VYPR
Vypr IntelligenceAI-generatedOct 13, 2026· 25 CVEs

Google Chrome: 25 High/Critical Vulnerabilities Patched in Single October 2026 Disclosure

Google Chrome version 155.0.8059.79 addresses 25 High to Critical vulnerabilities, including numerous memory corruption flaws, disclosed on October 13, 2026.

Key findings

  • 25 vulnerabilities in Google Chrome disclosed on October 13, 2026, patched in version 155.0.8059.79.
  • Predominant vulnerability types include use-after-free and buffer overflows across multiple browser components.
  • Several critical vulnerabilities allow for arbitrary code execution or sandbox escape.
  • Affected components range from Media and V8 to DOM, Bindings, and platform-specific issues on Android and Mac.
  • Users are urged to update to Chrome 155.0.8059.79 to mitigate High and Critical severity risks.

On October 13, 2026, Google released Chrome version 155.0.8059.79, addressing a significant batch of 25 vulnerabilities disclosed on the same day. These vulnerabilities, ranging in severity from High to Critical, primarily involve memory corruption issues such as use-after-free and buffer overflows, as well as authorization flaws. The widespread nature of these flaws across various components of the browser underscores the importance of timely patching for users.

The disclosed vulnerabilities impact several key areas within Chrome. A significant number of these issues are use-after-free vulnerabilities, affecting components like Media (CVE-2026-110172, CVE-2026-110171, CVE-2026-110167, CVE-2026-110153, CVE-2026-110151, CVE-2026-110148), Bindings (CVE-2026-110170), V8 (CVE-2026-110169, CVE-2026-110168), DOM (CVE-2026-110164, CVE-2026-110163), Desktop (CVE-2026-110162), Passwords (CVE-2026-110158), SVG (CVE-2026-110157, CVE-2026-110148), Canvas (CVE-2026-110154), and the core browser functionality (CVE-2026-110149). Additionally, buffer overflow vulnerabilities were found in Animation (CVE-2026-110166), PDFium (CVE-2026-110155), and ANGLE on Android (CVE-2026-110152).

Other notable vulnerabilities include incorrect authorization in Updater (CVE-2026-110159) and ReadingMode (CVE-2026-110160), which could lead to arbitrary code execution or bypass site isolation. Privilege elevation in the Installer on Windows (CVE-2026-110150) and vulnerabilities affecting Chrome on Android (CVE-2026-110165, CVE-2026-110152) and Mac (CVE-2026-110156) were also part of this disclosure.

The majority of these vulnerabilities allow for remote attackers to execute arbitrary code, either inside or outside the sandbox, or to read memory within the sandbox, typically via a crafted HTML page. However, some vulnerabilities, such as CVE-2026-110159 and CVE-2026-110150, require local access. The critical severity ratings for several of these flaws, including CVE-2026-110165, CVE-2026-110161, CVE-2026-110152, CVE-2026-110151, CVE-2026-110149, and CVE-2026-110148, indicate a high potential impact on user security.

Google has addressed all these vulnerabilities with the release of Chrome 155.0.8059.79. Users are strongly advised to update their Chrome browsers to this latest version to mitigate the risks associated with these security flaws. The consistent patching of memory corruption bugs highlights the ongoing challenges in securing complex software like web browsers.

This coordinated disclosure event, with all 25 vulnerabilities reported on the same day, emphasizes the importance of rapid response from both vendors and users. Staying updated with the latest browser versions is crucial for protecting against potential exploitation of such a large number of security weaknesses.

The vulnerabilities patched include:

Users should ensure their Chrome browser is updated to version 155.0.8059.79 or later to benefit from these security fixes.

The batch of 25 vulnerabilities disclosed on October 13, 2026, highlights critical security weaknesses in Google Chrome, predominantly memory corruption bugs. The update to version 155.0.8059.79 addresses these High and Critical severity flaws.

Key areas affected include Media, V8, DOM, Bindings, and various other components, with numerous use-after-free and buffer overflow vulnerabilities. Several critical vulnerabilities, including CVE-2026-110165, CVE-2026-110161, CVE-2026-110152, CVE-2026-110151, CVE-2026-110149, and CVE-2026-110148, pose a significant risk.

The vulnerabilities were patched in Chrome 155.0.8059.79. Users are strongly urged to update their browsers immediately to protect against potential exploitation.

This coordinated disclosure event underscores the ongoing need for vigilance and prompt updates in maintaining browser security.

The vulnerabilities patched include: CVE-2026-110172, CVE-2026-110171, CVE-2026-110170, CVE-2026-110169, CVE-2026-110168, CVE-2026-110167, CVE-2026-110166, CVE-2026-110165, CVE-2026-110164, CVE-2026-110163, CVE-2026-110162, CVE-2026-110161, CVE-2026-110160, CVE-2026-110159, CVE-2026-110158, CVE-2026-110157, CVE-2026-110156, CVE-2026-110155, CVE-2026-110154, CVE-2026-110153, CVE-2026-110152, CVE-2026-110151, CVE-2026-110150, CVE-2026-110149, CVE-2026-110148.

AI-written article. Grounded in 25 CVE records listed below.