India’s Computer Emergency Response Team (CERT‑In) issued an advisory on 14 October 2026 warning that several critical security flaws in Google Chrome could expose devices and data to malicious actors. In response, Google has begun distributing an update that resolves a total of 37 reported vulnerabilities, many of which are classified as critical.
Scope of the vulnerabilities
The advisory notes that the weaknesses affect Chrome desktop versions older than 155.0.8059.79 on Linux and older than 155.0.8059.79 or 155.0.8059.80 on Windows and macOS. Exploitation could enable attackers to execute arbitrary code, steal sensitive information, or trigger denial‑of‑service conditions on compromised systems.
Google’s patch addresses 37 distinct issues. Among the most severe is CVE‑2026‑110152, a buffer‑overflow bug in ANGLE, the graphics abstraction layer used by Chrome. The flaw allows data to be written beyond the allocated memory region, potentially causing browser crashes or providing a pathway for malicious code execution.
Six additional critical vulnerabilities are described as “use‑after‑free” bugs. These affect components that handle PDF files, networking, Scalable Vector Graphics (SVG), media playback, and core browser functionality. A use‑after‑free error occurs when software accesses memory that has already been released, creating an opening for attackers to interfere with normal operations or inject malicious code.
Beyond the critical set, the update also resolves several high‑severity issues across a range of Chrome subsystems. The V8 JavaScript engine, responsible for running web‑page scripts, is impacted by CVE‑2026‑110169, another use‑after‑free flaw. Additional patches cover the Password manager, Extensions framework, WebRTC communication module, Document Object Model (DOM), PDFium rendering library, and the Canvas graphics component. The breadth of affected modules illustrates how vulnerabilities can arise in many layers of a modern browser, from script execution to document handling and network communication.
The high‑severity V8 issue was reported by Xinyang Ge of Anthropic, with assistance from the AI system Claude, according to Google’s credits. This acknowledgment highlights the role of external security researchers and AI‑assisted analysis in uncovering complex bugs.
Updating Chrome and related browsers
CERT‑In advises both individuals and organisations running the affected versions to install the latest security update without delay. Users can verify their current Chrome version by opening the browser, clicking the three‑dot menu, and navigating to Help > About Google Chrome. The “About” page automatically checks for updates and, if a newer build is available, begins downloading it. A browser relaunch is required to complete the installation.
Google is rolling out the patched version gradually, meaning the update may not appear on every device immediately. The advisory recommends that users who do not see the new version on the first check repeat the process after a short interval.
The advisory also notes that Microsoft Edge, which is built on the same Chromium engine, could be exposed to some of the broader set of vulnerabilities. Microsoft issued its own advisory on 13 October 2026 acknowledging the Chromium fixes and stating that a stable‑channel update was in development. At the time of reporting, Microsoft had not released a corresponding patch, and Edge users were urged to monitor Microsoft’s update channels for the forthcoming fix.
Implications and the importance of timely patches
Web browsers routinely process content from websites, documents, extensions, and other online services. Vulnerabilities in any of these processing paths create opportunities for threat actors to compromise the host system. CERT‑In’s warning underscores the risk of continuing to use browsers that contain known security flaws, especially those that allow arbitrary code execution or memory corruption.
The advisory quotes The420 Cybersecurity Insight: “An Outdated Browser Can Become a Security Risk.” This statement reinforces the broader message that keeping software current is a fundamental defense against exploitation. By applying the latest patches, users close the attack surface presented by the identified flaws and reduce the likelihood of successful cyber‑attacks targeting Chrome’s core components.
In summary, the combination of CERT‑In’s advisory and Google’s rapid patch deployment highlights a coordinated effort to mitigate a sizable set of vulnerabilities across Chrome’s architecture. Users and organisations are encouraged to verify their browser versions, apply the update to version 155.0.8059.79 or later, and stay alert for further guidance from both Google and Microsoft regarding related Chromium‑based browsers.
Be First to Comment