Chrome 155.0.8059.79/.80 Fixes 37 Security Flaws, Including 7 Critical Bugs

Coming just six days after Chrome 155 initially hit the Stable channel on October 7 with an eye-watering 247 security fixes (versions 155.0.8059.39/.40), this follow-up release proves that browser engine maintenance in late 2026 is operating at breakneck speed. Whether you are a daily Windows 11 power user with forty tabs pinned in perpetuity or an enterprise systems administrator keeping endpoint compliance dashboards green, here is a complete breakdown of what is inside this update, why memory safety bugs continue to dominate the threat landscape, and what you need to do to lock down your system.

Release Overview: Versions, Channels, and Staged Rollout​

According to Google's official Chrome Releases blog, the October 13 update spans both desktop and mobile ecosystems, ensuring parity across the platforms where users spend most of their time.

Google notes that its Android release includes the same underlying security patches as the corresponding desktop build unless explicitly noted otherwise. Because Google distributes desktop updates in staged waves over "the coming days/weeks," two PCs sitting on the same desk might not receive the automatic background prompt at the exact same moment. However, triggering a manual update check in Chrome usually pulls the patch down immediately.

Section Summary: Chrome 155 has been updated to 155.0.8059.79/.80 on Windows and Mac and .79 on Linux and Android to resolve 37 security flaws.

Anatomy of the Seven Critical Vulnerabilities​

In Chromium's severity classification system, a Critical rating is reserved for vulnerabilities that could allow a remote attacker to execute arbitrary code, corrupt critical memory structures, or potentially bypass browser isolation boundaries without requiring complex user interaction beyond visiting a malicious or compromised webpage.

Out of the 37 total flaws addressed in this release, seven sit in that top-tier Critical category. One is a classic buffer overflow in the browser's graphics pipeline, while the remaining six are use-after-free (UAF) memory corruption bugs scattered across core rendering and networking subsystems.

1. The ANGLE Graphics Buffer Overflow (CVE-2026-110152)​

The headline flaw of the October 13 advisory is CVE-2026-110152, a Critical buffer overflow located in ANGLE (Almost Native Graphics Layer Engine). Reported on September 30, 2026, by researcher Zhenpeng "Leo" Lin at depthfirst, this vulnerability strikes a component that every Windows Chrome user relies on constantly.

What exactly does ANGLE do, and why is it such a sensitive target for Windows PCs? When a website renders 2D canvas graphics, WebGL content, or hardware-accelerated CSS animations, Chrome does not talk directly to every quirky graphics driver in the wild. Instead, ANGLE translates OpenGL ES API calls into the native hardware APIs of the host operating system—most notably Direct3D 11 and Direct3D 9 on Windows.

Because ANGLE sits right at the boundary between untrusted web content (such as shader programs or WebGL buffers supplied by a random webpage) and your system's GPU drivers and privileged graphics processes, a buffer overflow here is a five-alarm fire. If a crafted graphic payload can write data past the allocated memory buffer in ANGLE, it risks corrupting adjacent memory in the GPU process, which typically runs with higher system privileges than a standard isolated webpage renderer.

2. Six Critical Use-After-Free (UAF) Bugs​

The other six Critical vulnerabilities all share a single underlying mechanic: use-after-free (UAF). According to vulnerability tracking compiled by Google and corroborated by Security NEXT, these six Critical flaws span the following browser components:

• CVE-2026-110149: Use-after-free in Browser (affecting high-level browser process operations).
• CVE-2026-110136: Use-after-free in PDF (affecting Chrome's built-in PDF viewer pipeline).
• CVE-2026-110161: Use-after-free in Network (affecting network stack handling and data transport).
• CVE-2026-110165: Use-after-free in Core (affecting foundational Chromium engine routines).
• CVE-2026-110148: Use-after-free in SVG (affecting Scalable Vector Graphics parsing and rendering).
• CVE-2026-110151: Use-after-free in Media (affecting audio and video playback processing).

If you have followed browser security advisories over the past few years, the phrase "use-after-free" probably sounds like a broken record. In fact, as SecurityOnline noted in its analysis of this release, 25 of the 37 total bugs fixed in this build are use-after-free issues.

