Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI.

The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026.

Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to prompt an update check.

The most serious issue is CVE-2026-110922, a critical use-after-free flaw in Chrome’s Prerender feature. Google credits Xinyang Ge with reporting it on October 2.

A use-after-free bug occurs when software tries to use memory after it has been released. Depending on how an attacker can reach the flaw, this type of error may cause a crash or allow memory corruption. Google has not published further technical details and has not said the issue is being exploited.

CVE-2026-110913 is a high-severity memory corruption flaw in Chrome’s DOM, the browser system that represents and manages the structure of web pages.

Google Fixes 10 Chrome Vulnerabilities

Ge reported the bug on September 29, with Claude’s assistance. Google’s release note does not explain how the issue was found, whether Claude identified the flaw or helped with analysis, or what steps were involved. It does, however, publicly credit the AI’s assistance in the report.

The other high-severity fixes affect V8, Chrome’s JavaScript engine, as well as Core and SVG. They include two additional use-after-free flaws in V8, CVE-2026-110919 and CVE-2026-110921, and memory corruption issues CVE-2026-110918, CVE-2026-110917, and CVE-2026-110920. The reports came from Ge, Google, and researcher C0rk1.

The three medium-severity bugs involve improper input validation in Desktop, a use-after-free issue in Compositing, and memory corruption in Workers.

Google credited its own researchers with reporting these flaws. Together, the list shows that this release addresses problems in separate browser components rather than a single feature or subsystem.

Google says detailed bug information may remain restricted until most users have installed the fixes. This can limit what researchers and users can learn about the vulnerabilities while the update is spreading.

The company also said it uses tools such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL to find security bugs during development.

Chrome updates are delivered gradually, so users may not receive the new version at the same time. Check the browser’s About Google Chrome page and restart it if prompted to complete installation. Organizations should follow their normal browser update process and confirm that managed devices receive the fixed release.

This update follows other recent Chrome security coverage, including Google’s earlier report on a large Chrome vulnerability update and coverage of multiple Chrome flaws. Google’s Stable Channel announcement and Chrome Security page provide the primary release information.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI appeared first on Cyber Security News.

Google released a Chrome security update that addresses 37 vulnerabilities, including seven critical flaws that raise concerns about memory corruption and possible code execution.

Published on October 13, 2026, the update covers Windows, Mac, and Linux, with fixes spanning graphics, PDF handling, media processing, networking, and other browser components.

According to Google’s Stable Channel Update for Desktop, the patched versions are 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux. The release includes seven critical, 29 high, and one medium-severity security fixes.

Google says it will continue distributing updates over the coming days and weeks. The critical vulnerabilities include CVE-2026-110152, a buffer overflow in ANGLE, Chrome’s graphics translation layer. Zhenpeng “Leo” Lin at depthfirst reported the issue on September 30.

Buffer overflows can corrupt memory when software writes beyond the space reserved for data, potentially creating opportunities for attackers to change program behavior.

The remaining six critical entries are use-after-free flaws. CVE-2026-110149 affects Browser, CVE-2026-110136 affects PDF, CVE-2026-110161 affects Network, and CVE-2026-110165 affects Core.

Multiple Google Chrome Vulnerabilities

Google also patched CVE-2026-110148 in SVG and CVE-2026-110151 in Media. These findings involve Google researchers and Xinyang Ge.

A use-after-free vulnerability occurs when software continues accessing memory after releasing it. Depending on the bug, attackers may influence that memory’s contents, causing crashes, corrupting data, or potentially running malicious code. However, the flaw category alone does not enable an attack against every affected component.

Cybersecurity News previously covered Chrome’s update fixing 247 vulnerabilities, including four critical use-after-free issues. The latest release continues that focus on memory safety across multiple browser features rather than a single isolated component.

Among the high-severity vulnerabilities, CVE-2026-110169 affects V8, Chrome’s JavaScript and WebAssembly engine. Rapid7’s vulnerability record states that a crafted HTML page could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox in versions before 155.0.8059.79.

