Google has shipped a Chrome desktop update that fixes 37 security vulnerabilities, seven of which the company rates critical, its highest severity tier. The new stable build is 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux, and Google says it will roll out over the coming days and weeks.
The release notes do not say any of the bugs are being exploited in the wild, which sets this update apart from the September release that patched an exploited V8 zero-day. Even so, a browser is the piece of software most people point at untrusted content all day, so a batch of critical memory bugs is a good reason not to wait for the automatic restart.
Seven critical bugs, mostly memory errors
Google's stable channel announcement lists the critical issues as:
- CVE-2026-110152, a buffer overflow in ANGLE, Chrome's graphics translation layer
- CVE-2026-110149, a use after free in Browser
- CVE-2026-110136, a use after free in PDF
- CVE-2026-110161, a use after free in Network
- CVE-2026-110165, a use after free in Core
- CVE-2026-110148, a use after free in SVG
- CVE-2026-110151, a use after free in Media
A "use after free" is a bug where the program keeps using a piece of memory after it has handed it back. Google has not published technical details for any of these issues, and as usual it says access to bug details may stay restricted until most users have updated. CVE scores have not been published alongside the release, so the ratings above are Google's own.
Of the remaining fixes, 29 are rated high and one medium. The high-severity list includes three bugs in V8, Chrome's JavaScript engine (two use after free issues and a type confusion), several more in Media, PDF, PDFium and SVG, plus an information leak in the Passwords component, a privilege elevation in the installer and incorrect authorization issues in the Updater and Mojo components.
One researcher, fifteen bugs
The credit list is unusually lopsided. Researcher Xinyang Ge is credited with 15 of the 37 fixes, including three of the seven critical bugs (in PDF, SVG and Media). One of those credits reads "Xinyang Ge (Anthropic), assisted by Claude". Google's own teams reported a large share of the rest, and the critical ANGLE overflow was reported by Zhenpeng (Leo) Lin at depthfirst.
That fits a pattern visible across recent Chrome releases, where each stable update now carries dozens of memory-safety fixes. Recent weeks brought a fix for two sandbox escape bugs and Chrome 154's 108 fixes, 11 of them critical.
Update to 155.0.8059.79 or later
Chrome updates itself, but the fix only takes effect after a browser restart. To check, open Settings, then About Chrome, and confirm the version is 155.0.8059.79 (Linux) or 155.0.8059.79/.80 (Windows and Mac) or later. Administrators managing fleets should push the build through their usual channel rather than waiting for the staged rollout. Other Chromium-based browsers typically pick up these fixes in their own updates, so watch for those too.
Hong Kong's HKCERT has also issued a bulletin on the release. With no exploitation reported yet, this is the easy window: patching before anyone has a working exploit costs a restart, patching after costs a lot more.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.