Why does this happen so frequently? Chromium is predominantly written in C++, a language prized for raw execution speed where memory allocation and deallocation are tightly managed. A use-after-free bug occurs when a program frees a block of dynamic heap memory because it thinks an object (say, an SVG element or a media stream) is no longer needed, but inadvertently leaves a "dangling pointer" referencing that exact memory address. If an attacker can use JavaScript to quickly fill that freed memory slot with maliciously crafted data before the browser tries to use the dangling pointer again, the browser can be tricked into treating the attacker's payload as legitimate executable instructions.

Section Summary: The seven Critical fixes consist of a buffer overflow in the ANGLE graphics translation layer (CVE-2026-110152) and six use-after-free flaws affecting Browser, PDF, Network, Core, SVG, and Media components.

Inside the 29 High-Severity Fixes: V8, Sandboxes, and AI-Assisted Bug Hunting​

Stepping one rung down from Critical brings us to the 29 High-severity vulnerabilities and one Medium-severity flaw (CVE-2026-110142, a use-after-free in the FileSystem component). While "High" might sound slightly less urgent than "Critical," in browser security, the distinction often comes down to whether a bug is trapped inside Chrome's security sandbox.

Google's release notes highlight a wide variety of High-severity patches across the browser's codebase, including:

• Additional Use-After-Free Flaws: Patched across Passwords, Media, V8, DOM, ShapeDetection, SVG, PDF, and Canvas.
• Buffer Overflows: Addressed in Animation and PDFium (Chrome's PDF rendering library).
• Incorrect Authorization: Fixed in the Chrome Updater and in Mojo (Chromium's inter-process communication system that ferries messages between sandboxed tabs and the privileged main browser process).
• Logic and State Flaws: Including an observable discrepancy in the Media component, alongside patches addressing information leaks and privilege elevation vectors.

Spotlight on CVE-2026-110169 and the Sandbox Boundary​

One standout High-severity vulnerability documented by Windows Report and Google's release notes is CVE-2026-110169, a use-after-free flaw in V8, Chrome's high-performance JavaScript and WebAssembly engine.

According to the CVE description, in versions prior to 155.0.8059.79, this flaw could allow a remote attacker to execute arbitrary code inside the sandbox simply by convincing a user to load a specially crafted HTML page.

For everyday Windows users, that phrasing—"arbitrary code execution inside the sandbox"—deserves a clear translation:

• What it means: The attacker can hijack the specific renderer process assigned to that malicious browser tab, allowing them to manipulate data within that site's memory space or spoof page behavior.
• What it does NOT automatically mean: It does not, by itself, grant the attacker access to your Windows filesystem, your registry, or other isolated applications running on your PC. Chrome's multi-process sandbox strips renderer processes of direct OS privileges.
• Why it still matters immensely: Sophisticated threat actors rarely rely on a single bug. In real-world exploit chains, an attacker uses a V8 bug like CVE-2026-110169 as the initial foothold, and then chains it with a second bug—such as a flaw in Mojo inter-process communication or the ANGLE GPU layer—to escape the sandbox altogether. Patching the V8 bug breaks the very first link in that chain.

The Rise of AI-Assisted Vulnerability Discovery​

There is another fascinating subplot hiding in Google's credit roll for CVE-2026-110169. Google credits Xinyang Ge of Anthropic, assisted by Claude, with reporting the V8 vulnerability on September 28, 2026.

Look back just one week to the initial Chrome 155 release on October 7 (which patched 247 flaws), and a clear industry trend emerges: as CloudLink Tech reported regarding that earlier October 7 milestone release, external researchers uncovered dozens of high-severity flaws, including roughly a dozen attributed to Ge with the assistance of artificial intelligence.

From an industry perspective, this explains why browser patch counts have suddenly spiked in October 2026. Defensive security researchers are now deploying large language models and automated reasoning agents to audit complex C++ state machines, DOM trees, and JavaScript compilers at a scale human eyes alone could never match. The catch? If defensive researchers can use AI to spot deep memory lifecycle bugs in V8 and ANGLE, offensive actors are undoubtedly trying to do the exact same thing. That makes rapid patching on client machines more critical than ever.

Section Summary: The 29 High-severity fixes resolve dangerous bugs in V8, Mojo, Updater, and PDFium. Notably, CVE-2026-110169 in V8 was discovered with AI assistance and allows code execution within the browser sandbox.

