Google Chrome patches 37 security flaws including seven critical bugs

Google has published a security update for its Chrome browser across desktop and Android platforms, addressing 37 vulnerabilities, including seven critical memory safety defects.

The update resolves flaws that could lead to memory corruption, browser crashes, or arbitrary code execution. Most of the critical issues involve use-after-free errors, which occur when software continues to read or write to system memory after releasing it. Attackers can exploit such flaws to alter memory contents or run malicious instructions.

The critical vulnerabilities in Chrome

Among the seven critical bugs, one is a buffer overflow in ANGLE, the graphics engine translation layer used by Chrome to display hardware-accelerated visuals. The other six are use-after-free weaknesses scattered across core subsystems.

Zhenpeng Lin at depthfirst discovered and reported the ANGLE buffer overflow on 30 September. Google credited internal teams with finding 12 of the 37 patched bugs. At least 15 reports came from external researcher Xinyang Ge at Anthropic, who conducted the work assisted by Claude; Google noted that no bug bounty reward will be paid for those submissions. Google did confirm paying $1,000 for one high-severity flaw reported by an outside researcher, while other payouts remain undisclosed.

High-severity flaws resolved in the package include CVE-2026-110169 in V8, the JavaScript and WebAssembly engine, which could let an attacker execute code inside Chrome's sandbox via a crafted web page. Google has not indicated that any of the flaws are actively being exploited in attacks.

Patched versions and how to update

The fixes arrive in Chrome version 155.0.8059.79/.80 for Windows and macOS, and 155.0.8059.79 for Linux and Android.

Google is distributing the update automatically over several days, but desktop users can install it manually by selecting the three-dot menu, choosing Help, and clicking About Google Chrome. Relaunching the browser completes the installation. Android users will receive the update through the Google Play Store.

Mozilla fixes 77 bugs and introduces Firefox Enterprise

Mozilla also released security patches on Tuesday, issuing Firefox 158 alongside updates for Firefox ESR and Thunderbird. The browser update fixes 77 security defects, including 30 high-severity bugs covering sandbox escapes, privilege escalation, use-after-free errors, and race conditions. Mozilla researchers discovered 40 of the bugs, while Amy Burnett of OpenAI uncovered nine.

Alongside the patches, Mozilla launched Firefox Enterprise, a dedicated browser build aimed at business environments. The release includes an on-premise management console to oversee data access, enterprise policies, and artificial intelligence usage, relying on Mozilla's Gecko layout engine as an alternative to Chromium-based browsers.