Google Patches 10 Chrome Vulnerabilities, Including Critical Memory Corruption Flaw

Key Takeaways

• Google has rolled out an urgent security update for Chrome, addressing 10 vulnerabilities across Windows, Mac, and Linux platforms.
• The update includes a critical use-after-free flaw (CVE-2026-110922) in the Prerender feature and multiple high-severity memory corruption bugs.
• Impacted users should immediately update to Chrome versions 155.0.8059.84/.85 (Windows/Mac) or 155.0.8059.84 (Linux) to mitigate risks.
• Notably, one high-severity DOM memory corruption flaw was reported with assistance from Anthropic’s Claude AI.

Google has issued an essential security update for its Chrome browser, patching a total of 10 vulnerabilities. The comprehensive release, announced on October 15, 2026, targets critical and high-severity flaws affecting Windows, Mac, and Linux operating systems.

The update, which includes one critical, six high-severity, and three medium-severity vulnerabilities, is being progressively deployed to users. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux. Users are advised to install these updates as they become available to ensure their systems are protected.

Critical Vulnerability Addressed

The most severe vulnerability patched in this release is CVE-2026-110922, identified as a critical use-after-free flaw within Chrome’s Prerender feature. Xinyang Ge is credited with reporting this issue to Google on October 2. A use-after-free vulnerability arises when a program attempts to access memory that has already been deallocated. Such an error can lead to application crashes or, in more severe scenarios, enable memory corruption, potentially allowing arbitrary code execution. Google has not yet released specific technical details surrounding this vulnerability, nor has it indicated any active exploitation in the wild.

High-Severity Flaws, Including AI-Assisted Discovery

Among the high-severity vulnerabilities, CVE-2026-110913 stands out as a memory corruption flaw within Chrome’s Document Object Model (DOM). The DOM is a programming interface for web documents, representing the page structure and enabling scripts to dynamically access and update content. This particular bug was reported by Xinyang Ge of Anthropic on September 29, with explicit credit given to assistance from Claude AI. While Google’s release notes acknowledge the AI’s involvement, they do not elaborate on the specific role Claude played in the discovery or analysis of the flaw.

Additional high-severity fixes address issues in other core Chrome components. These include two more use-after-free vulnerabilities (CVE-2026-110919 and CVE-2026-110921) found in V8, Chrome’s JavaScript engine. Other memory corruption flaws, identified as CVE-2026-110918, CVE-2026-110917, and CVE-2026-110920, impact Core and SVG components. These high-severity bugs were reported by various contributors, including Xinyang Ge, Google’s internal security teams, and researcher C0rk1.

Medium-Severity Patches and Broader Security Efforts

The update also resolves three medium-severity vulnerabilities. These include an improper input validation flaw affecting the Desktop component, a use-after-free issue in Compositing, and a memory corruption bug in Workers. Google’s internal research teams are credited with reporting these particular vulnerabilities. The diverse range of affected components, as highlighted by this release addresses, indicates that the vulnerabilities span multiple distinct browser subsystems rather than concentrating on a single area.

Google maintains a policy of restricting detailed bug information until a significant portion of the user base has updated their browsers. This practice aims to limit the window of opportunity for attackers to exploit newly patched vulnerabilities before users can apply the fixes. The company also states that it leverages advanced security tools such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL internally to proactively identify security bugs during the development lifecycle.

What You Should Do

• Update Chrome Immediately: For Windows and Mac users, update to version 155.0.8059.84 or 155.0.8059.85. Linux users should update to version 155.0.8059.84.
• Verify Installation: To prompt an update, navigate to Chrome’s “About Google Chrome” page (usually accessible via Settings > Help > About Google Chrome). The browser will check for updates and download them automatically. Restart Chrome if prompted to complete the installation.
• For Organizations: System administrators should follow their established patch management procedures to ensure all managed devices receive and apply the latest Chrome update promptly.
• Stay Informed: Regularly check Google’s official Chrome Stable Channel announcements and the Chrome Security page for the latest information on security updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.