Exploitation Status and Why Details Remain Under Wraps​

Before anyone pulls the fire alarm in the server room, it is important to look at what Google has—and has not—said about real-world attacks:

• No Confirmed Active Exploitation: Google's October 13 advisory does not report that any of these 37 vulnerabilities are currently being exploited in the wild, nor does it establish a complete, weaponized attack chain for the newly patched bugs.
• Restricted Technical Disclosures: If you try to look up the granular bug tracker tickets on the Chromium Security Page right now, you will hit a digital velvet rope. Google explicitly restricts access to detailed bug reports and proof-of-concept triggers until a majority of Chrome's global user base has installed the update. Furthermore, Google keeps details locked if a vulnerability resides in a shared third-party open-source library (such as PDFium or ANGLE) that other software vendors and Chromium-based browsers still need time to patch.

For Windows users who split their time between Google Chrome and other Chromium-powered browsers—such as Microsoft Edge, Brave, Vivaldi, or Opera—this restriction policy is vital. Because those browsers share huge swaths of the underlying Chromium engine, V8, and ANGLE codebases, keeping the blueprint for CVE-2026-110152 private prevents attackers from reverse-engineering the patch and targeting sister browsers while their respective engineering teams finalize their own stable rollouts.

Section Summary: Google has not reported active in-the-wild exploitation for any of the 37 vulnerabilities, and technical bug tracker details remain restricted to protect unpatched users and downstream Chromium projects.

How to Update Google Chrome on Windows, Mac, and Linux​

Waiting days or weeks for Chrome's background updater to politely ask for a restart is an unnecessary gamble when seven Critical memory bugs are on the table. Updating takes less than thirty seconds.

Step-by-Step Guide for Windows and macOS Users​

• Launch Google Chrome on your desktop.
• Click the three-dot menu icon (Customize and control Google Chrome) in the top-right corner of the browser window.
• Hover your cursor over Help, then click About Google Chrome from the submenu. (Alternatively, type chrome://settings/help directly into your address bar and press Enter.)
• Chrome will immediately query Google's update servers and begin downloading the latest patch automatically.
• Once the download finishes, click the blue Relaunch button. Chrome will close and reopen, restoring your open tabs (though any unsaved text in standard web forms may be lost, so save your work first!).
• Verify that your browser now displays Version 155.0.8059.79 or 155.0.8059.80.

Note: If your browser checks for updates and still reports an older 155.0.8059.39/.40 build with a "Chrome is up to date" message, do not panic. Because Google's rollout is staged over days and weeks, your device cohort may still be queued; check back again in a few hours.

Updating on Linux and Enterprise Windows Environments​

• Linux Users: Rather than using the internal browser updater, run your distribution's standard package manager update routine (for example, sudo apt update && sudo apt --only-upgrade install google-chrome-stable on Debian/Ubuntu-based systems, or sudo dnf upgrade google-chrome-stable on Fedora/RHEL) to pull version 155.0.8059.79, then restart the browser.
• Windows IT Administrators: In managed corporate environments using Microsoft Intune, Group Policy (GPO), or third-party RMM tools, ensure that your Google Update administrative templates allow automatic updates or push the updated Enterprise MSI package. Because Chrome will not apply a downloaded update until the chrome.exe process is actually restarted, enforcing a scheduled relaunch notification policy ensures that users who never close their browsers do not leave unpatched renderer processes running in memory for weeks.

Between Microsoft's massive October 2026 Patch Tuesday rollout and two consecutive heavyweight Chrome 155 security updates in a single week, October is shaping up to be a marathon month for system hygiene. Take ten seconds to hit that Relaunch button—your GPU process and system memory will thank you.

Update: Microsoft acknowledges Chromium fixes, with Edge Stable update still pending (October 14, 2026)​

Microsoft has acknowledged the Chromium security fixes covered above but had not yet released the corresponding Edge Stable update as of Neowin’s October 14 report. According to Neowin, Microsoft’s October 13 security advisory says the company is aware of the fixes and is actively working on a security release. No release time was specified.

This adds a concrete status update to the earlier discussion of downstream Chromium browsers: Chrome’s patched build is available, while the matching Edge release reportedly remains pending. Updating Chrome does not update Edge, so Windows users who use both browsers should treat their patch status separately rather than assume that installing Google’s release also resolves Microsoft’s outstanding update.

For administrators, the practical distinction is that Chrome deployment completion should not be counted as Edge remediation. The report does not establish exactly which of the 37 vulnerabilities affect Edge, nor does it report active exploitation. Until Microsoft publishes the corresponding release details, the scope and delivery timing of Edge’s fixes remain unconfirmed.