Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI.
The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026.
Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to prompt an update check.
The most serious issue is CVE-2026-110922, a critical use-after-free flaw in Chrome’s Prerender feature. Google credits Xinyang Ge with reporting it on October 2.
A use-after-free bug occurs when software tries to use memory after it has been released. Depending on how an attacker can reach the flaw, this type of error may cause a crash or allow memory corruption. Google has not published further technical details and has not said the issue is being exploited.
CVE-2026-110913 is a high-severity memory corruption flaw in Chrome’s DOM, the browser system that represents and manages the structure of web pages.
Google Fixes 10 Chrome Vulnerabilities
Ge reported the bug on September 29, with Claude’s assistance. Google’s release note does not explain how the issue was found, whether Claude identified the flaw or helped with analysis, or what steps were involved. It does, however, publicly credit the AI’s assistance in the report.
The other high-severity fixes affect V8, Chrome’s JavaScript engine, as well as Core and SVG. They include two additional use-after-free flaws in V8, CVE-2026-110919 and CVE-2026-110921, and memory corruption issues CVE-2026-110918, CVE-2026-110917, and CVE-2026-110920. The reports came from Ge, Google, and researcher C0rk1.
The three medium-severity bugs involve improper input validation in Desktop, a use-after-free issue in Compositing, and memory corruption in Workers.
Google credited its own researchers with reporting these flaws. Together, the list shows that this release addresses problems in separate browser components rather than a single feature or subsystem.
Google says detailed bug information may remain restricted until most users have installed the fixes. This can limit what researchers and users can learn about the vulnerabilities while the update is spreading.
| CVE | Severity | Affected component | Reported by |
|---|---|---|---|
| CVE-2026-110922 | Critical | Prerender | Xinyang Ge |
| CVE-2026-110913 | High | DOM | Xinyang Ge, Anthropic, assisted by Claude |
| CVE-2026-110919 | High | V8 | Xinyang Ge |
| CVE-2026-110918 | High | Core | |
| CVE-2026-110917 | High | SVG | C0rk1 |
| CVE-2026-110921 | High | V8 | Xinyang Ge |
| CVE-2026-110920 | High | V8 | Xinyang Ge |
| CVE-2026-110916 | Medium | Desktop | |
| CVE-2026-110915 | Medium | Compositing | |
| CVE-2026-110914 | Medium | Workers |
The company also said it uses tools such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL to find security bugs during development.
Chrome updates are delivered gradually, so users may not receive the new version at the same time. Check the browser’s About Google Chrome page and restart it if prompted to complete installation. Organizations should follow their normal browser update process and confirm that managed devices receive the fixed release.
This update follows other recent Chrome security coverage, including Google’s earlier report on a large Chrome vulnerability update and coverage of multiple Chrome flaws. Google’s Stable Channel announcement and Chrome Security page provide the primary release information.