Google moved Chrome 155 to the Stable channel on October 13, 2026, and the Chrome 155 security update carries 37 fixes, seven of them rated Critical. The build is rolling out to Windows, Mac and Linux over the coming days and weeks, so your copy may still be on an older version. Google’s release post does not say any of the bugs were exploited in the wild, but the list is heavy on memory flaws in the code that opens web pages, PDFs and media. Checking takes about a minute.
TL;DR: Chrome 155 fixes 37 security bugs, including seven Critical ones in ANGLE, PDF, SVG, Media and other core components. Google’s post reports no attacks in the wild, but the update is still rolling out gradually. Open chrome://settings/help, let Chrome download the new build, and relaunch. Desktop builds should read 155.0.8059.79 or newer.
What the Chrome 155 security update fixes
Google’s desktop release post lists 37 security fixes: 7 Critical, 29 High and 1 Medium. The Stable builds are 155.0.8059.79 and 155.0.8059.80 for Windows and Mac, and 155.0.8059.79 for Linux.
The seven Critical entries are where the attention belongs. Six are use after free bugs and one is a buffer overflow in ANGLE, the layer Chrome uses to translate graphics calls. Google’s own team found three of them, and outside researchers found the rest.
| Component | Bug type | Found by | Reported |
|---|---|---|---|
| ANGLE | Buffer overflow | Zhenpeng (Leo) Lin at depthfirst | September 30, 2026 |
| Browser | Use after free | October 1, 2026 | |
| Use after free | Xinyang Ge | October 2, 2026 | |
| Network | Use after free | October 2, 2026 | |
| Core | Use after free | October 2, 2026 | |
| SVG | Use after free | Xinyang Ge | October 5, 2026 |
| Media | Use after free | Xinyang Ge | October 6, 2026 |
Less than two weeks ago, Chrome 154 reached Stable with a very different kind of change. That one reshaped how you load sites, while this release is about what happens once a page is already open.
Why most of the Critical bugs are memory bugs
A use after free happens when code keeps using a piece of memory after it has been released. Attackers can sometimes steer that mistake into running code they chose, which is why these bugs earn the Critical label.
The components in the table are the ones that handle content you did not write. A PDF opened from an email, an SVG image on a web page or a video in a tab all pass through code on this list. Google’s post gives component names and bug types, not exploit details, so there is nothing here to measure how reachable any single bug is.
The timeline is the part worth noticing. The newest of the seven Critical reports came in on October 6, and the fix went public a week later. For most people this will be invisible until the one moment it is not.
An AI assistant shows up in the credits
One High severity entry, CVE-2026-110169, is a use after free in V8, Chrome’s JavaScript engine. The post credits it to Xinyang Ge of Anthropic, assisted by Claude, and lists a report date of September 28, 2026.
Xinyang Ge is credited on more than a dozen other entries in this release, including three of the Critical ones. The post does not say which of those, if any, involved AI help, so the CVE-2026-110169 line is the only explicit credit.
It is a small detail in a long list, but it is a useful one. The credit line now records when a model helped find the bug, which tells you how some of this volume is being found.
How to check that Chrome has actually updated
Type chrome://settings/help into the address bar. Chrome checks for the update, downloads it and shows a Relaunch button, which restores your tabs.
On desktop the version should read 155.0.8059.79 or newer. A browser left running for days on a work laptop keeps the old code in memory, so the relaunch is the step people skip.
If the page still shows an older build, the rollout simply has not reached you yet. Check again tomorrow. If you are weighing other options anyway, our browser comparison covers how Chrome stacks up against Brave and Firefox.
