Google Chrome Patch Addresses 37 Flaws, Including Seven Critical RCE Vulnerabilities
What Happened — In early October 2024 Google released Chrome 155 updates for Windows, macOS, Linux, and Android that fix 37 security issues, seven of them rated Critical. Notable fixes include CVE‑2026‑110152 (buffer overflow in ANGLE on Android) and two use‑after‑free bugs in the PDF component (CVE‑2026‑110136, Critical; CVE‑2026‑110147, High).
Why It Matters for Trust & Control Assurance
- Unpatched browsers are a common entry point for remote‑code‑execution attacks; a robust vulnerability‑management program is a core control objective that mitigates this risk.
- Continuous evidence of timely patching feeds directly into audit‑ready documentation and demonstrates due‑diligence to regulators and partners.
- Verisq’s Control Mapping capability helps organizations map patch‑management activities to the Verisq Common Framework, producing defensible evidence across multiple compliance regimes.
Who Is Affected – Enterprises across all sectors that rely on Chrome as a primary endpoint browser (technology, finance, healthcare, retail, etc.).
Recommended Actions
- Verify that your Chrome fleet is on version 155.0.8059.79 (or later) across all OS platforms.
- Integrate Chrome update verification into your existing patch‑management workflow and capture screenshots or logs as evidence.
- Map the “vulnerability remediation” control to the VCF objective for continuous monitoring and audit readiness.
Technical Notes – The critical bugs are remote‑code‑execution flaws that bypass Chrome’s sandbox (ANGLE buffer overflow) or exploit use‑after‑free conditions in the PDF renderer. Exploitation could lead to arbitrary code execution on the host OS. Source: Malwarebytes Labs