Google Chrome Update Patches 37 Vulnerabilities Including Seven Critical Flaws
Google has released a new security update for its Google Chrome browser that resolves 37 vulnerabilities, including seven rated Critical.
The company issued the update on October 13, 2026, delivering version 155.0.8059.80 for Windows and macOS and 155.0.8059.79 for Linux. The patches address flaws across multiple components and will roll out gradually over the coming days and weeks.
Critical vulnerabilities
Seven issues received the highest severity rating. The most notable is a buffer overflow vulnerability CVE-2026-110152 in the graphics component ANGLE. The remaining six are Use After Free flaws: CVE-2026-110149 in Browser, CVE-2026-110136 in PDF, CVE-2026-110161 in Network, CVE-2026-110165 in Core, CVE-2026-110148 in SVG, and CVE-2026-110151 in Media.
High and Medium issues
Twenty-nine vulnerabilities are rated High. Most involve Use After Free conditions in components such as the V8 JavaScript engine, WebRTC, PDF, DOM, and Media. One additional vulnerability rated Medium was also fixed.
Full list of patched CVEs
- CVE-2026-110136 (Critical)
- CVE-2026-110148 (Critical)
- CVE-2026-110149 (Critical)
- CVE-2026-110151 (Critical)
- CVE-2026-110152 (Critical)
- CVE-2026-110161 (Critical)
- CVE-2026-110165 (Critical)
- CVE-2026-110137 to CVE-2026-110141, CVE-2026-110143 to CVE-2026-110147, CVE-2026-110150, CVE-2026-110153 to CVE-2026-110160, CVE-2026-110162 to CVE-2026-110164, CVE-2026-110166 to CVE-2026-110172 (High)
- CVE-2026-110142 (Medium)
Related articles
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.
Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21
The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.
Mozilla Releases Firefox 158.0.1 Security Update Fixing High-Severity Vulnerabilities and Compromised Certificates
Mozilla Foundation has published Firefox 158.0.1 on October 20, 2026, delivering fixes for four CVEs rated at high overall severity. Two vulnerabilities received a High rating, including a boundary condition flaw in the SVG component tracked as CVE-2026-113399 and a certificate blocklist issue identified as CVE-2026-113470. The update also refreshes the OneCRL list to block an intermediate certificate from eMudhra that was compromised earlier in the month. Mozilla delivered the updated blocklist via RemoteSettings on October 17 and embedded the changes directly into the browser release. This approach ensures compromised certificates remain blocked even when RemoteSettings is disabled or network access is unavailable. One Moderate and one Low severity issue complete the set of addressed flaws.