Chrome 155 stable update closes 37 security flaws, seven rated Critical
Google's Chrome 155 stable update, versions 155.0.8059.79/.80, fixes 37 security flaws, seven of them rated Critical. Malwarebytes says auto-update can stall on a browser that never closes or one with a blocking extension, so the installed build number is the thing to verify.
The Watch · Security desk
What happened
- Google issued the Chrome updates on October 13 and 14, according to Malwarebytes.
- Windows and Mac get builds 155.0.8059.79 and .80, while Linux gets 155.0.8059.79 only.
- The Android build, also 155.0.8059.79, shipped the same day but may not be on Google Play for everyone yet.
- CVE-2026-110136, rated Critical, is a use-after-free in Chrome's PDF component that lets a remote attacker run code outside the sandbox through a crafted HTML page.
- CVE-2026-110152 is a buffer overflow in ANGLE on Android with the same outside-sandbox reach through a crafted HTML page.
Why it matters
- Who's exposed exposure A browser left open for days, or one with an extension blocking the update, stays on the old build. Those are the machines a fleet version check will surface.
- Who has to decide decision Teams checking managed browsers have a concrete pass mark: 155.0.8059.79 or .80 on Windows and Mac, .79 on Linux and Android.
- Who's exposed exposure Two named bugs need only a crafted page to reach code outside the sandbox, so the exposed population is every user who browses on an unpatched build.
- What it limits constraint Managed Android devices cannot reach the ANGLE fix until Google Play offers the build to them, which Malwarebytes says is not yet universal.
Malwarebytes explains why the outside-sandbox bugs get the attention. In its words, a Chrome flaw that allows remote code execution outside the browser sandbox can turn a visit to a malicious or compromised website into direct code on the underlying operating system, often without further exploitation steps [11]. CVE-2026-110136 and the Android ANGLE overflow, CVE-2026-110152, are both in that class [8][9]. ANGLE is Chrome's graphics-translation layer [13].
The third CVE the post details, CVE-2026-110147, is a second use-after-free in the PDF component. It is rated High and runs inside the sandbox [10]. Malwarebytes cautions that attackers often chain several vulnerabilities to escape the sandbox, so an inside-sandbox rating describes a limit and does not make the bug harmless [12].
The post names three CVEs and gives ratings for two of them [8][9][10]. Seven of the 37 fixes are Critical, so 30 are not [15]. It does not say whether any of the flaws is exploited in the wild [14]. Patch priority therefore rests on the Critical ratings and the outside-sandbox reach, and not on any reported attacks.
Auto-update has two failure modes in Malwarebytes' account. A browser that is never closed lags behind, and so does one where something goes wrong, such as an extension preventing the update [6]. Google's rollout also runs over days and weeks [5]. We think those are different problems. Under a staggered rollout, some machines have not been offered the build yet. A browser left open has been offered it and has not applied it.
The target for a fleet check is 155.0.8059.79 or .80 on Windows and Mac, and .79 on Linux [2]. On Android it is 155.0.8059.79 [4]. Malwarebytes' manual route is About Google Chrome, then Relaunch [7]. That works one machine at a time. Across a fleet, the version string in inventory is the faster test.
Android carries its own delay. Malwarebytes says the build may not be on Google Play for everyone yet, and the ANGLE flaw is Android-specific [4][8].
What to watch
- Whether Google or any researcher reports in-the-wild exploitation of any of the 37 fixes.
- Whether Google Play offers Android 155.0.8059.79 to all devices, since the ANGLE flaw is Android-specific.
- Which CVEs make up the seven Critical ratings, since Malwarebytes details only one by number.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google issued several Chrome updates on October 13 and 14.
- [2]
The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux.
- [3]
The update includes 37 security fixes, including seven rated Critical.
- [4]
On the same day Google released version 155.0.8059.79 for Android, which may not be available on Google Play for everyone yet.
- [5]
Updates will roll out over the coming days and weeks.
- [6]
Automatic updating is the easiest option, but a user can lag behind if they never close the browser or if something goes wrong, such as an extension preventing the update.
- [7]
To update manually, open About Google Chrome from the settings or Help menu; Chrome checks for updates and, if one is available, the user clicks Relaunch to apply it.
- [8]
CVE-2026-110152 is a buffer overflow in ANGLE in Chrome on Android that could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
- [9]
CVE-2026-110136, rated Critical, is a use-after-free in the PDF component that could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
- [10]
CVE-2026-110147, rated High, is a use-after-free in the PDF component that could allow an attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
- [11]
Malwarebytes says Chrome vulnerabilities enabling remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code running on the underlying operating system, often without additional exploitation steps.
- [12]
Attackers often chain multiple vulnerabilities to escape the sandbox and achieve a more serious compromise, so an inside-the-sandbox rating describes a limitation but does not mean the vulnerability is harmless.
- [13]
ANGLE is Chrome's graphics-translation layer.
- [14]
Malwarebytes' post describes the fixes without reporting exploitation in the wild for any of them.
- [15]
Thirty of the 37 security fixes are not rated Critical.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- malwarebytes.comUpdate Chrome: Google fixes 37 security flaws, including seven critical bugs
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.