Threat reportVulnerabilityTL-2026-3801
Google Chrome 155 Security Update Fixes 10 Vulnerabilities Including Critical Prerender Use-After-Free (CVE-2026-110922)
Google Chrome 155 Security Update Fixes 10 Vulnerabilities (TL-2026-3801) is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-10-17. It has no confirmed attribution, affects Google Chrome (Windows, macOS, Linux), references 10 CVEs (CVE-2026-110922, CVE-2026-110913, CVE-2026-110919), maps to 3 MITRE ATT&CK techniques (T1203, T1204, T1566), and is covered by 9 detection rules and 5 indicators of compromise.
- CVSS
- 8.8/10Critical
- CVEs
- 10Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 5Indicators of compromise
Key facts for TL-2026-3801
- Threat ID
- TL-2026-3801
- Severity
- CRITICAL
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, education, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 5
How Google Chrome 155 Security Update Fixes 10 Vulnerabilities works
Google released Chrome 155.0.8059.84/.85 (Windows/Mac) and 155.0.8059.84 (Linux) on 2026-10-15, fixing 10 vulnerabilities: 1 Critical (Prerender use-after-free), 6 High (DOM, three in V8, Core, SVG) and 3 Medium. Google has not stated that any issue is exploited in the wild.
The Chrome stable-channel update to 155.0.8059.84/.85 (Windows/Mac) and 155.0.8059.84 (Linux) addresses 10 security issues. The single Critical-rated flaw, CVE-2026-110922, is a use-after-free in the Prerender component reported by Xinyang Ge of Anthropic on 2026-10-02. NVD describes it as allowing a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page; user interaction (visiting a malicious page) is required. NVD lists it as CWE-416 with a CVSS 3.1 base score of 8.8 and affected versions earlier than 155.0.8059.84, while Chromium rates it Critical. NVD references Chromium issue 568719351.
Six High-severity issues are fixed: CVE-2026-110913 (DOM, memory corruption, reported 2026-09-29 by Xinyang Ge with Claude AI assistance, which Google credited publicly), CVE-2026-110919 and CVE-2026-110921 (V8 use-after-free), CVE-2026-110920 (V8 memory corruption), CVE-2026-110918 (Core memory corruption, found by Google) and CVE-2026-110917 (SVG memory corruption, reported by C0rk1). Three Medium issues are CVE-2026-110916 (Desktop, improper input validation), CVE-2026-110915 (Compositing use-after-free) and CVE-2026-110914 (Workers memory corruption), all credited to Google.
The release follows the initial Chrome 155 stable release of 2026-10-07 (155.0.8059.39/.40), which patched 247 vulnerabilities including four Critical use-after-free flaws, many reported by Xinyang Ge with AI assistance. Per secondary reporting, the vendor made no mention of in-the-wild exploitation, bounty amounts for the Claude-assisted reports were not paid, and technical details are restricted until most users update. No PoC, exploit code, threat actor, malware or network IOCs are associated with these CVEs in the reviewed sources. Several details (Chromium release-note text for 155.0.8059.84, per-CVE NVD CVSS for the other nine CVEs) could not be verified directly from the primary Chrome Releases post.
Defender relevance: memory-corruption bugs in the renderer-facing components (V8, DOM, SVG, Prerender) are a common first stage of browser exploit chains, typically paired with a separate sandbox escape. Because Chrome auto-updates gradually over days to weeks, endpoints can stay exposed after release. Priority is fleet-wide version enforcement rather than IOC blocking.
MITRE ATT&CK techniques used in TL-2026-3801
Execution
T1203 Exploitation for Client Execution; T1204 User Execution
Initial Access
Affected products and versions in Google Chrome 155 Security Update Fixes 10 Vulnerabilities
- Google — Chrome (Windows, macOS, Linux)
Vulnerable versions: Versions prior to 155.0.8059.84
Fixed in: 155.0.8059.84/.85 (Windows/Mac); 155.0.8059.84 (Linux)
Remediation for Google Chrome 155 Security Update Fixes 10 Vulnerabilities
Patches
- Chrome 155.0.8059.84/.85 (Windows/macOS) and 155.0.8059.84 (Linux)
Immediate actions
- Update Google Chrome to 155.0.8059.84 or later (155.0.8059.84/.85 on Windows and macOS) and relaunch the browser to apply the update
- Verify the deployed version via chrome://version or endpoint inventory and flag hosts below 155.0.8059.84
- Update other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as soon as their vendors ship the corresponding Chromium 155 fixes
Workarounds
- No vendor workaround documented; restrict browsing to untrusted sites from unpatched hosts until updated
- Use Enhanced Safe Browsing and block known-malicious web content at the proxy
Longer-term hardening
- Enforce managed browser auto-update and a maximum relaunch deferral through enterprise policy
- Keep Chrome Site Isolation and the renderer sandbox enabled
- Monitor Chrome Releases and CISA KEV for later reports of exploitation of these CVEs
CVEs associated with Google Chrome 155 Security Update Fixes 10 Vulnerabilities
CVE-2026-110922, CVE-2026-110913, CVE-2026-110919, CVE-2026-110918, CVE-2026-110917, CVE-2026-110921, CVE-2026-110920, CVE-2026-110916, CVE-2026-110915, CVE-2026-110914
Weaknesses (CWE) in Google Chrome 155 Security Update Fixes 10 Vulnerabilities
Timeline of Google Chrome 155 Security Update Fixes 10 Vulnerabilities
- CVE-2026-110913 (DOM memory corruption) reported to Google by Xinyang Ge with Claude AI assistance
- CVE-2026-110922 (Prerender use-after-free, Critical) reported to Google by Xinyang Ge of Anthropic
- Initial Chrome 155 stable release (155.0.8059.39/.40) published with 247 security fixes, including four Critical use-after-free flaws; no in-the-wild exploitation stated
- NVD record for CVE-2026-110922 describes it as a CWE-416 use-after-free in Prerender affecting versions before 155.0.8059.84, with CVSS 3.1 base score 8.8
- Google released Chrome 155.0.8059.84/.85 (Windows/Mac) and 155.0.8059.84 (Linux) fixing 10 vulnerabilities (1 Critical, 6 High, 3 Medium)
- Cyber Security News reported the update, noting Google credits Claude AI assistance for CVE-2026-110913 and reports no exploitation; rollout continues gradually over days to weeks
Sources cited for Google Chrome 155 Security Update Fixes 10 Vulnerabilities
- Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
- NVD - CVE-2026-110922
- Chrome Releases - October 2026 (Stable Channel Update for Desktop)
- Chrome 155 Update Patches 247 Vulnerabilities (SecurityWeek)
- Chrome 155 update: 247 security fixes, OpenAI and Anthropic contributions (PiunikaWeb)
- Google Chrome 155: 247 security flaws fixed (IT-Connect)
Detection coverage for TL-2026-3801
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3801 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.