That limitation matters. Code execution inside the sandbox does not, by itself, prove an attacker can take control of the entire operating system.

Google’s release announcement does not describe a complete attack chain or confirm that these newly patched vulnerabilities are being exploited in the wild.

Google credits Xinyang Ge at Anthropic, assisted by Claude, with reporting CVE-2026-110169. Other high-severity fixes address V8 type confusion, buffer overflows in Animation and PDFium, a Passwords information leak, Installer privilege elevation, and authorization problems in ReadingMode, Updater, and Mojo.

For background, Cybersecurity News’ coverage of earlier ANGLE and V8 security fixes explains how memory-handling issues repeatedly affect graphics and script processing.

Users should open Chrome’s menu, select Help, then About Google Chrome to check for updates. After installation, select Relaunch to apply the fixes. Linux users should update through their package manager. Google’s Chrome update guide explains these steps.

Google may restrict detailed bug reports until most users receive patches. Restrictions may also remain if affected third-party libraries haven’t been fixed elsewhere, limiting the technical information currently available to readers and defenders.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks appeared first on Cyber Security News.

Google has released Chrome 153 to the Stable channel for Windows, macOS, and Linux, addressing 16 security vulnerabilities, including two critical memory-safety flaws in Dawn and WebGL.

The update is rolling out as version 153.0.8010.52/.53 for Windows and macOS, while Linux users will receive version 153.0.8010.52.

The most severe issue, tracked as CVE-2026-93374, is a critical use-after-free vulnerability in Dawn, Chrome’s implementation of the WebGPU graphics API.

Use-after-free bugs occur when software continues accessing memory after releasing it. In browser environments, such flaws can potentially enable attackers to corrupt memory, crash the browser, or execute arbitrary code through a specially crafted website or web application.

Florian Schweitzer reported the Dawn vulnerability to Google on April 8, 2026. Google has not yet disclosed the reward amount associated with the report.

Chrome 153 Patches 16 Security Vulnerabilities

Chrome 153 also fixes CVE-2026-93372, a critical buffer overflow vulnerability in WebGL. WebGL lets websites render interactive 2D and 3D graphics directly in the browser.

A buffer overflow can occur when an application writes more data into a memory buffer than it can hold, potentially allowing malicious content to overwrite adjacent memory and alter program execution.

Google reported the WebGL issue internally on August 17, 2026. The company has not released technical details about either critical flaw, a common practice intended to give users time to install the update before exploit information becomes broadly available.

The release further addresses eight high-severity vulnerabilities across several Chrome components. These include an incorrect reference resolution flaw in Tracing, a use-after-free and buffer overflow issue in PDFium, improper state validation in Skia, a use-after-free bug affecting Extensions, incorrect authorization in ORB, and a type confusion vulnerability in the V8 JavaScript engine.

Type confusion flaws in V8 are particularly important because V8 processes JavaScript from websites. An attacker may attempt to exploit such a vulnerability by causing the engine to treat one kind of object as another, which can lead to memory corruption and potentially support browser sandbox escape chains when combined with additional vulnerabilities.

The remaining fixes cover medium- and low-severity issues in FileSystem, Omnibox, Permissions, DataTransfer, Storage, Paint, and WebAppInstalls.

These include a race condition, server-side request forgery, information leaks, an out-of-bounds read, missing authorization checks, and a UI misrepresentation issue.

Google said it will keep bug details and related links restricted until most Chrome users have updated. Restrictions may also remain in place when affected third-party libraries are used by other projects that have not yet issued fixes.

Users should update Chrome immediately by opening the browser menu, selecting Help, and then About Google Chrome. Chrome normally downloads updates automatically, but users must restart the browser to apply them.

Organizations should prioritize deployment across managed endpoints because attackers can exploit browser vulnerabilities through routine web browsing, malicious advertisements, phishing pages, and compromised legitimate websites.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws appeared first on Cyber Security News.