Multiple Google Chrome Vulnerabilities Could Enable Memory Corruption and Code Execution Attacks
Google released a Chrome security update that addresses 37 vulnerabilities, including seven critical flaws that raise concerns about memory corruption and possible code execution.
Published on October 13, 2026, the update covers Windows, Mac, and Linux, with fixes spanning graphics, PDF handling, media processing, networking, and other browser components.
According to Google’s Stable Channel Update for Desktop, the patched versions are 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux. The release includes seven critical, 29 high, and one medium-severity security fixes.
Google says it will continue distributing updates over the coming days and weeks. The critical vulnerabilities include CVE-2026-110152, a buffer overflow in ANGLE, Chrome’s graphics translation layer. Zhenpeng “Leo” Lin at depthfirst reported the issue on September 30.
Buffer overflows can corrupt memory when software writes beyond the space reserved for data, potentially creating opportunities for attackers to change program behavior.
The remaining six critical entries are use-after-free flaws. CVE-2026-110149 affects Browser, CVE-2026-110136 affects PDF, CVE-2026-110161 affects Network, and CVE-2026-110165 affects Core.
Multiple Google Chrome Vulnerabilities
Google also patched CVE-2026-110148 in SVG and CVE-2026-110151 in Media. These findings involve Google researchers and Xinyang Ge.
A use-after-free vulnerability occurs when software continues accessing memory after releasing it. Depending on the bug, attackers may influence that memory’s contents, causing crashes, corrupting data, or potentially running malicious code. However, the flaw category alone does not enable an attack against every affected component.
Cybersecurity News previously covered Chrome’s update fixing 247 vulnerabilities, including four critical use-after-free issues. The latest release continues that focus on memory safety across multiple browser features rather than a single isolated component.
Among the high-severity vulnerabilities, CVE-2026-110169 affects V8, Chrome’s JavaScript and WebAssembly engine. Rapid7’s vulnerability record states that a crafted HTML page could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox in versions before 155.0.8059.79.
That limitation matters. Code execution inside the sandbox does not, by itself, prove an attacker can take control of the entire operating system.
CVE IDSeverityVulnerability TypeAffected ComponentCVE-2026-110152CriticalBuffer overflowANGLECVE-2026-110149CriticalUse after freeBrowserCVE-2026-110136CriticalUse after freePDFCVE-2026-110161CriticalUse after freeNetworkCVE-2026-110165CriticalUse after freeCoreCVE-2026-110148CriticalUse after freeSVGCVE-2026-110151CriticalUse after freeMediaCVE-2026-110162HighUse after freeDesktopCVE-2026-110170HighUse after freeBindingsCVE-2026-110160HighMissing authorizationReadingModeCVE-2026-110143HighUse of uninitialized variableThirdParty lmza_sdkCVE-2026-110146HighInformation leakPasswordsCVE-2026-110150HighPrivilege elevationInstallerCVE-2026-110156HighIncorrect reference resolutionExtensionsCVE-2026-110137HighUse after freeWebRTCCVE-2026-110140HighType confusionV8CVE-2026-110158HighUse after freePasswordsCVE-2026-110145HighUse after freePasswordsCVE-2026-110159HighIncorrect authorizationUpdaterCVE-2026-110144HighIncorrect authorizationMojoCVE-2026-110153HighUse after freeMediaCVE-2026-110166HighBuffer overflowAnimationCVE-2026-110169HighUse after freeV8CVE-2026-110168HighUse after freeV8CVE-2026-110139HighUse after freeMediaCVE-2026-110172HighUse after freeMediaCVE-2026-110164HighUse after freeDOMCVE-2026-110163HighUse after freeDOMCVE-2026-110141HighObservable discrepancyMediaCVE-2026-110138HighUse after freeShapeDetectionCVE-2026-110157HighUse after freeSVGCVE-2026-110147HighUse after freePDFCVE-2026-110154HighUse after freeCanvasCVE-2026-110155HighBuffer overflowPDFiumCVE-2026-110167HighUse after freeMediaCVE-2026-110171HighUse after freeMediaCVE-2026-110142MediumUse after freeFileSystem
Google’s release announcement does not describe a complete attack chain or confirm that these newly patched vulnerabilities are being exploited in the wild.
Google credits Xinyang Ge at Anthropic, assisted by Claude, with reporting CVE-2026-110169. Other high-severity fixes address V8 type confusion, buffer overflows in Animation and PDFium, a Passwords information leak, Installer privilege elevation, and authorization problems in ReadingMode, Updater, and Mojo.
For background, Cybersecurity News’ coverage of earlier ANGLE and V8 security fixes explains how memory-handling issues repeatedly affect graphics and script processing.
Users should open Chrome’s menu, select Help, then About Google Chrome to check for updates. After installation, select Relaunch to apply the fixes. Linux users should update through their package manager. Google’s Chrome update guide explains these steps.
Google may restrict detailed bug reports until most users receive patches. Restrictions may also remain if affected third-party libraries haven’t been fixed elsewhere, limiting the technical information currently available to readers and defenders.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
