GOOGLE has issued Chrome updates across desktop and Android to address a batch of security flaws, including seven rated as Critical. The desktop release, rolling out to Chrome 155.0.8059.79/.80 for Windows and macOS and 155.0.8059.79 for Linux, accompanies a separate Android update (155.0.8059.79). The company notes the updates include 37 security fixes, with the seven Critical flaws potentially allowing remote code execution. Updates will be staged over the next days and weeks.
Key technical details highlighted by Malwarebytes identify three CVEs of note. First, CVE-2026-110152 describes a buffer overflow in ANGLE (Chrome’s graphics-translation layer) on Android that could let a remote attacker execute arbitrary code outside the sandbox via a crafted HTML page.
The article also describes two use-after-free vulnerabilities in the PDF component: CVE-2026-110136, deemed Critical, which could enable remote code execution outside the sandbox via a crafted HTML page; and CVE-2026-110147, rated High, which could allow code execution inside the sandbox via a crafted HTML page. The piece explains that use-after-free flaws occur when memory is accessed after it has been freed, potentially causing crashes or enabling code execution. Although running inside the sandbox limits impact, attackers may chain vulnerabilities to escape it.
The piece notes users should update promptly, either by allowing automatic updates or via About Google Chrome, and acknowledges the Android update may not yet be visible to all on Google Play.