Google has released Chrome 155.0.8059.84 and .85 with fixes for 10 vulnerabilities, one rated critical and six rated high. The critical flaw, CVE-2026-110922, is a use-after-free bug in Prerender, the feature that loads pages before a user clicks on them. Google reports no exploitation in the wild.
CVE-2026-110922: Use-After-Free in Prerender
The stable channel update shipped October 15 for Windows, Mac and Linux, and it rolls out to users over days to weeks. Desktop builds before 155.0.8059.84 are affected. A crafted web page could trigger the bugs, and because other Chromium-based browsers share much of Chrome’s code, Edge, Brave and Opera will need matching updates.
The single critical vulnerability is a use-after-free in Prerender. Prerendering loads a page in the background before the user navigates to it, and the flaw sits in that feature’s handling of memory. Google has not published further technical detail about how the bug is triggered.
Three of Seven Critical and High Bugs Sit in the V8 Engine
Of the seven vulnerabilities rated critical or high, three are in V8, Chrome’s JavaScript engine. Other high-severity flaws include an input validation weakness in Desktop, a use-after-free in Compositing and memory corruption in Workers. Google keeps bug details private until most users have updated, so exploitation specifics are limited to these short descriptions. The V8 engine is the component that executes JavaScript, which is why bugs there are reachable from an ordinary web page.
Xinyang Ge Reported Five Bugs; One Credit Names Claude
Researcher Xinyang Ge reported five of the bugs in the release, which is half of the ten fixes. One flaw, CVE-2026-110913, was credited as found with assistance from Claude, the AI model from Anthropic. The credit means an AI model helped a human researcher find a vulnerability in the browser, and Google lists it in the same release notes as the rest of the fixes.
The Remaining High-Severity Flaws by Component
Beyond the critical Prerender bug, the high-severity fixes cover several parts of the browser. Three are in the V8 JavaScript engine, which runs the code of every web page a user visits. One is an input validation weakness in Desktop, one is a use-after-free in Compositing, and one is a memory corruption flaw in Workers. Together with the Prerender fix, these account for the one critical and six high-rated vulnerabilities named in the release.
No Exploitation and No KEV Listing
Google reports no exploitation in the wild for any of the 10 fixes, and none of them appear in CISA’s Known Exploited Vulnerabilities catalog. The release therefore carries no emergency signal of the kind attached to zero-day patches, though it contains a critical-rated fix that a crafted web page could reach. Administrators should still schedule the update promptly, because Google withholds bug details only until most users have updated.
The version string matters for checking status. Builds 155.0.8059.84 and .85 contain the fixes, and any desktop build earlier than 155.0.8059.84 on Windows, Mac or Linux is exposed to all ten flaws.
Manual Update to 155.0.8059.84 and Downstream Chromium Browsers
Users can update Chrome manually to 155.0.8059.84 or later instead of waiting for the staged rollout. Organizations running other Chromium-based browsers should watch for matching updates from those vendors, since the fixes reach each product on its own schedule.
That downstream schedule determines how long exposure lasts. A fix in Chrome does not protect a user of a derivative browser until that vendor ships the corresponding build. Google’s practice of withholding bug details until most users have updated is meant to narrow the window in which attackers can study the fixes, and the rollout over days to weeks is the period that practice covers.
Three of the ten fixes fall below the critical and high tiers, and the update information available so far does not describe them individually.
