CERT-In Warns Chrome Users as Google Fixes 37 Security Flaws, Including Seven Critical Bugs

Desktop Users Urged to Install Chrome Security Fixes

India's Computer Emergency Response Team, CERT-In, issued a warning on October 14, 2026, about Google Chrome vulnerabilities that could allow attackers to run malicious code, obtain sensitive information or disrupt affected computers. Google released fixes a day earlier for 37 security flaws, including seven rated critical.

The affected versions are Chrome releases earlier than 155.0.8059.79 on Linux and 155.0.8059.79/.80 on Windows and macOS. Users should open Chrome's About page, check for an update and relaunch the browser when prompted to finish installing it.

Google's desktop release announcement, dated October 13, lists seven critical vulnerabilities, 29 rated high and one rated medium. The weaknesses reach across graphics, documents, networking, passwords and the software that runs website instructions.

Google says distribution will take days or weeks. Someone who checks immediately may therefore need to check again as the release reaches more computers.

Which Versions Need Updating?

CERT-In's warning covers desktop Chrome on Windows, macOS and Linux. Hong Kong's Computer Emergency Response Team Coordination Centre, HKCERT, lists the same affected versions and recommends installing the vendor's fixes.

• Linux: install Chrome 155.0.8059.79 or later.
• Windows: install Chrome 155.0.8059.79/.80 or later.
• macOS: install Chrome 155.0.8059.79/.80 or later.

The version number matters because the fixes are delivered through the browser update. A computer can still open websites normally while running a version containing these weaknesses. For households, the immediate task is to check each computer. For organisations, it is to establish which machines have received the release and completed the required relaunch.

Chrome's version is shown under Help, then About Google Chrome, in the menu opened through the three dots at the top right of the browser. That page also checks whether an update is available.

Seven Critical Flaws Affect Core Browser Tasks

Google identifies CVE-2026-110152 as a critical buffer overflow in ANGLE, a graphics component used by Chrome. A buffer is an area of memory set aside to hold data. An overflow happens when software writes beyond that area's boundary, potentially damaging nearby data or allowing an attacker to interfere with how a program runs.

Zhenpeng (Leo) Lin at depthfirst reported the ANGLE vulnerability on September 30, according to Google's release notice. Its possible consequences include crashes and malicious code execution.

The six other critical vulnerabilities are all use after free errors. They affect Browser, PDF, Network, Core, SVG and Media components. These cover functions ranging from handling documents and graphics to communicating over a network.

A use after free error occurs when software continues to use a piece of memory after releasing it. Think of a program treating an old storage location as if its contents still belonged to it, even though that space may now hold something else. An attacker may be able to influence the replacement contents and disrupt or redirect the program.

Google lists the six critical identifiers as CVE-2026-110149, CVE-2026-110136, CVE-2026-110161, CVE-2026-110165, CVE-2026-110148 and CVE-2026-110151. Together with the ANGLE flaw, they account for seven of the 37 fixes, or roughly one in five.

What Could Happen on an Affected Computer?

CERT-In warns that exploitation could lead to arbitrary code execution, sensitive information disclosure or denial of service. In everyday terms, those outcomes mean running instructions chosen by an attacker, exposing private data or making software stop working properly.

HKCERT's Chrome security bulletin, also dated October 14, lists two further possible impacts: elevation of privilege and security restriction bypass. The first means gaining permissions beyond those normally allowed; the second means getting around a protective rule.

HKCERT assigns the bulletin a Medium Risk rating, while Google's list rates seven individual flaws critical. The two assessments use different scopes: HKCERT gives a rating to the bulletin as a whole, while Google labels each vulnerability separately. HKCERT's recommended action is to apply the fixes.

The HKCERT bulletin enumerates CVE-2026-110136 through CVE-2026-110172, a sequence containing all 37 identifiers. CVE numbers act as reference labels, helping software makers and administrators track the same security problem across notices and updates.

Passwords, JavaScript and Documents Are Also Affected

Google's 29 high severity fixes include problems in V8, Chrome's JavaScript engine. JavaScript provides instructions that make many websites interactive. A weakness in the engine can arise while the browser is processing those instructions.

The V8 entries include a type confusion flaw, CVE-2026-110140, and two use after free flaws, CVE-2026-110168 and CVE-2026-110169. Type confusion means software handles a piece of data as though it were a different kind, which can lead to unsafe memory operations.

Chrome's Passwords component has three high severity entries: an information leak and two use after free errors. Other fixes concern Extensions, WebRTC, DOM, Canvas and PDFium. These components support add ons, browser communications, webpage structure, drawing and PDF processing.

