Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google patched ten Chrome 155 flaws, including critical Prerender use-after-free CVE-2026-110922, with no known exploitation.
Google released Chrome 155 on October 15, 2026, with 10 security fixes and no reported in-the-wild exploitation. The Critical issue, CVE-2026-110922, is a use-after-free in Prerender reported by Xinyang Ge that could enable memory corruption and, in some cases, code execution in the renderer. Six High-severity flaws include V8, DOM, Core, and SVG bugs; CVE-2026-110913, a DOM memory-corruption issue, was credited to Xinyang Ge of Anthropic and assisted by Claude. Stable versions are 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 for Linux, and Chromium-based browsers may inherit the fixes.
- Critical CVE-2026-110922 is a use-after-free in Chrome Prerender.
- Six High bugs affect V8, DOM, Core, and SVG; three Medium bugs were found by Google.
- CVE-2026-110913 was reported by Anthropic’s Xinyang Ge and assisted by Claude.
- Google reports no exploitation in the wild and restricts bug details until rollout.
- Stable builds are 155.0.8059.84/.85 on Windows and Mac, and .84 on Linux.
Vulnerabilities mentionedAll →
- CVE-2026-1109138.8—Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pagepublished
- CVE-2026-1109148.8—Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…published
Full article442 words · extracted from gbhackers.com · click to collapse
Google has released Chrome 155 to the Stable channel with 10 security fixes. One is rated Critical: a use-after-free in Prerender, tracked as CVE-2026-110922. The update was published on October 15, 2026.
The Stable channel moves to version 155.0.8059.84/.85 for Windows and Mac, and 155.0.8059.84 for Linux. Google says the rollout will take place “over the coming days/weeks”.
Users should not wait for the automatic update. They can open Chrome’s About page to trigger it, then relaunch the browser.
Chrome 155 security flaws
According to the update advisory published by Google, CVE-2026-110922 is a use-after-free in Prerender, the feature that loads pages in the background to speed up navigation. Xinyang Ge reported it on October 2, 2026.
Use-after-free bugs happen when code keeps using memory after it has been released. Attackers can exploit them for memory corruption and, in some cases, arbitrary code execution inside the renderer.
Google has not published exploitation details. It also keeps bug-tracker access restricted until most users have updated.chromereleases.
Five of the six High-severity flaws are in V8, DOM, Core and SVG. The sixth is CVE-2026-110913, covered below. Xinyang Ge reported four of them, three of which are in V8, Chrome’s JavaScript and WebAssembly engine.chromereleases.
CVE-2026-110913 stands out. It is a memory corruption flaw in DOM, reported by Xinyang Ge of Anthropic and “assisted by Claude” on September 29, 2026. Google credits an AI model in the report. That fits a growing trend of AI-assisted vulnerability research.chromereleases.
Google’s own researchers reported all three Medium-severity bugs. They are an improper input validation flaw in Desktop, a use-after-free in Compositing and a memory corruption flaw in Workers. The Desktop bug was reported on April 12, 2026, which makes it the oldest in the batch.
| CVE | Severity | Component | Type | Reporter |
| CVE-2026-110922 | Critical | Prerender | Use after free | Xinyang Ge |
| CVE-2026-110913 | High | DOM | Memory corruption | Xinyang Ge (Anthropic), assisted by Claude |
| CVE-2026-110919 | High | V8 | Use after free | Xinyang Ge |
| CVE-2026-110918 | High | Core | Memory corruption | |
| CVE-2026-110917 | High | SVG | Memory corruption | C0rk1 |
| CVE-2026-110921 | High | V8 | Use after free | Xinyang Ge |
| CVE-2026-110920 | High | V8 | Memory corruption | Xinyang Ge |
| CVE-2026-110916 | Medium | Desktop | Improper input validation | |
| CVE-2026-110915 | Medium | Compositing | Use after free | |
| CVE-2026-110914 | Medium | Workers | Memory corruption |
Google says it found many of these bugs with AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL.
The advisory does not report any exploitation in the wild. The bugs were reported between April and October 2026.chromereleases.googleblog
Administrators should push Chrome 155.0.8059.84/.85 across managed fleets and confirm that browsers restart after updating. Other Chromium-based browsers, such as Edge, Brave and Opera, often inherit these fixes. Check each vendor for its own patched release.