Google ships Chrome 155 updates fixing 37 security flaws, seven rated critical
Google released Chrome 155 patches for Windows, Mac, Linux and Android on October 13-14, addressing 37 security issues including seven critical bugs.
Key points
- Google issued Chrome 155 updates on October 13 and 14, fixing 37 security vulnerabilities.
- Seven flaws are rated critical, including a buffer overflow in ANGLE and use-after-free errors.
- The update affects Windows, macOS, Linux and Android, with versions 155.0.8059.79 or .80.
Google distributed Chrome 155 security updates for desktop and Android platforms on October 13 and 14, 2026. These patches address 37 identified security vulnerabilities, with seven classified as critical severity by the vendor.
The desktop updates bring Chrome to version 155.0.8059.79 or 155.0.8059.80 for Windows and Mac users. Linux users receive version 155.0.8059.79. Android devices also get version 155.0.8059.79, though Google noted availability may vary across the Google Play store initially.
Vulnerability Details and Severity
According to GBHackers, the release resolves seven critical, 29 high and one medium-severity issue. Critical flaws include CVE-2026-110152, a buffer overflow in the ANGLE graphics layer on Android. Malwarebytes Labs states this allows remote attackers to run code outside the sandbox via crafted HTML.
Other critical bugs involve use-after-free errors in browser, PDF, networking, core, SVG and media components. CVE-2026-110136 in PDF processing is one example, enabling arbitrary code execution outside the sandbox. High-severity issues include type confusion in V8 and memory flaws in WebRTC and DOM.
Affected Components and Reporting
Zhenpeng “Leo” Lin of depthfirst reported the ANGLE flaw on September 30. Xinyang Ge of Anthropic, assisted by Claude, reported V8 issue CVE-2026-110169 on September 28. Ge also submitted PDF, SVG and media flaws between October 1 and 6.
These vulnerabilities span multiple subsystems rather than a single component. Google did not confirm active exploitation in the wild, so these are not classified as zero-day attacks. That suggests the risks remain theoretical until proven otherwise in real-world scenarios.
What should you do?
Users should apply the latest Chrome update immediately to mitigate these risks. Manual checks are recommended if automatic updates fail due to open tabs or extension conflicts. Organizations should verify deployment across all endpoints to ensure consistency.
What to do and how to stay safe: Google
- Open Chrome settings and select "About Google Chrome" to check for and install the latest version manually.
- Ensure automatic updates are enabled in Chrome settings to prevent lagging behind on future security patches.
- Restart the browser completely after an update is downloaded to ensure the new version is fully applied.
- Monitor vendor advisories for confirmation of active exploitation, which would elevate the urgency of remediation.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these Chrome vulnerabilities being actively exploited?
Google has not confirmed any active exploitation in the wild, so they are not considered zero-day vulnerabilities at this time.
Which Chrome versions fix these security flaws?
Desktop versions are 155.0.8059.79 or .80 for Windows and Mac, 155.0.8059.79 for Linux, and 155.0.8059.79 for Android.
How many critical bugs are in this update?
There are seven critical-severity vulnerabilities, including a buffer overflow in ANGLE and several use-after-free flaws.
