Chrome 155: 7 Critical Buffer Overflow, Use-After-Free Flaws Patched on Desktop, Android

The short version

• Google released Chrome 155 updates on October 13 and 14, fixing 37 security vulnerabilities, seven of which are rated critical.
• Critical flaws include a buffer overflow in the ANGLE graphics component and use-after-free errors in PDF, networking, and media subsystems.
• Desktop users should update to version 155.0.8059.79 or .80, while Android users should look for version 155.0.8059.79.

The details

Google issued several Chrome updates on October 13 and 14, according to Malwarebytes Labs. The desktop stable channel moves to version 155.0.8059.79 for Linux and 155.0.8059.79 or .80 for Windows and macOS. Android users receive version 155.0.8059.79, which also includes stability and performance improvements. The update addresses 37 security flaws, with seven rated critical, 29 high, and one medium, as reported by GBHackers.

One critical vulnerability is CVE-2026-110152, a buffer overflow in the ANGLE graphics-translation layer on Android. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. ANGLE translates graphics commands for Chrome, and the overflow occurs when data exceeds the memory area’s capacity, overwriting adjacent memory.

Another critical issue is CVE-2026-110136, a use-after-free vulnerability in the PDF component. This flaw also allows remote code execution outside the sandbox through a crafted page. A second PDF flaw, CVE-2026-110147, is rated high and allows code execution inside the sandbox. Use-after-free bugs occur when a program accesses memory after it has been freed, potentially allowing attackers to run malicious code.

The remaining five critical flaws are use-after-free vulnerabilities in other browser components. CVE-2026-110149 affects the browser, CVE-2026-110161 affects networking, CVE-2026-110165 affects core components, CVE-2026-110148 affects SVG, and CVE-2026-110151 affects media. These issues were reported by researchers Zhenpeng “Leo” Lin and Xinyang Ge between September 30 and October 6.

High-severity vulnerabilities include CVE-2026-110140, a type confusion issue in V8, and use-after-free flaws CVE-2026-110169 and CVE-2026-110168 in V8. Other high-severity issues involve WebRTC, DOM, Canvas, ShapeDetection, passwords, and media components. Google did not confirm whether any of these flaws are being actively exploited in the wild.

The context

Chrome vulnerabilities that enable remote code execution outside the sandbox are particularly valuable to attackers. They can turn a visit to a malicious website into direct code running on the operating system, often without additional exploitation steps. Code running inside the sandbox is restricted to the browser environment, limiting attacker access to the rest of the device. However, attackers often chain multiple vulnerabilities to escape the sandbox and achieve a more serious compromise.

The patched versions resolve weaknesses across graphics, networking, PDF processing, media, and JavaScript execution. Google distributes updates over the coming days and weeks. Automatic updates are the easiest option, but users may lag behind if they never close the browser or if extensions prevent updates. Manual updates are available by opening About Google Chrome in the settings or help menu and clicking Relaunch.

What to watch

• Monitor for the availability of Chrome 155.0.8059.79 on Android, as it may not be available on Google Play for all users immediately.
• Check for manual update prompts if automatic updates fail due to extensions or browser usage patterns.
• Watch for further advisories from Google regarding active exploitation of these vulnerabilities.
• Verify that all devices in your environment have successfully applied the latest Chrome version.

What it means for organisations

Teams usually prioritize patching browsers that expose critical remote code execution flaws, especially those outside the sandbox. Security leaders should verify that update policies cover all operating systems, including Android devices managed by the organization. IT staff need to confirm that automatic updates are functioning correctly and that no extensions are blocking installations. Communication should reach all users to encourage restarting browsers after updates. Risk managers should assess exposure to crafted web pages and PDFs, as these are common attack vectors.

What to do and how to stay safe: Google Chrome

• Open Chrome’s settings menu and navigate to About Google Chrome to manually check for the latest version.
• Click Relaunch if an update is available to apply the security fixes immediately.
• Review installed extensions to ensure none are preventing automatic updates from completing.
• Encourage users to close and reopen their browsers regularly to allow pending updates to install.

Step-by-step guide: Secure Home Routers for Small Business Networks

General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-110152?

CVE-2026-110152 is a critical buffer overflow vulnerability in the ANGLE graphics-translation layer of Chrome on Android, allowing remote code execution outside the sandbox.

Are these vulnerabilities being actively exploited?

Google did not confirm whether any of these vulnerabilities are being actively exploited in the wild, according to GBHackers.

How many critical vulnerabilities are in Chrome 155?

Chrome 155 addresses seven critical vulnerabilities, including flaws in ANGLE, PDF processing, networking, and media components.