Summary
- Chrome 155.0.8059.79/.80 is rolling out across desktop platforms.
- Google says the stable update includes 37 security fixes.
- Bug details may remain restricted while users receive the fixes.
Google has released a stable-channel update for Chrome desktop containing 37 security fixes, including critical memory-safety vulnerabilities. The 13 October 2026 release moves Windows and macOS users to versions 155.0.8059.79 or 155.0.8059.80 and Linux users to 155.0.8059.79, with distribution taking place over the following days and weeks.
The update affects a browser that often sits between staff and business-critical applications, including identity services, cloud administration, finance platforms and collaborative systems. Browser vulnerabilities can expose users to malicious content or create a route across boundaries expected to separate web pages from local data and device functions. The consequences depend on each flaw and its exploitation requirements.
Google's release notes identify critical issues among the fixes, including a buffer overflow in ANGLE and a use-after-free defect in the browser. These classes describe memory handling errors that may lead to crashes or, under particular conditions, more serious security outcomes. A severity rating does not itself demonstrate that the vulnerabilities are currently being exploited in the wild.
The Chrome team says it may restrict links and bug details until a majority of users have received an update. It can also maintain restrictions where defects affect third-party libraries used by other projects that have not yet applied a correction. That policy reflects the risk of publishing technical detail before dependent software has been widely patched.
Enterprise deployment adds another variable to an otherwise automatic consumer update. Managed devices can follow controlled release channels, maintenance windows and policy-based version requirements. A published fix date does not guarantee that every employee workstation has installed or restarted into the corrected version, particularly where a browser session stays open for long periods.
Security teams also need to distinguish the standard stable channel from the separate extended stable release. Google issued an extended stable update on 13 October with its own version numbers and 28 fixes. Those release trains are not interchangeable; a version judged current on one channel may be inappropriate for another deployment.
Browsers increasingly carry access to applications without requiring a dedicated desktop client. This concentrates a large number of authentication sessions, saved site permissions and corporate workflows in one piece of software. Restricting extensions and applying endpoint controls can reduce some exposure, but those measures do not substitute for deploying the vendor's security corrections where a vulnerable browser version remains in use.
The 37-fix figure should not be interpreted as 37 confirmed attacks, 37 exploited zero-days or a direct count of remotely exploitable vulnerabilities. It is the number of security fixes identified in the stable-channel release. Google lists individual findings and credits researchers where details can be disclosed. The release includes critical flaws affecting ANGLE and browser memory handling, while the separate extended stable channel received 28 security fixes on the same day.
Google’s staged release means managed devices may be running different patched and unpatched builds after the announcement. Google's announcement identifies the corrected build, but desktop populations may not all reach it on the same day. Users may receive the download while the old browser process continues running, and organisations that maintain a tested version ring can be deliberately behind public release. This makes inventory and update state more informative than a policy stating that automatic updates are enabled. Browser hardening also depends on the surrounding device, identity and application controls. Even a fully patched browser can be abused through stolen sessions or authorised but risky extensions, while the newly fixed flaws represent a separate technical exposure that version updates are intended to address.
The rollout was announced on 13 October and remains subject to the normal staged distribution process. Organisations using Chrome on managed Windows, macOS and Linux systems can establish their position by comparing installed builds with the stable-channel release specified by Google.
