Chrome 155 and GIMP Security Updates Patch High-Risk Memory Flaws

Two open source codebases, one kind of bug

This month two of the most widely installed desktop programs built on open source code each needed security patches, and the reasons were similar. Google shipped Chrome 155, which is built on the open source Chromium project, with 247 security fixes. Over the same weeks, Linux distributions released several rounds of GIMP updates for crafted image files that can corrupt memory and, in the worst cases, run an attacker's code. The two projects have very different scale and funding. Even so, most of the defects in both come down to code that handles memory unsafely when it reads input from someone else.

The main point here is not just that two well-known programs need updates. It is that open source software reaches users through different paths. The path a project's fixes take, whether through its own auto-updater or through a distribution's package queue, now affects users' risk about as much as the bugs themselves.

Chrome 155: a release of unusual size

Google moved Chrome 155 to the Stable channel on October 6. The desktop builds are 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux, and the rollout continues over the following days and weeks.11 Of the 247 fixes, Google rated four Critical, 53 High, 122 Medium and 68 Low.11 That is far larger than recent releases. The October 1 desktop update to 154.0.8037.97 contained only 11 security fixes.1120

All four Critical bugs are use-after-free flaws. They sit in the Chromecast, Browser, Navigation and Track components and are tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358 and CVE-2026-106347.1216 Google found the Chromecast bug itself, and researcher Xinyang Ge reported the other three.16 Two of Ge's findings, in Navigation and Track, are credited to Xinyang Ge of Anthropic, "assisted by Claude."1115 This is not new. The smaller Chrome 154 update a week earlier also included a WebRTC buffer overflow that Ge reported with the same AI assistance.20

The High-severity list is broad. A $5,000 bounty went to CVE-2026-102322, an incorrect-authorization flaw in Site Isolation, which is one of Chrome's core defenses for keeping websites apart.1115 Other fixes cover an integer overflow in WebGL, several uninitialized-resource bugs in the ANGLE graphics layer, and race conditions, type confusion and use-after-free flaws in the V8 JavaScript engine.1226 Separate CVE records describe a use-after-free in Chrome's HTML Parser that could let a remote attacker run code inside the sandbox through a crafted page.17 Another, Mac-only race condition could allow code execution outside the sandbox, but only if the attacker had already compromised the renderer and used social engineering.14

Where the Chrome coverage diverges

Outlets agree on the totals but describe the danger differently. Malwarebytes calls the Browser and Navigation use-after-free bugs top priorities and says each could let a remote attacker run code outside the sandbox through a crafted HTML page.13 Cybersecurity News is more cautious. It notes that Google's announcement classifies the bugs only as use-after-free and does not say whether they allow sandbox escape, need user interaction, or can be chained into a working attack.26 SecurityOnline assigns CVSS scores of 9.6 to three of the four Critical bugs and 8.8 to the Track flaw, a reminder that Chromium's own severity labels and CVSS numbers do not always line up.15

There is also a version-number mismatch. Malwarebytes lists the Windows and Mac builds as 154.0.8037.39/.40.13 Other reports give 155.0.8059.39/.40.1112 The second figure is more consistent with the CVE records, which list affected Chrome versions as those before 155.0.8059.39.17 Administrators checking their fleets should use the 155 build number.

The reporting does agree on one thing: Google has not said any of the 247 bugs were exploited in the wild, and details of the Critical flaws are still restricted.1115 That restraint should not be taken lightly. In September, Chrome patched a V8 out-of-bounds write that was already being actively exploited, in a release that also fixed 229 other flaws.25 Bugs can go from an embargoed fix to a working attack quickly.

GIMP: a steady run of file-parser bugs

GIMP's problems are less dramatic but just as instructive. There has been no single large release. Instead, a series of advisories from enterprise and community distributions has fixed one image-format parser after another.

A SUSE update from early October fixes ten vulnerabilities. They include heap- and stack-based buffer overflows and integer overflows in TIF and SGI parsing, plus an out-of-bounds write in the lighting effects plugin.5 SUSE scores several at CVSS 7.8.5 Red Hat's advisory RHSA-2026:75575, which AlmaLinux mirrored, is rated Important and covers out-of-bounds writes, heap overflows and integer overflows, including in the lighting effects and GIMPressionist plugins.2 SUSE also issued a functional equivalent of that Red Hat advisory. Debian's DSA-6509-1 fixes flaws reachable through malformed PSD, ICO, PIX and PCX files and through the light effects filter, with the fixed package at 3.0.4-3+deb13u11 for the stable "trixie" release.9 An earlier SUSE update addressed an unsigned integer underflow in the PSD plugin that allows arbitrary code execution, along with overflows in FLI, SGI, PCX and XWD handling.107

The disclosures keep coming. On October 7 a heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader was published. It is caused by 32-bit size calculations that overflow and lead to undersized allocations.8 A heap over-read in the X cursor thumbnail loader followed the same day, and one tracker listed its fix status as not yet reported.1 Two days later came a NULL-pointer crash in the XCF loader, triggered by a crafted file with an empty simulation parasite.21

Why GIMP's risk looks different from Chrome's

The two sets of bugs differ in severity, and the difference is easy to miss. Chrome's flaws can be reached by visiting a web page. GIMP's typical attack path is local and needs the victim to open a file. SUSE's CVSS vector for the 7.8-rated bugs shows local access and required user interaction.5 The XCF and XMC issues rate a Medium 5.5 and mainly threaten availability.211 The suggested workaround for the cursor-loader bug is to open or preview files only from trusted sources.1

That does not mean the bugs are harmless. VulDB's analysis of the DDS overflow argues that heap corruption of this kind can be shaped into code execution. It also notes that designers and other professionals often open images from email, downloads and shared drives without checking them.8 Image editors take in exactly the kind of untrusted, complex binary formats that attackers like to use.

The open source supply chain is the real story

The open source angle shows up in how these fixes reach users. Chrome's are delivered by a vendor. Google pushes the updates, and users mainly need to restart the browser.25 The Chromium code underneath, however, is reused by Linux distributions, and their packaged versions have to keep up. In September, SUSE, Debian, Fedora, RHEL and others shipped coordinated updates that included a Critical chromium package fixing 38 flaws.24 Google also says it may keep bug details restricted when a vulnerability affects a third-party library used by other projects that have not yet patched it.26 Under that policy, the open source projects around Chromium affect when the details can be disclosed.

GIMP shows the other side. Many of its CVEs come from Red Hat's tracker and are fixed through distribution errata, not a single upstream release.127 The same flaws then pass through AlmaLinux, Oracle Linux, MiracleLinux, openSUSE, Debian and TuxCare's extended-support builds on their own schedules.23 A Tenable check for an unpatched GIMP CVE across Linux distributions, dated September 14, predates several of the vendor fixes.2 Some users stayed exposed during that gap.

There is a clear pattern. Both projects are written in memory-unsafe languages, both parse large amounts of untrusted input, and both are now being examined more closely, partly by AI-assisted researchers. Chrome has Google's fuzzing infrastructure, including AddressSanitizer, libFuzzer and AFL, plus a bounty program to absorb that pressure.26 A volunteer-driven project like GIMP mostly relies on distribution security teams to triage and backport fixes. When discovery speeds up, the projects with less funding feel it first.

What to do now

Chrome users should confirm they are running 155.0.8059.39 or later and restart the browser, since a browser that stays open can delay updates.1325 Linux users should apply their distribution's latest gimp and chromium packages instead of waiting for upstream releases. Anyone who handles image files from outside sources should treat unfamiliar PSD, TIF, DDS and similar files with caution until GIMP is updated.589