Google published a Chrome 155 security update on October 13, 2026 that fixes 37 vulnerabilities, seven of them critical.
Key Facts
- Google’s Chrome update fixes 37 security flaws, with seven rated critical, 29 high and one medium.
- Use-after-free errors make up 25 of the 37 flaws. This memory bug lets software reuse data it already released.
- At least 15 of the vulnerabilities were reported by Xinyang Ge (Anthropic), assisted by Claude, according to SecurityWeek.
- Google’s release announcement does not describe a complete attack chain or confirm that these newly patched vulnerabilities are being exploited in the wild.
37 fixes, and one researcher reported 15 or more
Two earlier rounds were smaller. Our Chrome security coverage shows that Google Chrome 149 fixes 18 security vulnerabilities, including four critical and 14 high severity flaws. A separate Chrome stable update on September 4 fixed 12 vulnerabilities. Those rounds total 30.
Google found 12 security defects. Ge’s reports are at least 40.5% of the batch. If the counts do not overlap, one researcher working with an AI model reported more flaws than Google’s own team found.
Google handed out $1,000 for a high-severity issue reported by an external researcher. It has yet to disclose the reward amounts for the remaining external reports. For the Ge reports, no bug bounty reward will be paid.
Google ships Chrome 155 update fixing 37 vulnerabilities, seven of them Critical. Critical fixes include buffer overflow CVE-2026-110152 in ANGLE and six Use After Free issues in Browser, PDF, Network, Core, SVG and Media. Twenty-nine High-severity Use After Free flaws affect V8, WebRTC, DOM and other components. #Chrome #CVE #Patch
— World Cybersecurity News (@WorldCyberNewsX) October 14, 2026
Cybersecurity News names Ge on fewer entries, listing CVE-2026-110148 in SVG and CVE-2026-110151 in Media as findings that involve Google researchers and Xinyang Ge. Joint credit means the two counts may overlap, so they should not be added together.
Firefox 158, released the same day, credits Mozilla (40) and Amy Burnett of OpenAI (9) with most of its 77 fixes. Both advisories now carry credit lines tied to AI labs, and neither source says how those reports are paid.
Every critical is a memory bug
Of the seven critical flaws, CVE-2026-110152 is a buffer overflow in ANGLE, Chrome’s graphics translation layer. The remaining six critical entries are use-after-free flaws in Browser, PDF, Network, Core, SVG and Media. Use-after-free weaknesses represented the majority of the 29 high-severity bugs.
Counting buffer overflows too, 28 entries are use-after-free or buffer-overflow bugs. The other 9 entries are all rated high.
These include a V8 type confusion and a Passwords information leak. Four are access-control bugs: Installer privilege elevation and authorization problems in ReadingMode, Updater, and Mojo. A count by bug type, not severity alone, shows the patch also closes permission gaps that a memory-safety framing hides.
CVE-2026-110169 affects V8, Chrome’s JavaScript and WebAssembly engine.
Rapid7’s record, describes a crafted HTML page that could let a remote attacker execute arbitrary code inside Chrome’s sandbox. Running code in that sandbox does not by itself prove an attacker can take over the whole operating system.
What’s Next?
Patched builds are 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux. Users should open Chrome’s menu, select Help, then About Google Chrome to check for updates.
Google says it will continue distributing updates over the coming days and weeks. It may restrict detailed bug reports until most users receive patches. Installing the update helps reduce exposure, and public technical detail on the new flaws may stay thin until the rollout finishes.
