Google fixes 27 Chrome vulnerabilities, eight of them critical, in version 155.0.8059.79

What happened

On 13 October Google shipped a Stable Channel update for Chrome on desktop that fixes 27 vulnerabilities. They come on top of the Chromoting authorisation flaw on Mac (CVE-2026-106195) we reported on 8 October. According to NVD, all of them are fixed in version 155.0.8059.79. Google's post on its Chrome Releases blog adds no further detail in the text available, so the technical information below comes from NVD entries.

Most are use-after-free bugs, where the browser reuses memory it has already released. The rest are buffer overflows, a type confusion and two authorisation errors. In almost every case, a victim only needs to open a malicious web page. The most serious ones allow an attacker to escape the sandbox, the barrier that isolates web content from the rest of the system.

• Critical (CVSS 9.6), code execution outside the sandbox: CVE-2026-110136 (PDF), CVE-2026-110149 (Browser), CVE-2026-110142 (FileSystem) and CVE-2026-110161 (Network, via crafted network traffic).
• Critical (CVSS 9.6), Chrome on Android only: CVE-2026-110152 (ANGLE) and CVE-2026-110165 (Core).
• Critical (CVSS 9.6), requiring a program running on the machine: CVE-2026-110144 (Mojo, Windows only) and CVE-2026-110159 (Updater).
• High (CVSS 8.8), code execution inside the sandbox, in Media and WebRTC: CVE-2026-110137, CVE-2026-110139, CVE-2026-110151, CVE-2026-110153, CVE-2026-110167, CVE-2026-110171 and CVE-2026-110172.
• High (CVSS 8.8), other components: CVE-2026-110140, CVE-2026-110168 and CVE-2026-110169 (V8 engine); CVE-2026-110147 and CVE-2026-110155 (PDF and PDFium); CVE-2026-110148 and CVE-2026-110157 (SVG); CVE-2026-110163 and CVE-2026-110164 (DOM); CVE-2026-110154 (Canvas); CVE-2026-110162 (Desktop) and CVE-2026-110166 (Animation).

Who is affected

Any device running Google Chrome older than version 155.0.8059.79 is affected. Two of the critical flaws affect only Chrome on Android, and one affects only Windows; the rest do not name a specific platform.

Chromium's own severity ratings do not always match the CVSS scores. For instance, Google rates CVE-2026-110142 as medium, while it lists CVE-2026-110148 and CVE-2026-110151 as critical despite their CVSS 8.8.

Exploitation status

None of the 27 vulnerabilities appears in CISA's KEV catalogue of flaws with confirmed active exploitation, and no public exploit is known. FIRST puts the chance of exploitation within the next month at between 0.1% and 0.3%, so exploitation is considered unlikely for now. Even so, five of the eight critical bugs can be triggered simply by visiting a malicious website, so the update should not be delayed.

What to do

Updating is the only definitive fix. We recommend the following steps:

• Update Google Chrome to version 155.0.8059.79 or later on every device, then restart the browser so the update takes effect.
• In managed environments, use your admin console or asset inventory to confirm that no machines are still on older versions.
• Update Chrome on corporate Android devices through Google Play or your mobile device management platform.
• On machines already updated after the 8 October advisory, check that they are now on 155.0.8059.79 so that CVE-2026-110136 and the rest of this batch are also fixed.
• Remind users to be careful with links and PDF files from unknown sources until the rollout is complete.

Sources

• Google Chrome Releases: Stable Channel Update for Desktop (13 October 2026)

Affected technologies

Vulnerabilities (27)