Google shipped Chrome 155 on 13 October with 37 security fixes, seven of them rated Critical. A crafted web page is enough to reach code execution outside the browser sandbox. Update every company browser this week.
What happened
The Stable channel update moves Windows and Mac to 155.0.8059.79 or 155.0.8059.80, and Linux to 155.0.8059.79. Google lists 37 fixes in that build. The seven Critical entries are a buffer overflow in ANGLE and use-after-free bugs in Browser, PDF, Network, Core, SVG and Media.
CVE-2026-110136 is a use-after-free in the PDF component. Google's record says a remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page on Chrome before 155.0.8059.79. CVE-2026-110152 is a buffer overflow in ANGLE on Android Chrome, with the same outcome: code execution outside the sandbox from a crafted page. Google has not reported exploitation of this batch.
A follow-up Stable build, 155.0.8059.84, rolled out on 15 October with 10 further fixes, including another Critical use-after-free. Treat anything older than that build as behind.
Who is affected
- Google Chrome on Windows and Mac before 155.0.8059.79
- Google Chrome on Linux before 155.0.8059.79
- Google Chrome on Android before 155.0.8059.79
- Staff who open email links, customer portals or PDFs inside the browser
What to do now
Update Chrome to 155.0.8059.84 or later, then relaunch it.
- On a PC, open Chrome menu, Help, About Google Chrome, and wait until it reports up to date, then relaunch.
- Confirm the version string starts at 155.0.8059.84 or higher. The 13 October fix landed in .79; the 15 October fix is .84.
- Push the same update through your browser management policy so laptops that sit off-site do not stay on the old build.
- Repeat the check on Android phones used for email and banking apps that open links in Chrome.
What this means for South African businesses
Almost every SME we support has Chrome on the front desk PC, the director's laptop and at least a few Android phones. A bug that fires from a normal web page, with no login and no attachment the user has to open, is the kind of flaw phishing crews use the week a patch ships. The practical risk is not a targeted nation-state attack. It is a staff member clicking a link in a supplier email before the browser has restarted onto the new build.
Google has not said these flaws are being exploited. That is not a reason to wait. Restart the browser after the update or the old code keeps running.
Source: Google Chrome Releases, Stable Channel Update for Desktop, 13 October 2026.