Critical Chrome Flaws Let Attackers Corrupt Memory, Execute Code

Key Takeaways

• Google has released a critical security update for Chrome, addressing 37 vulnerabilities.
• Seven of these flaws are rated critical, primarily involving memory corruption issues like buffer overflows and use-after-free vulnerabilities.
• The update impacts Chrome users on Windows, Mac, and Linux platforms.
• Users are strongly advised to update their browsers immediately to patch these severe vulnerabilities and prevent potential code execution.

Chrome Update Addresses Critical Memory Corruption Vulnerabilities

Google has rolled out a significant security update for its Chrome browser, patching a total of 37 vulnerabilities. This comprehensive release includes fixes for seven critical flaws that could lead to memory corruption and potential arbitrary code execution, posing a serious risk to users.

The update, issued on October 13, 2026, targets Chrome installations across Windows, Mac, and Linux operating systems. The patches span various browser components, including critical areas such as graphics rendering, PDF processing, media handling, and networking functionalities.

Version Details and Severity Breakdown

According to Google’s release announcement, the updated Chrome versions are 155.0.8059.79 and 155.0.8059.80 for Windows and Mac, and 155.0.8059.79 for Linux. The security bulletin highlights the severity of the patched vulnerabilities, categorizing seven as critical, 29 as high-severity, and one as medium-severity.

Google has indicated that these updates will continue to propagate to users over the coming days and weeks. The most severe vulnerabilities largely involve memory safety issues.

Critical Vulnerabilities Detailed

One of the critical flaws, identified as CVE-2026-110152, is a buffer overflow vulnerability within ANGLE, Chrome’s graphics translation layer. This issue was reported by Zhenpeng “Leo” Lin at depthfirst on September 30. Buffer overflows occur when a program attempts to write data beyond the allocated buffer, potentially corrupting adjacent memory and creating an avenue for attackers to manipulate program execution.

The remaining six critical vulnerabilities are all classified as use-after-free flaws. These include CVE-2026-110149 affecting the Browser component, CVE-2026-110136 in the PDF handler, CVE-2026-110161 related to Network operations, and CVE-2026-110165 impacting the browser’s Core. Additionally, CVE-2026-110148 in SVG and CVE-2026-110151 in Media were also addressed, with contributions from Google researchers and Xinyang Ge in their discovery.

A use-after-free vulnerability arises when a program tries to access memory that has already been deallocated. This can lead to various detrimental outcomes, such as application crashes, data corruption, or, in severe cases, the execution of arbitrary malicious code. While a use-after-free flaw is a serious concern, its potential for exploitation can vary depending on the specific component affected.

This latest update continues a trend of Google focusing on memory safety, following a previous Chrome patch that fixed 247 vulnerabilities, including four critical use-after-free issues. The consistent attention to these types of flaws underscores their pervasive nature across various browser features.

High-Severity Flaws and Their Implications

Among the high-severity vulnerabilities, CVE-2026-110169 stands out, affecting V8, Chrome’s JavaScript and WebAssembly engine. Rapid7’s vulnerability record indicates that this flaw could allow a remote attacker to execute arbitrary code within Chrome’s sandbox by tricking a user into visiting a specially crafted HTML page. It is crucial to note that code execution within the sandbox typically does not, by itself, grant an attacker full control over the underlying operating system.

Other notable high-severity fixes include various use-after-free vulnerabilities across components like Desktop, Bindings, WebRTC, Passwords, and Media. The update also addresses a V8 type confusion issue (CVE-2026-110140), buffer overflows in Animation (CVE-2026-110166) and PDFium (CVE-2026-110155), an information leak in Passwords (CVE-2026-110146), privilege elevation in the Installer (CVE-2026-110150), and incorrect authorization issues in ReadingMode (CVE-2026-110160), Updater (CVE-2026-110159), and Mojo (CVE-2026-110144).

While Google’s announcement does not detail specific attack chains or confirm active exploitation of these newly patched vulnerabilities, the severity of the flaws necessitates prompt action from users. Google often restricts the release of detailed technical information about vulnerabilities until a significant portion of the user base has applied the patches, or if third-party libraries involved have not yet been fixed.

What You Should Do

• Update Chrome Immediately: Open Chrome, navigate to the menu (three dots), select “Help,” then “About Google Chrome.” The browser will automatically check for and download the update.
• Relaunch the Browser: After the update is installed, ensure you click “Relaunch” to apply the fixes.
• Linux Users: Update Chrome through your distribution’s package manager to ensure the latest security patches are applied.
• Verify Version: Confirm your Chrome version is 155.0.8059.79/.80 (Windows/Mac) or 155.0.8059.79 (Linux) or newer.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.