Google patches 37 Chrome flaws, including seven critical bugs in version 155

Google released updates for Chrome version 155 on October 13 and 14, 2026, fixing 37 security vulnerabilities, according to Malwarebytes Labs and GBHackers. The patch includes seven critical flaws that could allow attackers to run malicious code on a user's device through a crafted webpage. These updates address weaknesses in graphics, networking, PDF processing, media, and JavaScript execution components.

How it unfolded

• On October 13 and 14, 2026, Google issued Chrome 155 updates for desktop operating systems and Android devices.
• The desktop update brought Chrome to versions 155.0.8059.79 and 155.0.8059.80 for Windows and Mac, and 155.0.8059.79 for Linux.
• Google released version 155.0.8059.79 for Android on the same day, though availability on Google Play may vary by user.
• The update resolves 37 vulnerabilities, including seven critical issues, 29 high-severity problems, and one medium-severity flaw.

Who is affected

Users of Chrome on Windows, Mac, Linux, and Android are affected by these flaws. The seven critical vulnerabilities include CVE-2026-110152, a buffer overflow in ANGLE on Android reported by Zhenpeng “Leo” Lin, and six use-after-free flaws. These use-after-free bugs affect the browser, PDF processing, networking, core components, SVG, and media, as reported by Xinyang Ge of Anthropic. High-severity issues include type confusion and use-after-free flaws in the V8 JavaScript engine.

What happens next

Google will roll out the updates over the coming days and weeks. Users can allow Chrome to update automatically or manually check for updates in the settings or Help menu. If an update is available, users should click Relaunch to apply it. Some users may lag behind if they never close the browser or if an extension prevents the update. Google did not confirm whether these vulnerabilities are being actively exploited in the wild.

The background in plain language

Teams usually monitor browser updates because unpatched flaws can let attackers run code on a device. A buffer overflow happens when a program puts too much data into memory, overwriting adjacent areas. A use-after-free error occurs when code accesses memory after it has been freed. Sandbox escapes are serious because they allow code to run outside the browser's restricted environment, potentially affecting the entire operating system.

Background: Sandbox escape vulnerabilities

Sandboxes do not create new security boundaries; they rely on the underlying operating system. If the host kernel has a vulnerability, the sandbox is transparent. Assume the sandbox can be bypassed via kernel exploits or resource exhaustion, not just application logic errors.

Read the full guide: Sandbox Escape Myths: Why Your Isolation Strategy Fails

What to do and how to stay safe: Google Chrome

• Check your Chrome version in the settings menu and update to 155.0.8059.80 or later on desktop.
• Ensure automatic updates are enabled in Chrome settings to receive future patches without delay.
• Restart your browser after an update is downloaded to apply the security fixes immediately.
• Monitor for official advisories from Google regarding active exploitation of these vulnerabilities.

Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are these Chrome vulnerabilities being actively exploited?

Google did not confirm whether these vulnerabilities are being actively exploited in the wild, so they are not classified as zero-day vulnerabilities.

How many critical flaws are in the Chrome 155 update?

The update includes seven critical vulnerabilities, 29 high-severity issues, and one medium-severity vulnerability.

What is CVE-2026-110152?

CVE-2026-110152 is a critical buffer overflow vulnerability in ANGLE on Android that could allow remote code execution outside the sandbox.