Chrome Security Update: Critical Flaw Fixed in Version 155

Google's current Chrome Stable build for desktop, version 155.0.8059.84 (155.0.8059.85 on some Windows and Mac machines), fixes a critical security flaw that could let an attacker run code inside Chrome's sandbox just by getting a victim to load a malicious web page. The bug, tracked as CVE-2026-110922, is a use-after-free in Chrome's Prerender feature — the system that quietly loads pages in the background before you click a link. Google shipped the fix on October 15, 2026, alongside nine other security patches, and it's still rolling out to the Stable channel in stages, per Google's standard release language. If your Chrome hasn't auto-updated yet, this is worth doing manually today.

What's new, and which Chrome version are you actually on

Chrome's version-numbering and release cadence can be confusing, because different platforms and channels move at different speeds, and Google now ships several overlapping tracks — Stable, Early Stable, Beta, Dev, and (for enterprise) Extended Stable. As of today, here's where things actually stand across the board:

• Desktop Stable (the version almost everyone is running): 155.0.8059.84/.85 for Windows and Mac, 155.0.8059.84 for Linux — shipped October 15 with the Prerender fix described below.
• Desktop "Early Stable": Chrome 157.0.8103.15/.16 began rolling out to a small percentage of Windows users on October 22, with Mac following shortly after. This is a staged pre-release of the next full Stable build and isn't yet on most machines.
• Android: Chrome 157.0.8103.14 began an early-Stable rollout on October 23, also limited to a small percentage of users initially.
• iOS: Chrome Stable 156 (156.0.8078.54) shipped fully on October 23.
• ChromeOS: M-156 (Browser 156.0.8078.42) reached the Stable channel on October 20, bundled with a separate set of OS-level security fixes.

In other words: desktop users are current on Chrome 155 with the October 15 security patch applied — once it finishes rolling out to their particular machine — while the next major jump, Chrome 156 and 157, is still in staged rollout and hasn't fully replaced 155 on desktop yet. You can check exactly what you're running by typing chrome://settings/help into the address bar; Chrome will show your build number and tell you if an update is waiting.

The critical flaw: CVE-2026-110922

CVE-2026-110922 is a use-after-free bug — a class of memory-safety flaw where a program keeps a reference to a piece of memory after that memory has already been freed up for something else to use. If an attacker can get the browser to reuse that freed memory in a predictable way, they can potentially overwrite it with their own data and hijack the program's execution. Use-after-free bugs are, by a wide margin, the most common category of Critical and High-severity Chrome vulnerabilities disclosed in any given month, because so much of Chrome's rendering and networking code juggles objects that get created and destroyed constantly as you browse.

This particular bug sits in Prerender, the Chrome subsystem that speculatively loads a page in the background before you actually click a link, so the page feels instant the moment you do click it. Because Prerender processes page content automatically — without you clicking anything beyond a link Chrome predicts you're likely to visit, or in some cases simply by loading a page that references the target in a way the browser decides to prefetch — a crafted HTML page could potentially trigger the bug with very little user interaction. That combination of "runs mostly automatically" and "touches freed memory" is exactly the pattern that makes a bug worth a Critical rating rather than High.

Google rates the flaw Critical, its highest severity tier, reserved for bugs that could allow code execution outside of Chrome's security sandbox or otherwise seriously compromise the browser or the underlying operating system. Public vulnerability trackers, including Debian's security tracker, list a CVSS 3.1 base score of 8.8 for the issue. As with nearly every Chrome security bulletin, Google says it is not aware of any attacks exploiting this specific bug in the wild, and at the time of writing it is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, which tracks flaws confirmed to be under active attack. That's good news, but it's also exactly the window in which patching matters most: once a flaw like this is public and a fix has shipped, researchers — and attackers — start comparing the old and new code to work out precisely how to exploit it on machines that haven't updated yet.

The other nine fixes in this release

The October 15 update bundles nine additional security fixes alongside the Prerender flaw. Google's release notes, as is standard practice, hold back full technical detail on most individual bugs — descriptions, affected components, and researcher credit — until a solid majority of users have updated. That's a deliberate trade-off: publishing full exploit-relevant detail immediately would make life easier for attackers targeting the slice of users who haven't patched yet. This mirrors the approach Google took with the previous major Chrome security update, which also withheld full bug detail until rollout completed. Here's the severity breakdown reported around the release:

This update landed just two days after a considerably larger one: on October 13, Chrome 155.0.8059.79/.80 (Windows/Mac) and 155.0.8059.79 (Linux) fixed 37 security issues, seven of them Critical — including a Critical use-after-free in the PDF renderer, CVE-2026-110136, which Google said could let an attacker execute arbitrary code outside Chrome's sandbox via a crafted HTML page. Taken together, Chrome shipped 47 security fixes across eight Critical-rated bugs in a single five-day stretch this month. If you've been running Chrome for more than two weeks without restarting it, there's a reasonable chance you've missed both of these updates — Chrome downloads patches silently in the background but only applies them the next time you relaunch the browser.

