Organisations urged to patch Chrome 155 after 37 security flaws addressed
Google releases updates for Windows, Mac, Linux and Android fixing 37 vulnerabilities, seven rated critical, to stop remote code execution.
Key points
- Google issued Chrome 155 updates on 13 and 14 October 2026 for desktop and Android devices.
- The patch resolves 37 security flaws, including seven critical bugs and 29 high-severity issues.
- Critical defects include a buffer overflow in ANGLE and use-after-free errors in PDF processing.
Organisations should update their Google Chrome browsers immediately after the vendor released patches for 37 security vulnerabilities, seven of which are rated critical. The updates, issued on 13 and 14 October 2026, address serious defects that could allow attackers to run malicious code on user devices through crafted webpages, according to Malwarebytes Labs.
The desktop update brings Windows and Mac users to versions 155.0.8059.79 or .80, while Linux users receive version 155.0.8059.79. Android devices also get version 155.0.8059.79, though availability on Google Play may vary. Google stated that these updates include stability and performance improvements alongside the security fixes.
What we know
GBHackers reported that the update resolves weaknesses across graphics, networking, PDF processing, media and JavaScript execution components. The advisory lists seven critical vulnerabilities, 29 high-severity issues and one medium-severity flaw. One critical defect, CVE-2026-110152, is a buffer overflow in the ANGLE graphics-translation layer on Android, discovered by Zhenpeng “Leo” Lin.
Other critical flaws involve use-after-free vulnerabilities in the browser, PDF processing, networking, core components, SVG and media. Xinyang Ge reported several of these issues between 1 and 6 October. Google did not confirm whether any of these vulnerabilities are being actively exploited in the wild, so they are not classified as zero-day attacks.
Defender's checklist
- Verify that all managed Chrome installations have reached version 155.0.8059.79 or higher on desktop platforms.
- Monitor Android device fleets for the rollout of version 155.0.8059.79, as availability on Google Play may be staggered.
- Check internal logs for signs of exploitation attempts targeting ANGLE or PDF processing components during the update window.
- Ensure automatic update settings are enabled to prevent devices from lagging behind due to extensions or open browser sessions.
The background in plain language
Browsers use sandboxes to restrict what code can access on a device. Flaws allowing code to run outside this sandbox are dangerous because they give attackers direct access to the operating system. Use-after-free errors occur when software accesses memory after it has been released, potentially letting attackers inject malicious instructions. Buffer overflows happen when too much data is forced into a memory space, overwriting adjacent areas. Teams usually prioritise patching these issues quickly to prevent remote code execution. Regular updates reduce exposure to such memory corruption bugs.
Background: Use-after-free vulnerabilities
Prevent use-after-free errors by enforcing strict memory ownership rules, using smart pointers, and enabling compiler hardening. This checklist covers code structure, build configuration, and runtime defenses to stop dangling pointer exploits before they compromise your software.
Read the full guide: Use-After-Free Vulnerabilities Prevention Checklist for Secure Code
What to do and how to stay safe: Google Chrome
- Manually check for updates by opening the Help menu and selecting About Google Chrome to force an immediate version check.
- Restart the browser after an update is downloaded to ensure the new security patches are fully applied to the running process.
- Review installed extensions, as some may prevent automatic updates from completing successfully and leave systems vulnerable.
- Watch for official vendor announcements regarding new updates, as Google stated that updates will roll out over the coming days and weeks.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these Chrome vulnerabilities actively being exploited?
Google did not confirm whether these vulnerabilities are being actively exploited in the wild, so they are not classified as zero-day vulnerabilities.
What is the severity rating of the most serious flaws?
Seven of the 37 security flaws are rated critical, while 29 are rated high-severity and one is rated medium-severity.
Which components are affected by these security fixes?
The update resolves weaknesses in graphics, networking, PDF processing, media, JavaScript execution, browser, core, SVG, V8, WebRTC, DOM, Canvas and ShapeDetection.
