Chrome’s new update closes 37 vulnerabilities, seven of which are critical

Google has released a new security update for the desktop version of the Chrome browser. On Windows and macOS, it has been updated to version 155.0.8059.79/.80, and on Linux to 155.0.8059.79. According to the company’s release notes, this update fixes 37 security vulnerabilities, seven of which are classified as “critical.”

Seven critical-level vulnerabilities

The bugs marked as critical include a buffer overflow in the ANGLE component (CVE-2026-110152), a use-after-free in the Browser component (CVE-2026-110149), a use-after-free in PDF (CVE-2026-110136), a use-after-free in Network (CVE-2026-110161), a use-after-free in Core (CVE-2026-110165), a use-after-free in SVG (CVE-2026-110148), and a use-after-free in Media (CVE-2026-110151).

NVD records assign a CVSS score of 9.6 to CVE-2026-110136, CVE-2026-110161, and CVE-2026-110165; CVE-2026-110144 and CVE-2026-110159 are also listed with the same score. The descriptions say that opening a crafted page could allow an attacker to execute code in the browser. Some bugs are noted as allowing code to escape the security sandbox, while others can be triggered with the help of a local program.

Which components are affected

The high-risk group includes type confusion and use-after-free bugs in the V8 engine (CVE-2026-110140, CVE-2026-110168, CVE-2026-110169), a buffer overflow in PDFium (CVE-2026-110155), and vulnerabilities in the WebRTC (CVE-2026-110137), DOM (CVE-2026-110163 and CVE-2026-110164), Media (CVE-2026-110171, CVE-2026-110172), Animation (CVE-2026-110166), SVG (CVE-2026-110157), Desktop (CVE-2026-110162), and Passwords (CVE-2026-110158, CVE-2026-110145) components. The list also includes an information disclosure related to the password manager (CVE-2026-110146) and authorization flaws in the Updater and Mojo components.

According to NVD records, some of the vulnerabilities are platform-specific. CVE-2026-110165 affects Chrome on Android, CVE-2026-110156 affects extensions on macOS, and CVE-2026-110144 affects the Mojo channel on Windows. All desktop installations of Chrome prior to these version numbers are considered to be within the affected version range.

How to update

Chrome downloads the update in the background on its own. Those who want to check immediately can close and reopen the browser, or go to the three-dot menu in the top right, choose “Help,” and then “About Chrome” to check the version instantly. On Android and iOS, the Chrome app needs to be updated through the store.

Google’s release note does not state that these vulnerabilities are being actively exploited, but it keeps bug details restricted until most users have received the update. Given that the browser is a primary tool used throughout the day, even delaying the update for a few days leaves the attack surface open. In corporate environments, teams that centrally manage browser updates need to complete the rollout within this week.

Source: Chrome Releases · NVD