Google Chrome Update Patches 37 Vulnerabilities Including Seven Critical Flaws
Google has released a new security update for its Google Chrome browser that resolves 37 vulnerabilities, including seven rated Critical.
The company issued the update on October 13, 2026, delivering version 155.0.8059.80 for Windows and macOS and 155.0.8059.79 for Linux. The patches address flaws across multiple components and will roll out gradually over the coming days and weeks.
Critical vulnerabilities
Seven issues received the highest severity rating. The most notable is a buffer overflow vulnerability CVE-2026-110152 in the graphics component ANGLE. The remaining six are Use After Free flaws: CVE-2026-110149 in Browser, CVE-2026-110136 in PDF, CVE-2026-110161 in Network, CVE-2026-110165 in Core, CVE-2026-110148 in SVG, and CVE-2026-110151 in Media.
High and Medium issues
Twenty-nine vulnerabilities are rated High. Most involve Use After Free conditions in components such as the V8 JavaScript engine, WebRTC, PDF, DOM, and Media. One additional vulnerability rated Medium was also fixed.
Full list of patched CVEs
- CVE-2026-110136 (Critical)
- CVE-2026-110148 (Critical)
- CVE-2026-110149 (Critical)
- CVE-2026-110151 (Critical)
- CVE-2026-110152 (Critical)
- CVE-2026-110161 (Critical)
- CVE-2026-110165 (Critical)
- CVE-2026-110137 to CVE-2026-110141, CVE-2026-110143 to CVE-2026-110147, CVE-2026-110150, CVE-2026-110153 to CVE-2026-110160, CVE-2026-110162 to CVE-2026-110164, CVE-2026-110166 to CVE-2026-110172 (High)
- CVE-2026-110142 (Medium)
Related articles
Ivanti Connect Secure VPN Hit by Zero-Day Authentication Bypass Vulnerability CVE-2026-104935
Ivanti has disclosed a critical authentication bypass vulnerability in its Ivanti Connect Secure remote access product that allows remote attackers to execute arbitrary commands without authentication. The flaw, tracked as CVE-2026-104935, carries a CVSSv3.0 base score of 8.6 and has already been exploited in the wild against certain customer environments. Affected versions include 25.1.2.2, 25.1.1.1, and 22.8R2.4 along with earlier releases in those branches, while versions 22.7R2.14 and prior remain unaffected. Ivanti discovered the issue through its product security program and released the fix in version 25.1.3.0 during July. The company published its security advisory on October 13, 2026, confirming active exploitation of the zero-day in unpatched branches.
NICT Warns of A2B Attacks Where Reverse-Engineered Android Apps Expose Vulnerable Backend Servers
Japan's National Institute of Information and Communications Technology (NICT) has issued an alert on A2B attacks, in which publicly available Android apps are reverse-engineered to identify and target their backend servers. The technique, called App-to-Backend Attack, allows threat actors to discover internal server endpoints even when organizations do not publish connection details. Once identified, attackers exploit vulnerabilities, weak authentication, or misconfigured APIs on those servers, leading to unauthorized access and data theft. NICT notes that multiple recent membership-service breaches in Japan stem from this vector rather than flaws in the mobile apps themselves. The institute urges developers and operators to harden backend infrastructure, conduct thorough compromise assessments, and apply proper access controls. Related incidents include unauthorized access to Lawson ID services, Yakiniku King app member data, and Japan Post's postal app.
From HFT to Infosec: How AI Accelerates the Developer-Hacker Arms Race
An experienced security researcher draws a parallel between high-frequency trading evolution and modern vulnerability research, showing how artificial intelligence compresses the time between patch release and working exploit. The author describes the classic workflow where developer Rob fixes buffer overflows in an FTP server while researcher Dave reverse-engineers the diff to locate the exact change. With AI assistance, both sides now generate patches or exploits in minutes rather than days or weeks. The piece highlights that publishing a patch effectively discloses the location of the flaw, allowing automated tools to produce reliable exploits almost instantly. Historical examples such as wu-ftpd CVEs and the EternalBlue/MS17-010 worm illustrate how quickly mass exploitation follows disclosure. The author warns that open-source projects face an existential dilemma: withhold patches and leave users exposed, or release them and trigger immediate automated scanning. Recommendations include mandatory back-porting of fixes and wider use of runtime protections, yet the overall outlook remains pessimistic about the coming wave of fully automated attacks.
Ghost Assets in Vulnerability Management: How Identification, Merging and Asset History Eliminate Anomalies in MaxPatrol VM
Positive Technologies experts explain how infrastructure changes create duplicate, merged and phantom assets that distort vulnerability management. The article details three core mechanisms inside MaxPatrol VM: unique asset identification across scan sources, non-destructive merging of new and existing data, and full lifecycle history with configurable aging policies. It describes how the system distinguishes assets using prioritized keys such as system ID, FQDN, MAC address and VM ID, then applies recursive merging rules that respect multiple data sources. Policies allow teams to set freshness and obsolescence thresholds, automatically hiding assets after 90 days while preserving historical snapshots for PDQL queries. The piece also covers practical cloning and partial-scan scenarios that can produce misleading duplicates or lingering collections.