How worried should you actually be?

For most people, the honest answer is: don't panic, but don't ignore it either. Google hasn't seen active exploitation of CVE-2026-110922, and Chrome's sandbox architecture means a single memory-corruption bug like this typically isn't enough on its own to fully compromise a machine — attackers usually need to chain it together with a second, separate sandbox-escape vulnerability to actually break out and run code on the underlying operating system. That's a meaningfully higher bar than a lone Critical rating might suggest, and it's why relatively few of the dozens of Critical Chrome bugs patched every year ever get weaponized into real-world attacks before users have had a chance to update.

That said, Critical-rated Chrome bugs absolutely do get weaponized, and Prerender-class bugs in particular are attractive because they can trigger with minimal interaction. Chrome's own security team, Google's Project Zero research group, and automated efforts like the "BigSleep" AI-assisted bug-hunting program — which has been credited with finding several Chrome use-after-free bugs patched earlier this year — actively hunt for exactly this class of flaw precisely because it's a reliable building block for real attacks. Keeping Chrome updated, and actually restarting the browser rather than leaving dozens of tabs open for weeks at a time, remains the single most effective thing a regular user can do to stay ahead of that research.

How to update Chrome right now

Chrome normally updates itself silently in the background and applies the update the next time you relaunch the browser. To check your version and force an update immediately:

1. Click the three-dot menu in the top-right corner of Chrome.
2. Go to Help > About Google Chrome (or type chrome://settings/help directly into the address bar).
3. Chrome will automatically check for an update and begin downloading one if it's available.
4. Click Relaunch once it appears — the update isn't actually active until you restart the browser, even after it finishes downloading.
5. Confirm the version number reads 155.0.8059.84 or later (or a 156/157 build, if your machine has already moved onto the newer staged rollout).

On Android and iOS, update through the Google Play Store or Apple's App Store respectively; both platforms typically auto-update Chrome unless you've specifically disabled that setting for the app.

What about Android, iOS and ChromeOS?

Security fixes don't always land on every platform on the same day, and it's worth keeping the platforms straight if you use Chrome across multiple devices. The October 15 fixes described above are specific to the Windows/Mac/Linux desktop Stable channel. Android and iOS run on their own release cadence, and in this case both have since moved on to newer builds — Chrome Stable 156 on iOS and an early-Stable Chrome 157 on Android — that bundle their own, separately disclosed security work rather than the exact same patch list. ChromeOS, meanwhile, ships Chrome browser fixes bundled together with operating-system-level patches rather than as a standalone browser update: its October 20 Stable release (M-156) included a long list of browser CVEs dating back to late September, plus three ChromeOS-specific fixes rated High severity, including a double-free in the Mali GPU driver's error-handling path and an out-of-bounds indirect call in arc-keymaster that could enable a guest-to-host attack inside Android's App Runtime for Chrome.

Why Chrome's patch pace matters

Chrome ships a new major version roughly every four weeks on its normal schedule, with security-only point releases squeezed in between whenever a serious bug needs an out-of-cycle fix — which is effectively what happened twice in five days this October, with the October 13 and October 15 updates landing back to back. For a browser used by billions of people as the front door to nearly everything they do online, that pace is deliberate: Chrome's security team would rather ship a fix the moment it clears internal testing than batch it into the next scheduled release and leave a known Critical bug sitting in production any longer than necessary. It's also why Chrome's auto-update mechanism, and the habit of actually restarting the browser when it asks, matters more than almost any other single security setting on a typical computer.

If you manage Chrome across multiple machines — for a family, a small office, or a larger organization — Google also publishes an Extended Stable channel that updates on a slower, more predictable cadence for environments that can't tolerate frequent changes, alongside policy controls that let IT admins force updates on a schedule rather than relying on each user to relaunch their browser voluntarily, similar in spirit to how enterprises handled the rollout of Windows 11's KB5127648 update this month. For everyone else, the default auto-update behavior, left switched on, is designed to close gaps like this one within days of a fix becoming available.

What's next

Chrome 157 is currently in an early-Stable rollout to a small slice of desktop and Android users, with wider Mac desktop availability following shortly after the initial Windows push. Expect it to widen to the full Stable channel over the next one to two weeks, at which point Google will typically publish its own dedicated security bulletin detailing exactly which CVEs that release fixes. In the meantime, the actionable step is the same one it always is with Chrome: open the three-dot menu, check for an update, and restart the browser when it asks. It takes well under a minute, and it closes the gap on a bug rated as seriously as this one.

Written byFelix Moreau

Felix Moreau writes Pandromeda's software coverage and how-to guides. He covers Windows, macOS and Linux updates, the apps people rely on, emulators and developer tools, and turns official documentation into clear, numbered steps that work on the current version.

More from Felix MoreauAll Software & Guides coverage