Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
Google patched ten Chrome flaws, including critical prerender use-after-free CVE-2026-110922, with no known exploitation.
Google's October 15, 2026 Stable update fixes 10 Chrome vulnerabilities on Windows, Mac, and Linux in versions 155.0.8059.84/.85. The most serious is CVE-2026-110922, a critical use-after-free in Prerender reported by Xinyang Ge of Anthropic. High-severity fixes include DOM memory corruption CVE-2026-110913, credited as found with Claude, plus use-after-free and memory-corruption bugs in V8, Core, and SVG. Google has not said any issue is exploited and may withhold details until the rollout is widespread.
- Chrome 155.0.8059.84/.85 fixes one critical, six high, and three medium flaws.
- Critical CVE-2026-110922 is a use-after-free in Prerender, reported by Xinyang Ge.
- High-severity DOM bug CVE-2026-110913 was reported with Claude's assistance.
- Other highs hit V8, Core, and SVG; Google reports no exploitation.
- Bug details may stay restricted until most users receive the update.
Vulnerabilities mentionedAll →
- CVE-2026-1109138.8—Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pagepublished
- CVE-2026-1109148.8—Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…published
Full article572 words · extracted from cybersecuritynews.com · click to collapse
Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI.
The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026.
Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to prompt an update check.
The most serious issue is CVE-2026-110922, a critical use-after-free flaw in Chrome’s Prerender feature. Google credits Xinyang Ge with reporting it on October 2.
A use-after-free bug occurs when software tries to use memory after it has been released. Depending on how an attacker can reach the flaw, this type of error may cause a crash or allow memory corruption. Google has not published further technical details and has not said the issue is being exploited.
CVE-2026-110913 is a high-severity memory corruption flaw in Chrome’s DOM, the browser system that represents and manages the structure of web pages.
Google Fixes 10 Chrome Vulnerabilities
Ge reported the bug on September 29, with Claude’s assistance. Google’s release note does not explain how the issue was found, whether Claude identified the flaw or helped with analysis, or what steps were involved. It does, however, publicly credit the AI’s assistance in the report.
The other high-severity fixes affect V8, Chrome’s JavaScript engine, as well as Core and SVG. They include two additional use-after-free flaws in V8, CVE-2026-110919 and CVE-2026-110921, and memory corruption issues CVE-2026-110918, CVE-2026-110917, and CVE-2026-110920. The reports came from Ge, Google, and researcher C0rk1.
The three medium-severity bugs involve improper input validation in Desktop, a use-after-free issue in Compositing, and memory corruption in Workers.
Google credited its own researchers with reporting these flaws. Together, the list shows that this release addresses problems in separate browser components rather than a single feature or subsystem.
Google says detailed bug information may remain restricted until most users have installed the fixes. This can limit what researchers and users can learn about the vulnerabilities while the update is spreading.
| CVE | Severity | Affected component | Reported by |
|---|---|---|---|
| CVE-2026-110922 | Critical | Prerender | Xinyang Ge |
| CVE-2026-110913 | High | DOM | Xinyang Ge, Anthropic, assisted by Claude |
| CVE-2026-110919 | High | V8 | Xinyang Ge |
| CVE-2026-110918 | High | Core | |
| CVE-2026-110917 | High | SVG | C0rk1 |
| CVE-2026-110921 | High | V8 | Xinyang Ge |
| CVE-2026-110920 | High | V8 | Xinyang Ge |
| CVE-2026-110916 | Medium | Desktop | |
| CVE-2026-110915 | Medium | Compositing | |
| CVE-2026-110914 | Medium | Workers |
The company also said it uses tools such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL to find security bugs during development.
Chrome updates are delivered gradually, so users may not receive the new version at the same time. Check the browser’s About Google Chrome page and restart it if prompted to complete installation. Organizations should follow their normal browser update process and confirm that managed devices receive the fixed release.
This update follows other recent Chrome security coverage, including Google’s earlier report on a large Chrome vulnerability update and coverage of multiple Chrome flaws. Google’s Stable Channel announcement and Chrome Security page provide the primary release information.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.