Google also lists permission related weaknesses in ReadingMode, Installer, Updater and Mojo. For example, an authorisation error concerns whether a program correctly checks that an action is allowed. The single medium severity entry is a use after free vulnerability in FileSystem, identified as CVE-2026-110142.

The breadth of the list explains why the update matters beyond any single browsing activity. Chrome processes text, scripts, graphics, documents and network data, and this release repairs weaknesses in several of those processing paths.

Who Reported the Vulnerabilities?

Xinyang Ge of Anthropic reported the high severity V8 vulnerability CVE-2026-110169 on September 28, with assistance from Claude, according to Google's credit. The notice identifies the researcher, organisation and assistance involved, but gives no further description of Claude's role.

Google also credits Xinyang Ge for multiple other findings, including critical vulnerabilities in PDF, SVG and Media. Google itself reported the critical Browser, Network and Core errors. Other named contributors include Hoyong Jin, M. Fauzan Wijaya, Aria Akhavan, Souma Ohsawa and Andrew Boni.

The disclosure dates show that the release brings together findings made over several months. Google's list includes a Bindings vulnerability reported on March 25 and more recent Media vulnerabilities reported on October 6. They are being addressed together in this stable release.

Why Some Technical Details Remain Restricted

Google says access to some bug records may remain restricted while users receive the update. Srinivas Sista, who published the release announcement for Google Chrome, explained the company's disclosure policy:

Access to bug details and links may be kept restricted until a majority of users are updated with a fix.

Google also says restrictions can continue when a vulnerability affects a library used by other projects that have not yet repaired it. A library is a reusable piece of software, so the same underlying error can require work by several development teams.

The release notice names the affected components and error types while limiting access to some deeper technical records. For users, the practical information is the version containing the fixes. For administrators, the identifiers provide a way to match this release against vulnerability tracking and software inventories.

From Research Reports to the Public Warning

The key dates trace how individual findings became a browser update and then public security warnings:

• September 28, 2026: Xinyang Ge of Anthropic reported CVE-2026-110169 in V8, assisted by Claude.
• September 30: Zhenpeng (Leo) Lin at depthfirst reported the critical ANGLE buffer overflow.
• October 1 to 6: Google and other researchers reported several further critical and high severity vulnerabilities included in the release.
• October 13: Google announced the stable Chrome update containing 37 security fixes.
• October 14: CERT-In issued its warning, and HKCERT published its bulletin covering the same 37 identifiers.

Google's release date marks the start of distribution. Its stated rollout period of days or weeks means delivery will continue after the announcement, making follow up checks useful for computers that initially show no available update.

How to Complete the Update

Chrome users can begin through the browser's built in update screen. The steps are straightforward:

• Open Chrome and select the three dot menu at the top right.
• Select Help, then About Google Chrome.
• Allow Chrome to check for and download an available update.
• Save any unfinished work and select Relaunch if prompted.
• Return to the About page to check the installed version.

A relaunch matters because downloading the update and running the updated browser are separate steps. Keeping an old browser session open can delay completion of the installation.

Organisations should check installed versions across their desktop computers, including devices whose users rarely close the browser. The concrete goal is to confirm that machines are running the release containing the fixes, with any required restart completed.

Users who do not yet see the release should check again during Google's rollout. The official release notice allows days or weeks for distribution, a longer window than simply expecting every computer to receive it on announcement day.

Edge Users Also Need to Watch for Fixes

Microsoft Edge uses Chromium, the browser platform that also underlies Chrome. Some vulnerabilities in that shared software can therefore require fixes in Edge as well.

Microsoft acknowledged the latest Chromium security fixes in an advisory dated October 13 and said it was working on an update. At the time of the warning, the corresponding stable channel security update had not been released, and Microsoft had given no release date.

Edge users should check for Microsoft's update as it becomes available. People who use both browsers need to check each one: Chrome receives its security release through Google, while Edge receives its release through Microsoft.

Key Points

• CERT-In warned desktop Chrome users on October 14, 2026, about vulnerabilities that could expose data, disrupt software or allow malicious code execution.
• Google's October 13 release fixes 37 flaws: seven critical, 29 high and one medium.
• The fixed versions are 155.0.8059.79 for Linux and 155.0.8059.79/.80 for Windows and macOS, or later releases.
• Users should check Help, then About Google Chrome, install the update and relaunch when prompted.
• Google says distribution may take days or weeks. Microsoft had not announced a date for the corresponding Edge stable update.