Key points
- Chrome Stable 155.0.8059.79/.80 includes 37 security fixes for Windows, Mac and Linux.
- Chrome Extended Stable 152.0.7977.167 contains 28 security fixes for Windows and Mac.
- Updates address critical issues including buffer overflows in ANGLE and use-after-free flaws in multiple components.
Attackers exploiting these flaws could potentially execute arbitrary code or crash the browser, gaining significant control over affected systems. The vulnerabilities span various components, from rendering engines to network handling, requiring users to update their browsers to mitigate the risk.
In plain English
The latest updates resolve serious security holes that allow malicious actors to manipulate how Chrome handles memory. These flaws, categorised as critical or high severity, exist in parts of the browser responsible for processing graphics, documents and network requests. Without the patch, a compromised website could trigger these errors to run unauthorised software.
The background
Google released version 155.0.8059.79 for Windows and Mac, with Linux receiving version 155.0.8059.79, according to the Stable Channel Update advisory. The Extended Stable channel moved to version 152.0.7977.167 for Windows and Mac. The Stable update addresses 37 issues, while the Extended Stable update covers 28. Details for some bugs remain restricted until most users have updated.
What changes now
Users on both channels should ensure their browsers have automatically updated to the latest versions. The rollout will occur over the coming days and weeks. Administrators managing fleets should verify that endpoints have received the specific version numbers mentioned in the advisories to ensure protection against the disclosed CVEs.
The attacker's path
Teams usually monitor for unusual memory access patterns or unexpected process spawns that indicate exploitation of memory corruption flaws. Check whether endpoints are running the patched versions immediately, as unpatched systems remain vulnerable to remote code execution. Verify that automatic update mechanisms are functioning correctly across all managed devices to minimise the window of exposure during the rollout period.
What to do and how to stay safe: Google Chrome
- Verify that all managed endpoints have updated to Chrome 155.0.8059.79 or 152.0.7977.167.
- Monitor for any failed update attempts on devices that have not received the latest build.
- Ensure automatic updates are enabled for Chrome to receive future security patches promptly.
- Review browser extension policies to reduce the attack surface for potential exploitation.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many security fixes are in the Chrome Stable update?
The Chrome Stable update includes 37 security fixes, according to the official advisory.
Which operating systems are affected by the Extended Stable update?
The Extended Stable update applies to Windows and Mac systems, as stated in the release notes.
Are details for all vulnerabilities publicly available?
No, access to bug details may be restricted until a majority of users have updated with the fix.
