Google released a Chrome security update that addresses 37 vulnerabilities, including seven rated Critical, exposing weaknesses across the browser, graphics, networking, and document-processing components.
Published on October 13, 2026, the advisory lists 29 high-severity flaws and one medium-severity issue, with memory safety defects dominating the disclosed vulnerabilities.
The update advances Chrome to versions 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux.
Critical Google Chrome Flaws
The most severe findings, CVE-2026-110152 is a buffer overflow in ANGLE, reported by Zhenpeng “Leo” Lin at depthfirst on September 30.
The remaining critical vulnerabilities involve use-after-free conditions in Browser, PDF, Network, Core, SVG, and Media, demonstrating that the fixes span several distinct Chrome subsystems and components.
Google credits its researchers with the critical Browser, Network, and Core discoveries. Xinyang Ge reported the critical PDF, SVG, and Media vulnerabilities.
These classifications establish the severity of the underlying defects, but the release notes do not establish whether any particular issue enables remote code execution or bypasses Chrome’s sandbox.
The high severity fixes extend to V8, WebRTC, DOM, Canvas, PDFium, passwords, extensions, and installation infrastructure. They include multiple use-after-free defects, buffer overflows in Animation and PDFium, and a V8 type confusion vulnerability.
Separate authorization weaknesses affect ReadingMode, Updater, and Mojo, broadening the update beyond memory corruption alone.
Other disclosed issues include an information leak in Passwords, privilege elevation in Installer, incorrect reference resolution in Extensions, and an uninitialized variable in the component identified as “ThirdParty lmza_sdk.”
Google also lists an observable discrepancy in Media. The sole medium severity vulnerability, CVE-2026-110142, involves use-after-free in FileSystem functionality.
One noteworthy attribution concerns CVE-2026-110169, a high-severity V8 use-after-free flaw reported by Xinyang Ge of Anthropic, assisted by Claude.
Google awarded Findingz $1,000 for CVE-2026-110162 in Desktop. Several other rewards remain undetermined, while numerous entries list N/A instead of a disclosed monetary award.
Google warns that access to bug details may remain restricted until most users have installed fixes. Restrictions can also continue when a vulnerability affects a third-party library used by other projects that remain unpatched.
Consequently, the public announcement leaves important questions about triggering conditions and practical exploitation unanswered today.
The announcement does not state that these vulnerabilities are being exploited in the wild. Its confirmed remediation is the updated Stable release for Windows, Mac, and Linux.
| CVE | Severity | Component | Vulnerability type |
|---|---|---|---|
| CVE-2026-110152 | Critical | ANGLE | Buffer overflow |
| CVE-2026-110149 | Critical | Browser | Use after free |
| CVE-2026-110136 | Critical | Use after free | |
| CVE-2026-110161 | Critical | Network | Use after free |
| CVE-2026-110165 | Critical | Core | Use after free |
| CVE-2026-110148 | Critical | SVG | Use after free |
| CVE-2026-110151 | Critical | Media | Use after free |
| CVE-2026-110162 | High | Desktop | Use after free |
| CVE-2026-110170 | High | Bindings | Use after free |
| CVE-2026-110160 | High | ReadingMode | Missing authorization |
| CVE-2026-110143 | High | ThirdParty lmza_sdk | Use of uninitialized variable |
| CVE-2026-110146 | High | Passwords | Information leak |
| CVE-2026-110150 | High | Installer | Privilege elevation |
| CVE-2026-110156 | High | Extensions | Incorrect reference resolution |
| CVE-2026-110137 | High | WebRTC | Use after free |
| CVE-2026-110140 | High | V8 | Type confusion |
| CVE-2026-110158 | High | Passwords | Use after free |
| CVE-2026-110145 | High | Passwords | Use after free |
| CVE-2026-110159 | High | Updater | Incorrect authorization |
| CVE-2026-110144 | High | Mojo | Incorrect authorization |
| CVE-2026-110153 | High | Media | Use after free |
| CVE-2026-110166 | High | Animation | Buffer overflow |
| CVE-2026-110169 | High | V8 | Use after free |
| CVE-2026-110168 | High | V8 | Use after free |
| CVE-2026-110139 | High | Media | Use after free |
| CVE-2026-110172 | High | Media | Use after free |
| CVE-2026-110164 | High | DOM | Use after free |
| CVE-2026-110163 | High | DOM | Use after free |
| CVE-2026-110141 | High | Media | Observable discrepancy |
| CVE-2026-110138 | High | ShapeDetection | Use after free |
| CVE-2026-110157 | High | SVG | Use after free |
| CVE-2026-110147 | High | Use after free | |
| CVE-2026-110154 | High | Canvas | Use after free |
| CVE-2026-110155 | High | PDFium | Buffer overflow |
| CVE-2026-110167 | High | Media | Use after free |
| CVE-2026-110171 | High | Media | Use after free |
| CVE-2026-110142 | Medium | FileSystem | Use after free |
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
