Google Chrome Update Fixes 37 Security Vulnerabilities, Including 7 Critical Flaws

Google has released Chrome 155 for Windows, macOS, and Linux, addressing 37 security vulnerabilities, including seven critical flaws.

Announced on October 13, 2026, this desktop update resolves weaknesses across various browser components, including graphics, networking, PDF processing, media, and JavaScript execution.

The update includes seven critical vulnerabilities, 29 high-severity issues, and one medium-severity vulnerability, making it a significant security enhancement.

The patched versions are 155.0.8059.79/.80 for Windows and macOS, and 155.0.8059.79 for Linux. Google said it will distribute updates over the coming days and weeks.

The announcement identifies the affected components and vulnerability classes but does not provide detailed exploitation requirements.

Additionally, Google did not confirm whether these vulnerabilities are being actively exploited in the wild, so they should not be classified as zero-day vulnerabilities.

Seven Critical Vulnerabilities Patched

Among the critical vulnerabilities is CVE-2026-110152, a buffer overflow in ANGLE, reported by Zhenpeng “Leo” Lin at depthfirst on September 30.

The other six critical issues involve use-after-free flaws: CVE-2026-110149 in the browser, CVE-2026-110136 in PDF processing, CVE-2026-110161 in networking, CVE-2026-110165 in core components, CVE-2026-110148 in SVG, and CVE-2026-110151 in media. Together, these vulnerabilities affect distinct browser subsystems rather than a single flawed component.

Google reported critical vulnerabilities in the browser, networking, and core components. In contrast, Xinyang Ge reported issues in PDF, SVG, and media. They submitted these reports between October 1 and October 6.

Although Google rates each flaw as critical, the advisory does not provide information on attack chains, proof-of-concept exploits, or whether the individual vulnerabilities could independently compromise a device. Therefore, their severity should be distinguished from unverified claims about specific attacker capabilities.

The 29 high-severity vulnerabilities include CVE-2026-110140, a type confusion issue in V8, along with V8 use-after-free flaws CVE-2026-110169 and CVE-2026-110168.

Google credits Xinyang Ge of Anthropic, assisted by Claude, with reporting CVE-2026-110169 on September 28. Other memory-related vulnerabilities involve WebRTC, DOM, Canvas, ShapeDetection, SVG, PDF, passwords, and media, highlighting the wide range of components impacted by this patch.

Several high-severity issues relate to authorization and privilege handling rather than memory lifecycle errors. These include missing authorization in ReadingMode, incorrect authorization in Updater and Mojo, and privilege escalation in Installer.

Google also fixed an information leak in the passwords manager, incorrect reference resolution in extensions, buffer overflows in animation and PDFium, and an uninitialized variable issue in a third-party component. The sole medium-severity vulnerability, CVE-2026-110142, affects the FileSystem.

Google noted that access to technical bug details may remain restricted until most users receive the fixes. Restrictions may persist if an affected third-party library is shared with projects that have not yet patched it.

This limits publicly available information on triggering conditions and exploitability, while still allowing Google to disclose identifiers, severity ratings, affected components, researcher credits, and selected reward information.

The release also highlights Google’s testing toolkit, which includes AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL. These tools complement researchers’ reports by helping identify security defects during Chrome development.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.