Google Chrome Update Addresses 37 Vulnerabilities, Including 7 Critical Flaws

Google has announced a security update for its Chrome browser, addressing a total of 37 vulnerabilities. This includes seven critical flaws that raise alarm over memory corruption and potential code execution issues. The release, which took place on October 13, 2026, targets Windows, Mac, and Linux users, implementing fixes across a variety of browser components such as graphics, PDF handling, media processing, and networking.

The updated versions include 155.0.8059.79 and 155.0.8059.80 for Windows and Mac, respectively, while Linux users will update to version 155.0.8059.79. The update is structured as follows: seven critical, 29 high, and one medium-severity security fixes.

Among the notable critical vulnerabilities is CVE-2026-110152, identified as a buffer overflow in ANGLE, Chrome’s graphics translation layer. Zhenpeng “Leo” Lin from depthfirst reported this issue on September 30. A buffer overflow can allow memory corruption when the software writes beyond its allocated space, potentially enabling attackers to alter the program’s intended behaviour.

The other six critical vulnerabilities are classified as use-after-free errors. CVE-2026-110149 pertains to the Browser, CVE-2026-110136 concerns PDF processing, CVE-2026-110161 relates to Network functions, and CVE-2026-110165 is connected to Core operations. Additionally, CVE-2026-110148 and CVE-2026-110151 affect SVG and Media components, respectively. Use-after-free vulnerabilities occur when software continues to access memory that has already been released, which can lead to crashes, data corruption, or the execution of malicious code.

Despite the severity of these vulnerabilities, not all software components are equally susceptible to attacks due to the nature of the flaws. Cybersecurity News had previously highlighted an update that addressed 247 vulnerabilities, including four critical use-after-free flaws, highlighting Google’s ongoing emphasis on memory safety across diverse browser functionalities.

High-severity vulnerabilities include CVE-2026-110169, which affects V8, the JavaScript and WebAssembly engine in Chrome. According to Rapid7’s vulnerability record, a specially crafted HTML page could allow an attacker to execute arbitrary code within Chrome’s sandbox in versions prior to 155.0.8059.79. It is important to note that executing code within the sandbox does not necessarily grant an attacker control over the entire operating system.

Google's announcement did not clarify whether these vulnerabilities are currently being exploited in real-world scenarios. Notably, the company credited Xinyang Ge from Anthropic, alongside assistance from Claude, for reporting CVE-2026-110169. Other high-severity fixes involve V8 type confusion, buffer overflows in the Animation and PDFium components, as well as privilege elevation issues tied to the Installer and authorization problems in ReadingMode, Updater, and Mojo.

For users wishing to apply these updates, they can navigate to Chrome's menu, select Help, and then About Google Chrome. After installing the updates, users should select 'Relaunch' to ensure that the fixes are applied. For Linux users, updates are available through their package manager as detailed in Google’s update guide.

Google may limit the availability of detailed bug reports until most users have received the necessary patches. Restrictions may persist for third-party libraries that remain unaddressed, which may also hinder the availability of detailed technical information for users and cybersecurity defenders alike. Users are encouraged to update their systems to defend against emerging malware threats as they appear. Google regularly advises its users to remain vigilant regarding cybersecurity threats and maintain updated software systems.