Google has released Chrome 155 to the Stable channel with 10 security fixes. One is rated Critical: a use-after-free in Prerender, tracked as CVE-2026-110922. The update was published on October 15, 2026.
The Stable channel moves to version 155.0.8059.84/.85 for Windows and Mac, and 155.0.8059.84 for Linux. Google says the rollout will take place “over the coming days/weeks”.
Users should not wait for the automatic update. They can open Chrome’s About page to trigger it, then relaunch the browser.
Chrome 155 security flaws
According to the update advisory published by Google, CVE-2026-110922 is a use-after-free in Prerender, the feature that loads pages in the background to speed up navigation. Xinyang Ge reported it on October 2, 2026.
Use-after-free bugs happen when code keeps using memory after it has been released. Attackers can exploit them for memory corruption and, in some cases, arbitrary code execution inside the renderer.
Google has not published exploitation details. It also keeps bug-tracker access restricted until most users have updated.chromereleases.
Five of the six High-severity flaws are in V8, DOM, Core and SVG. The sixth is CVE-2026-110913, covered below. Xinyang Ge reported four of them, three of which are in V8, Chrome’s JavaScript and WebAssembly engine.chromereleases.
CVE-2026-110913 stands out. It is a memory corruption flaw in DOM, reported by Xinyang Ge of Anthropic and “assisted by Claude” on September 29, 2026. Google credits an AI model in the report. That fits a growing trend of AI-assisted vulnerability research.chromereleases.
Google’s own researchers reported all three Medium-severity bugs. They are an improper input validation flaw in Desktop, a use-after-free in Compositing and a memory corruption flaw in Workers. The Desktop bug was reported on April 12, 2026, which makes it the oldest in the batch.
| CVE | Severity | Component | Type | Reporter |
| CVE-2026-110922 | Critical | Prerender | Use after free | Xinyang Ge |
| CVE-2026-110913 | High | DOM | Memory corruption | Xinyang Ge (Anthropic), assisted by Claude |
| CVE-2026-110919 | High | V8 | Use after free | Xinyang Ge |
| CVE-2026-110918 | High | Core | Memory corruption | |
| CVE-2026-110917 | High | SVG | Memory corruption | C0rk1 |
| CVE-2026-110921 | High | V8 | Use after free | Xinyang Ge |
| CVE-2026-110920 | High | V8 | Memory corruption | Xinyang Ge |
| CVE-2026-110916 | Medium | Desktop | Improper input validation | |
| CVE-2026-110915 | Medium | Compositing | Use after free | |
| CVE-2026-110914 | Medium | Workers | Memory corruption |
Google says it found many of these bugs with AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL.
The advisory does not report any exploitation in the wild. The bugs were reported between April and October 2026.chromereleases.googleblog
Administrators should push Chrome 155.0.8059.84/.85 across managed fleets and confirm that browsers restart after updating. Other Chromium-based browsers, such as Edge, Brave and Opera, often inherit these fixes. Check each vendor for its own patched release.
