Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks

Google released a Chrome security update that addresses 37 vulnerabilities, including seven critical flaws that raise concerns about memory corruption and possible code execution.

Published on October 13, 2026, the update covers Windows, Mac, and Linux, with fixes spanning graphics, PDF handling, media processing, networking, and other browser components.

According to Google’s Stable Channel Update for Desktop, the patched versions are 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux. The release includes seven critical, 29 high, and one medium-severity security fixes.

Google says it will continue distributing updates over the coming days and weeks. The critical vulnerabilities include CVE-2026-110152, a buffer overflow in ANGLE, Chrome’s graphics translation layer. Zhenpeng “Leo” Lin at depthfirst reported the issue on September 30.

Buffer overflows can corrupt memory when software writes beyond the space reserved for data, potentially creating opportunities for attackers to change program behavior.

The remaining six critical entries are use-after-free flaws. CVE-2026-110149 affects Browser, CVE-2026-110136 affects PDF, CVE-2026-110161 affects Network, and CVE-2026-110165 affects Core.

Multiple Google Chrome Vulnerabilities

Google also patched CVE-2026-110148 in SVG and CVE-2026-110151 in Media. These findings involve Google researchers and Xinyang Ge.

A use-after-free vulnerability occurs when software continues accessing memory after releasing it. Depending on the bug, attackers may influence that memory’s contents, causing crashes, corrupting data, or potentially running malicious code. However, the flaw category alone does not enable an attack against every affected component.

Cybersecurity News previously covered Chrome’s update fixing 247 vulnerabilities, including four critical use-after-free issues. The latest release continues that focus on memory safety across multiple browser features rather than a single isolated component.

Among the high-severity vulnerabilities, CVE-2026-110169 affects V8, Chrome’s JavaScript and WebAssembly engine. Rapid7’s vulnerability record states that a crafted HTML page could allow a remote attacker to execute arbitrary code inside Chrome’s sandbox in versions before 155.0.8059.79.

That limitation matters. Code execution inside the sandbox does not, by itself, prove an attacker can take control of the entire operating system.

Google’s release announcement does not describe a complete attack chain or confirm that these newly patched vulnerabilities are being exploited in the wild.

Google credits Xinyang Ge at Anthropic, assisted by Claude, with reporting CVE-2026-110169. Other high-severity fixes address V8 type confusion, buffer overflows in Animation and PDFium, a Passwords information leak, Installer privilege elevation, and authorization problems in ReadingMode, Updater, and Mojo.

For background, Cybersecurity News’ coverage of earlier ANGLE and V8 security fixes explains how memory-handling issues repeatedly affect graphics and script processing.

Users should open Chrome’s menu, select Help, then About Google Chrome to check for updates. After installation, select Relaunch to apply the fixes. Linux users should update through their package manager. Google’s Chrome update guide explains these steps.

Google may restrict detailed bug reports until most users receive patches. Restrictions may also remain if affected third-party libraries haven’t been fixed elsewhere, limiting the technical information currently available to readers and defenders.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks appeared first on Cyber Security News.