Google shipped 37 security fixes in a single Chrome desktop update on Oct. 13, and seven of them carry the top severity rating of Critical. The release, version 155.0.8059.79 or .80 depending on the platform, covers Windows, Mac and Linux and is rolling out in stages over the coming days and weeks.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one free daily email from TLDR.
We may earn a commission if you sign up.
The batch splits into 7 Critical, 29 High and 1 Medium flaws, according to Google’s release notes. Most are memory-safety errors, a class of bug that browser makers have fought for years, and the list leans heavily on a single bug type known as use-after-free.
Chrome 155’s critical and high-severity fixes
The Stable Channel Update for Desktop names 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. It was posted on Tuesday, Oct. 13, and is signed by Srinivas Sista of the Chrome team. The company’s Chrome Releases blog also shows an Early Stable build, 156.0.8078.35/.36, going to a small percentage of Windows and Mac users on Oct. 14, a sign that the next version is already close.
Google’s notice adds that access to bug details and links may stay restricted until a majority of users have updated, and that restrictions may remain in place if a bug exists in a third-party library other projects depend on. The practical consequence is that the public descriptions are thin, which is normal for the first days of a rollout: each entry lists a component, a bug type, a reporter and a date, not a working explanation of how an attack would unfold.
The Critical flaws and the components they touch
Under Chromium’s published severity guidelines, a Critical issue lets an attacker read or write arbitrary resources on the underlying platform with the user’s full privileges, for example through browser-process memory corruption reachable from web content. That is the category the seven fixes fall into.
They are CVE-2026-110152, a buffer overflow in ANGLE, the graphics translation layer, reported on Sept. 30 by Zhenpeng (Leo) Lin of depthfirst; and use-after-free bugs in the Browser (CVE-2026-110149), PDF (CVE-2026-110136), Network (CVE-2026-110161), Core (CVE-2026-110165), SVG (CVE-2026-110148) and Media (CVE-2026-110151) components. Google’s own security team found three of the seven, and the researcher Xinyang Ge reported three more.
The 29 High-severity entries are broader in kind. They include a type confusion in the V8 JavaScript engine, an information leak and use-after-free bugs in Passwords, privilege elevation in the Installer, an incorrect authorization in the Updater, and further use-after-free errors in the DOM, Canvas and WebRTC code, plus a buffer overflow in Animation. One lone Medium flaw sits in FileSystem. Ge, whose name recurs through the table, is credited on one V8 entry as “Xinyang Ge (Anthropic), assisted by Claude.”
Money paid out for the discoveries is largely not yet settled. Only one reward is listed in the post: $1,000 for CVE-2026-110162, a High-severity use-after-free in the Desktop component reported by a researcher using the name Findingz. The remaining entries show N/A, or TBD while rewards are still being decided.
A use-after-free bug occurs when a program keeps using a piece of memory after releasing it, which can let an attacker steer what the browser does next. Six of the seven Critical entries and most of the High entries fit that description, which is why the Chromium guidelines treat memory corruption reachable from web content as the most serious class of flaw. Google credits a toolbox of bug-hunting methods for the finds, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL.
Outside researchers are named across the High-severity list as well. Hoyong Jin is credited with the information leak in Passwords, M. Fauzan Wijaya with the privilege elevation in the Installer, Aria Akhavan of Haikhavan Security with the incorrect authorization in the Updater, and Souma Ohsawa with an incorrect authorization in Mojo. Each of those four carries a reward status of TBD, so payouts have not yet been announced.
Getting the update on a desktop
Chrome normally updates itself in the background, but the browser has to restart to finish the job, and a window left open for days can keep running the older, vulnerable build. With seven Critical flaws in the batch, a restart is worth doing sooner rather than later. Google’s update instructions are to open the More menu, choose Help and then About Google Chrome, and click Relaunch. If no Relaunch button appears, the browser is already current. Chrome reopens tabs and windows after the restart, though Incognito windows do not come back.
Administrators who manage fleets of machines follow a different path. Google’s release notes page for Chrome Enterprise and Education says browser updates follow the Early Stable Release date and points to the Chromium Dash schedule for exact timing. Because the 155 rollout is staged, some machines may not be offered the update on the first day, and a manual check is the quickest way to find out.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
