Chrome 155 update fixes ten security bugs, one rated critical

Chrome 155 update fixes ten security bugs, one rated critical

15 October 2026: Google has moved the Chrome Stable channel to 155.0.8059.84 and .85 on Windows and Mac and 155.0.8059.84 on Linux, fixing ten security bugs. The worst, CVE-2026-110922, is a critical use-after-free in Prerender, the feature that loads a page in the background before the user clicks. Google says the build will roll out over the coming days and weeks, so a desktop fleet left to update itself may run the vulnerable version for a while yet.

The ten fixes by severity

The release notes list one critical, six high and three medium issues:

• Critical: CVE-2026-110922, use after free in Prerender.
• High: CVE-2026-110913, memory corruption in DOM; CVE-2026-110919 and CVE-2026-110921, use after free in V8; CVE-2026-110920, memory corruption in V8; CVE-2026-110918, memory corruption in Core; CVE-2026-110917, memory corruption in SVG.
• Medium: CVE-2026-110916, improper input validation in Desktop; CVE-2026-110915, use after free in Compositing; CVE-2026-110914, memory corruption in Workers.

Three of the high-severity bugs sit in V8, the JavaScript engine, which is the usual route for a malicious page to reach memory. An outside researcher, Xinyang Ge, is credited with five of the ten reports, all filed between 29 September and 5 October. Google's own teams found the rest, and the oldest dates back to April.

Google does not say that any of the flaws is being exploited, and it keeps the bug details closed until most users have updated. The Hong Kong Computer Emergency Response Team Coordination Centre published its own bulletin the next morning. It says a remote attacker could use the flaws to cause a denial of service or run code, and it advises updating to the versions above.

Making sure managed machines actually update

Chrome downloads the new build in the background but only switches to it after a restart, so a browser that stays open for days keeps running the old code. On a single machine, the About Google Chrome page shows the running version and triggers the update. In a managed estate, the version report in the Chrome admin tools, or an endpoint inventory, shows which machines are still below 155.0.8059.84. A relaunch notification policy tells users when a restart is due.

The fixes land in Chromium, so Microsoft Edge, Brave, Opera and the other browsers built on it need their own releases with the same patches. Each vendor publishes them on its own schedule, and Google's notes do not cover them. A fleet that standardises on another Chromium browser should watch that vendor's release notes rather than Chrome's.

Chrome 156 is already close

The same release page shows Chrome 156 going out to a small share of users as an early Stable build on 14 October, ahead of its full release. Teams that pin versions or hold back updates for testing will meet the next major version within weeks.

Related on TrustList:

• Drupal fixes critical Field UI flaw with a no-login path via add-ons
• Nextcloud's built-in Collabora server flaw was exploited before disclosure
• Attackers exploit SiteGuard WAF flaw that runs commands as root

Sources

• Chrome Releases: Stable Channel Update for Desktop, 15 October 2026
• HKCERT security bulletin: Google Chrome multiple vulnerabilities, 16 October 2026