Google shipped a Chrome security update on October 15 that fixes 10 vulnerabilities, and one of them is rated critical. The release is four days old, but it is still reaching browsers, and coverage kept coming through October 19. Google has not said that any of the ten bugs is under attack, which makes this a reason to act now rather than a reason to panic.
Chrome is installed on many American laptops and desktops, and the fixes cover Windows, Mac and Linux. Chrome Geek reports that Chrome for Android carries the same fixes. If you use Chrome for banking, email or work, the fix takes a few minutes and mostly requires a restart.
Chrome security update: what Google fixed on October 15
The most serious flaw is CVE-2026-110922, a critical use-after-free bug in Chrome's Prerender component. Use-after-free bugs occur when software keeps using memory after it has been released, and attackers can sometimes turn that mistake into a way to run their own code. Cyberpress and Cybersecurity News both credit Xinyang Ge with reporting the bug, with an October 2 disclosure date.
Piunikaweb's October 19 coverage says the critical bug could have let a malicious site reach deleted memory while a page was being preloaded. Prerendering loads a page in the background before you visit it, so a flaw there matters even though no file download is involved.
The other nine fixes break down by severity, according to the coverage:
- High (six): CVE-2026-110913 in DOM, a memory-corruption flaw reported September 29; three V8 bugs, CVE-2026-110919, CVE-2026-110920 and CVE-2026-110921; CVE-2026-110918 in Core; and CVE-2026-110917 in SVG.
- Medium (three): CVE-2026-110916 in Desktop input validation, CVE-2026-110915 in Compositing, and CVE-2026-110914 in Workers.
Coverage describes the fixes as use-after-free and memory-corruption issues. Google has not published further technical detail, so readers have to judge the risk from the severity labels and the limited specifics above. Google has also not said whether any of the ten bugs is being exploited in the wild, a gap that Simply Secure Group also notes.
Which Chrome build has the fix
The fixed builds are Chrome 155.0.8059.84 or .85 on Windows and Mac, and 155.0.8059.84 on Linux, according to Chrome Geek. Any build older than that does not include the October 15 fixes.
Chrome's October stream has been unusually heavy, which makes the version history easy to mix up. The October 6 stable release carried 247 security fixes, four of them rated critical, according to gHacks. On October 13, build 155.0.8059.79/.80 added 37 fixes, seven of them critical, as Malwarebytes reported. The October 15 update then added 10 more.
If your browser still reads 155.0.8059.79, it predates the October 15 fixes, so update again rather than assuming you are covered. The build strings and fix counts in this story come from secondary coverage. For managed devices, Google's own Chrome Releases post remains the place to confirm exact numbers.
Where Claude fits into the bug hunt
Google's release credits Xinyang Ge of Anthropic for CVE-2026-110913, the high-severity DOM memory-corruption flaw reported on September 29. The credit reads “assisted by Claude,” as Cybersecurity News and GBHackers report.
The release does not explain how the bug was found or what Claude contributed. “Assisted by” covers a wide range of help, and the public record does not say how much of the discovery came from the model. That gap matters, because a headline that names an AI model can suggest more than the release note confirms.
Our earlier reporting on XBOW's AI agents chaining three Chrome bugs into a $250,000 exploit shows what these tools can do when they are pointed at browser code. Defenders should expect more AI-assisted reports like this one. Vendors will likely need to explain their credit lines more clearly when a model is named, though Google has not said that.
How to update Chrome and confirm your build
For desktop users, the quick path looks like this:
- Type chrome://settings/help into the address bar and press Enter. Chrome checks for updates when this page opens.
- Let the download finish. If an update is available, the About page will show it.
- Click Relaunch. A downloaded update does not protect you until the browser restarts, as Techjournal notes.
- Confirm the build reads 155.0.8059.84 or newer on Windows, Mac or Linux.
- If no update appears, check again in a few days. Rollouts are staged, so a missing update may simply mean your turn has not come yet.
Android users should open the Google Play Store, search for Chrome and install any pending update. Edge, Brave and Opera are Chromium-based browsers that ship their own patches, so check their update pages too. The coverage of this update does not address those browsers' timelines, so look in each browser's settings menu directly.
The exposure is broad. DigitBin reports that browser flaws can be triggered by visiting a prepared webpage, opening a PDF or clicking a malicious link. Anyone browsing on an unpatched build is in scope, and a patch is one of the few steps that closes the gap for everyone at once.
What is still unknown and what to watch next
Several questions remain open. Google has not said whether any of the ten bugs is being exploited. Coverage says technical details stay restricted until most users update, so the attack mechanics remain unclear. The tension is familiar: a published fix tells attackers where to look, so vendors often hold back specifics until patches reach most machines.
Claude's role is also unresolved, and the version counts vary across outlets. Those discrepancies are a reason to check your own build rather than trust any single article's numbers.
Enterprise teams face a heavier load this week. The Palo Alto PAN-OS zero-day, CVE-2026-0322, is being exploited, which puts network administrators on a tighter clock than most desktop users face. Chrome patches are still worth installing quickly, but they are not the most urgent item on every IT queue.
Watch for three things: whether Google updates its Chrome Releases post with exploitation status, whether later stable updates add technical detail on the Prerender bug, and whether follow-up reporting clarifies how Claude contributed. The next Chrome stable update will likely arrive on the usual cadence, and checking your build after each one is the simplest habit that keeps you covered.
