Google has released a Chrome Stable security update that addresses ten vulnerabilities across Windows, macOS and Linux. The group includes one critical flaw, six high-severity issues and three medium-severity bugs spread across several browser components. The most urgent repair is for a use-after-free condition in Chrome’s Prerender functionality.

The fixed builds are Chrome 155.0.8059.84 and .85 for Windows and macOS, and 155.0.8059.84 for Linux. Distribution is staged, so not every device will see the update simultaneously. Users can prompt a check from Chrome’s About page and should restart the browser when requested, because downloading an update without relaunching leaves the old process running.

Critical flaw affects the Prerender feature

CVE-2026-110922 is a critical use-after-free vulnerability reported by researcher Xinyang Ge on October 2. This class of defect occurs when software releases a region of memory but later continues to reference it. An attacker who can manipulate the stale reference may trigger a crash or corrupt memory, sometimes creating a path toward code execution.

Google has not published detailed exploitation mechanics and has not said that the flaw is being used in active attacks. Restricting technical information during rollout is a common protective measure: it gives the majority of users time to update before complete details make reliable exploit development easier. The lack of reported exploitation, however, is not a reason to postpone an available critical patch.

The release also fixes CVE-2026-110913, a high-severity memory-corruption issue in the Document Object Model, which represents and controls the structure of web pages. Ge reported the issue with assistance from Anthropic and its Claude AI system. The credit is notable, although Google’s advisory does not describe whether the model discovered the bug, helped analyze it or assisted with another part of the research process.

V8, SVG and Core receive high-severity fixes

Five additional high-severity problems affect foundational browser components. CVE-2026-110919 and CVE-2026-110921 are use-after-free flaws in V8, Chrome’s JavaScript engine. CVE-2026-110920 is another V8 memory-corruption issue. Google repaired CVE-2026-110918 in Core, while researcher C0rk1 reported CVE-2026-110917 in SVG.

The three medium-severity vulnerabilities round out the update: CVE-2026-110916 involves insufficient input validation in Desktop, CVE-2026-110915 is a use-after-free issue in Compositing, and CVE-2026-110914 concerns memory corruption in Workers. Together, the ten fixes show that this is not a patch for one isolated subsystem.

• Critical: CVE-2026-110922 in Prerender.
• High: CVE-2026-110913 in DOM and five flaws across V8, Core and SVG.
• Medium: three issues in Desktop, Compositing and Workers.

Google also noted that its internal security work uses memory-safety and fuzzing tools including AddressSanitizer, MemorySanitizer, libFuzzer and AFL. These tools exercise software with unusual inputs and monitor execution for memory errors that conventional functional tests may not reveal.

Enterprises should verify deployment, not assume it

For individuals, the practical response is to update and relaunch. Managed environments need an additional verification step. Administrators should confirm that device-management reporting shows the corrected build on Windows, macOS and Linux endpoints, investigate machines that remain behind policy, and account for browsers that have been left open for long periods.

Because Chromium code is used by multiple browser products, security teams should also watch their respective vendors for applicable releases and version guidance rather than assuming that updating Google Chrome fixes every Chromium-based browser installed in the organization.

Browser vulnerabilities are attractive because malicious web content can reach large numbers of users with little friction. Rapid installation narrows that opportunity. Security teams should communicate the required restart clearly and track exceptions until every managed endpoint reports compliance. With a critical memory flaw at the top of this release and multiple high-severity issues underneath it, organizations should treat Chrome 155.0.8059.84 or later as the new minimum secured baseline.