Google shipped two Chrome desktop stable-channel updates two days apart, on October 13 and October 15, 2026. Together they fix 47 security vulnerabilities, eight of them rated critical. The October 13 release moved Chrome to 155.0.8059.79/.80 on Windows and Mac and 155.0.8059.79 on Linux, with 37 security fixes. The October 15 release moved it to 155.0.8059.84/.85 on Windows and Mac and 155.0.8059.84 on Linux, with 10 more.

Neither release note says an exploit exists in the wild for any of the 47 issues. CISA's ADP enrichment on NVD rates exploitation as "none" for the two critical CVEs examined here, and none of the CVEs appears in CISA's Known Exploited Vulnerabilities catalog as of its October 16 release. Google says both builds "will roll out over the coming days/weeks."

The October 13 release: 37 fixes

Google's release note lists 7 critical, 29 high and 1 medium-severity fix, the same breakdown SecurityWeek reported. The seven critical issues:

  • CVE-2026-110152: buffer overflow in ANGLE, reported by Zhenpeng (Leo) Lin at depthfirst on September 30, 2026.
  • CVE-2026-110149: use after free in Browser, reported by Google.
  • CVE-2026-110136: use after free in PDF, reported by Xinyang Ge.
  • CVE-2026-110161: use after free in Network, reported by Google.
  • CVE-2026-110165: use after free in Core, reported by Google.
  • CVE-2026-110148: use after free in SVG, reported by Xinyang Ge.
  • CVE-2026-110151: use after free in Media, reported by Xinyang Ge.

For the ANGLE bug, NVD's description says it "allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page." CISA's ADP assigned it a CVSS 3.1 base score of 9.6. NVD's text refers to Chrome on Android prior to 155.0.8059.79, even though Google lists the fix in its desktop release note. The bounty for the ANGLE report is listed as "TBD."

The release note gives no further technical detail on the other critical bugs. Google says access to bug details "may be kept restricted until a majority of users are updated with a fix."

The high-severity list includes CVE-2026-110162, a use after free in Desktop reported by Findingz, which carries a $1,000 bounty. It also includes CVE-2026-110169, a use after free in V8 that Google credits to "Xinyang Ge (Anthropic), assisted by Claude." The single medium-severity fix is CVE-2026-110142, a use after free in FileSystem reported by Andrew Boni.

The October 15 release: 10 more fixes

The only critical item in the second update is CVE-2026-110922, a use after free in Prerender. The release note credits it to Xinyang Ge and dates the report to October 2, 2026. NVD's description says it allowed a remote attacker "to execute arbitrary code inside the sandbox via a crafted HTML page" in Chrome prior to 155.0.8059.84. Google rates it critical, while CISA's ADP gives it a CVSS 3.1 score of 8.8, which falls in the High band.

The other nine fixes:

  • High: CVE-2026-110913 (memory corruption in DOM); CVE-2026-110919 and CVE-2026-110921 (use after free in V8); CVE-2026-110920 (memory corruption in V8); CVE-2026-110918 (memory corruption in Core); CVE-2026-110917 (memory corruption in SVG).
  • Medium: CVE-2026-110916 (improper input validation in Desktop); CVE-2026-110915 (use after free in Compositing); CVE-2026-110914 (memory corruption in Workers).

Who found the bugs

Credits in both release notes show where the reports came from. For October 13, SecurityWeek counts at least 15 of the 37 flaws as reported by Xinyang Ge of Anthropic, assisted by Claude, and says no bounty will be paid for them. SecurityWeek says Google found 12 itself and that, the same day, Google announced higher bug bounty rewards for some Chrome vulnerabilities. In the October 15 note, Xinyang Ge is credited on five of the 10 fixes, including the critical Prerender bug. Google is credited on four, and a researcher listed as C0rk1 on the SVG bug.

SecurityWeek covered Firefox in the same report. It says Firefox 158 fixed 77 security defects, 30 of them high severity. Mozilla found 40 of them, and Amy Burnett of OpenAI found 9. SecurityWeek puts the combined Chrome and Firefox total at 114, counting the October 13 Chrome release. Thunderbird 158 and 153.5 and Firefox ESR 153.5 and 115.43 also include patches for many of these issues.

Mozilla also introduced Firefox Enterprise, a browser for organizations with strict security, governance and compliance requirements. According to SecurityWeek, it includes a management console that organizations can host on their own infrastructure to manage policies, access, data transfers and AI use.

What It Means for Defenders

  • Use the October 15 build as the baseline. A machine that installed only the October 13 update still lacks the Prerender fix and the nine other October 15 fixes.
  • Confirm the browser relaunched. Chrome applies a downloaded update only after a relaunch. Use endpoint management or Chrome Enterprise reporting to find devices still on 155.0.8059.79/.80 or earlier, and consider a relaunch-notification policy that forces a restart.
  • Check other Chromium-based browsers separately. Confirm with each vendor, including vendors of embedded Chromium runtimes, that its current build includes the 155.0.8059.84 fixes.
  • Patch Mozilla products in the same window. Move Firefox to 158, Firefox ESR to 153.5 or 115.43, and Thunderbird to 158 or 153.5, depending on the channel you deploy.
  • Watch for a change in exploitation status. No KEV due date applies today. If Google amends a note to say an exploit exists in the wild, or CISA adds one of these CVEs to KEV, treat it as an emergency patch.

Sources