Use‑After‑Free Flaws in Chrome & ChromeOS (CVE‑2026‑106197, CVE‑2026‑106358, CVE‑2026‑106240)
What Happened — Google released stable‑channel updates for Chrome (v155.0.8059.39 on Linux, v154.0.8037.39/40 on Windows/macOS) and ChromeOS (v155.0.8059.39) on Oct 6 2026. The releases contain 247 security fixes, including four Critical use‑after‑free and type‑confusion vulnerabilities (CVE‑2026‑106197, CVE‑2026‑106358, CVE‑2026‑106240, plus one additional critical flaw).
Why It Matters for Trust & Control Assurance
- Timely patching of browsers is a core control objective: maintain a documented, repeatable process to remediate known vulnerabilities before they can be leveraged.
- Continuous evidence of patch compliance (version inventories, update logs) provides a defensible audit trail for frameworks such as NIST CSF 2.0.
- Demonstrating that your organization enforces automatic updates or validates manual patches aligns with the Control Mapping capability, turning raw patch data into continuous assurance evidence.
Who Is Affected — Enterprises and end‑users across all sectors that rely on Chrome or ChromeOS, including technology SaaS providers, financial services, healthcare, education, and government workstations.
Recommended Actions
- Verify that auto‑update is enabled on all Chrome browsers and ChromeOS devices.
- Run an inventory check to confirm the installed version meets the new release numbers.
- Capture and retain update logs as part of your patch‑management evidence repository.
- Integrate the version‑check into your continuous control‑monitoring platform to flag any lagging endpoints.
Source: Malwarebytes Labs
Technical Notes
- CVE‑2026‑106197: Use‑after‑free in the Browser module; remote code execution (RCE) outside the sandbox via crafted HTML.
- CVE‑2026‑106358: Use‑after‑free in Navigation; similar RCE path through malicious redirects.
- CVE‑2026‑106240: Type‑confusion in V8 JavaScript engine; enables arbitrary code execution.
- All three are rated Critical (CVSS ≥ 9.0) and could let an attacker execute native code without additional exploits.
Source: [Malwarebytes Labs]