Google has rolled out a critical security update for Chrome, patching ten vulnerabilities across Windows, macOS, and Linux. The fix includes one critical issue, six high-severity flaws, and three medium-level bugs. Among the most notable problems is a memory corruption vulnerability in Chrome’s DOM, which researchers discovered with the assistance of Claude AI. The update was officially announced on October 15, 2026, as versions 155.0.8059.84/.85 for Windows and Mac, and 155.0.8059.84 for Linux. Users are encouraged to trigger the update via Chrome’s About page.
Critical “Use-After-Free” Bug in Prerender
The most urgent flaw, CVE-2026-110922, is a use-after-free bug in Chrome’s Prerender feature. First reported by security researcher Xinyang Ge on October 2, this vulnerability can allow Chrome to operate on memory after it has been freed—leading to crashes or potentially opening avenues for memory corruption. At present, Google has not observed active exploitation.
High-Severity Flaws Span DOM, V8, Core, and SVG
Another severe issue, CVE-2026-110913, is a DOM memory corruption flaw that was flagged with help from Claude AI. Reported on September 29 by Xinyang Ge and Anthropic, this bug could impact how Chrome handles the structural model of web pages.
The bulk of the high-severity patches touch critical components like Chrome’s JavaScript engine V8, Core, and the SVG system. These include two additional use-after-free faults (CVE-2026-110919, CVE-2026-110921), and memory corruption defects in V8, Core, and SVG under identifiers CVE-2026-110918, CVE-2026-110917, and CVE-2026-110920.
Medium Bugs & Update Rollout Details
The three medium-severity issues cover problems like improper input validation in the Desktop component, a use-after-free flaw in Compositing, and memory corruption in Workers. These were all identified by Google’s internal team.
Chrome’s release will be delivered in stages, meaning some users may see the patch sooner than others. To ensure protection, users should verify they’re on the newest version via Chrome’s About page, then restart the browser. Organizations should follow standard update procedures to ensure managed machines receive the patch. Detailed reports of the bugs may stay locked until most users have acquired the update to limit exposure.
Background:Memory corruption and use-after-free bugs are among the most serious threats for browsers. They occur when a program references memory locations it shouldn’t, often leading to crashes, data leaks, or remote code execution. Chrome has increasingly leaned on tools like AddressSanitizer, MemorySanitizer, libFuzzer, and AFL to proactively detect these faults during development.
This latest update follows earlier security fixes in Chrome, reinforcing Google’s ongoing commitment to patching browser vulnerabilities.
Why It Matters & What to Watch:This set of patches underlines how AI tools like Claude are playing a growing role in discovering significant security flaws. The inclusion of multiple use-after-free and memory corruption bugs across separate components—not just one feature—suggests systemic pressure points in Chrome’s architecture. Users should update immediately once the patch appears. Meanwhile, security teams and browser developers must continue investing in AI-assisted vulnerability detection and make faster progress on eliminating entire classes of flaws rather than just treating symptoms.
