Which browsers are affected by the Chrome 155 update?

Directly, Google Chrome itself on Windows, macOS, and Linux. Other Chromium-based browsers (Microsoft Edge, Brave, Opera) typically receive matching patches separately and slightly later — worth checking those for updates too.

Were these vulnerabilities exploited in real-world attacks?

As of the patch release and the technical write-ups (October 6–7, 2026), no confirmed cases of active in-the-wild exploitation had been reported.

What does the "assisted by Claude" note in Google's bulletin mean?

It's Google's official annotation on a vulnerability entry, indicating the researcher used Anthropic's Claude AI model as a tool while hunting for and analyzing the bug. The human researcher remains the credited finder, with the AI listed as the tool that assisted.

← All news

October 15, 2026

Chrome 155: AI Helped Find Critical Security Bugs

Emily ParkerContent & SEO Specialist

Chrome 155: AI Helped Find Critical Security Bugs

In short: On October 6, 2026, Google released Chrome 155 — one of the browser's largest security updates in recent memory, fixing 247 vulnerabilities, including four critical ones. All four critical flaws are use-after-free bugs that can let an attacker hijack a browser process. Two of them were found by researcher Xinyang Ge with help from Anthropic's Claude AI model — a rare public example of generative AI contributing to real vulnerability research before attackers get there first. No active exploitation in the wild had been reported as of publication, but updating is still urgent: detailed write-ups tend to accelerate working exploits, as happened recently with the Telegram Desktop flaw — more in our guide to the risks of unpatched devices.

What exactly Chrome 155 fixes

Of the 247 vulnerabilities patched, 4 are rated critical, 53 high-severity, and roughly 190 medium or low. The update shipped for Windows and macOS (versions 155.0.8059.39/.40) and Linux (155.0.8059.39). All four critical flaws share the same bug class — use-after-free, where a program keeps using a memory region after it has been freed, which can in theory allow arbitrary code execution inside the browser. The affected components are Chromecast (CVE-2026-106382), Browser (CVE-2026-106197), Navigation (CVE-2026-106358), and Track (CVE-2026-106347).

How AI entered the vulnerability hunt

The most notable detail of this update is the origin of two of the four critical bugs. Google officially credits Navigation (CVE-2026-106358) and Track (CVE-2026-106347) to researcher Xinyang Ge of Anthropic, and both entries carry the note "assisted by Claude" — meaning the findings were made with help from the Claude AI model. This doesn't mean AI independently "found the bug" without human involvement; it describes a researcher-plus-model pairing, where AI speeds up code analysis and the hunt for patterns typical of use-after-free bugs. Still, a public credit like this in Chrome's official security bulletin is a notable signal that AI tools are becoming a working part of vulnerability research at major companies, not a one-off experiment.

Why this matters beyond developers

For an ordinary user, the specific CVE details matter less than the underlying fact: a bug of this class can, in theory, let an attacker hijack a browser process through a specially crafted page or script, with no action from the victim beyond opening that page. According to coverage of the update, no active in-the-wild exploitation had been confirmed as of patch release, but detailed technical write-ups and working proofs-of-concept typically follow within weeks. The browser is the entry point for nearly everything you do online — banking, email, web-based messengers, work tools — so keeping it current matters more than almost any other installed app.

What to do right now

Update Chrome to version 155.0.8059.39 or newer — it usually updates automatically on restart; check your version under Settings → About Google Chrome.
Restart the browser after updating — a downloaded patch only takes effect after a restart, not silently in the background.
Review your extensions — old or abandoned extensions can stay exploitable even after the browser itself is patched; see our piece on malicious browser extensions.
This isn't Chrome-only: Edge, Brave, Opera and other Chromium-based browsers share the same engine — check for updates there too.

A browser-level flaw like this has nothing to do with traffic encryption, and no VPN substitutes for a software update. But on untrusted networks — cafés, airports, hotels — it's still worth encrypting your traffic separately from browser patches: LiMP VPN hides which sites and services you visit from the network owner. Plans start at 69 ₽/month, verified no-logs policy: pricing.

FAQ

A few quick answers about Chrome 155 and AI's role in finding these bugs.

Sources

← All news