Google Ships Third Chrome 155 Security Patch in Ten Days, Closing Nearly 300 Flaws Including Seven Critical Bugs

Google has shipped its third Chrome 155 security update in ten days, bringing the total number of vulnerabilities fixed across the three releases to nearly 300. The latest wave includes seven critical flaws patched on October 13, and Google has not reported any of the bugs as being exploited in the wild.

The October 13 stable-channel update, Chrome 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux, addresses 37 security vulnerabilities. Seven are rated critical, 29 are high severity and one is medium. Google says the fixes will reach users gradually over the coming days and weeks.

The critical bugs span several parts of the browser. One is a buffer overflow in ANGLE, Chrome's graphics translation layer, tracked as CVE-2026-110152 and listed as affecting Chrome on Android. The other six are use-after-free flaws in the browser itself, PDF processing, networking, core components, SVG and media. Use-after-free bugs occur when software keeps using memory after it has been released, which can let attackers corrupt data and, in some cases, run their own code.

A crafted web page can be enough to trigger some of these bugs. One PDF flaw, CVE-2026-110136, could allow code execution outside the browser's sandbox if exploited, according to the vulnerability description. The high-severity group includes problems in V8, Chrome's JavaScript and WebAssembly engine, as well as password management, extensions, WebRTC and PDF handling.

The October 13 release followed a far larger update on October 6, which fixed 247 vulnerabilities, including four critical memory-safety flaws, across Windows, Mac and Linux. All four critical entries in that batch were use-after-free bugs, and affected areas included the browser, navigation and Chromecast components. One of the critical issues in the browser component was reported to Google on September 11 by researcher Xinyang Ge.

On October 15, Google followed with Chrome 155.0.8059.84/.85, which fixes 10 more vulnerabilities, including a use-after-free bug in Prerender. Security trackers report no confirmed exploitation for that update either.

Not that Google has said. Unlike a zero-day emergency patch, none of the flaws in these updates has been listed as actively exploited. That distinction matters, but experts still urge users to update promptly. Once a patch is public, attackers can compare old and new code to work out what was fixed, and the gap between a patch and widespread installation is when users are most exposed.

On a desktop, open the three-dot menu, go to Help and choose About Google Chrome. Chrome will check for updates automatically. Click Relaunch to finish installing. You can confirm your version by typing chrome://version in the address bar. On Android, update Chrome through the Google Play Store.

Other browsers built on Chromium, such as Microsoft Edge, Brave and Opera, usually receive their own fixes separately, so check for updates there as well.

IT teams should confirm that managed devices have pulled the latest version, shorten update deferral windows and restart browsers promptly. Because Chrome often keeps running for days, a pending update does nothing until the browser is relaunched.

Most of the serious flaws in these releases are memory-safety bugs, a long-standing weakness in software written in languages such as C++. Chrome's size and complexity, with millions of lines of code handling web pages, graphics, media and documents, give researchers and attackers a large surface to probe. Rapid patching and bug bounty programmes help catch issues early, but large batches like this one are a regular feature of modern browser maintenance.