Google Chrome's critical vulnerabilities, October 2026: what to patch now

Google Chrome shipped five Stable channel updates in October 2026, fixing 658 vulnerabilities across them. Nineteen of those 658 carry Chrome's own Critical severity label, the rating Google's security team assigns, not a generic score. None of the 19 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog as of October 23, 2026. Update anyway: open Chrome's menu, go to Help > About Google Chrome, and click Relaunch if one is offered.

How many Critical vulnerabilities did Chrome's October 2026 updates fix?

Nineteen, counted directly from each CVE's own NVD description this run. Chrome's security team tags every vulnerability it fixes with its own severity rating in the text of the CVE description itself, separate from NVD's independent CVSS v3.1 scoring of the same flaw. That label, not a raw CVSS number, is this page's count of Critical.

Release date (NVD publication)	Version (Windows/Mac)	Total fixes	Critical (Chrome's label)
Oct 2, 2026	154.0.8037.97	11	1
Oct 6, 2026	155.0.8059.39	247	4
Oct 13, 2026	155.0.8059.79	37	7
Oct 15, 2026	155.0.8059.84	10	1
Oct 20, 2026	156.0.8078.47	353	6
Total		658	19

The dates are when NVD published each CVE record, which typically trails Chrome's own release announcement by a day or so, not the announcement date itself. The October 13 update, smaller in total fixes than the two large releases either side of it, actually carries the highest concentration of Critical flaws: 7 of its 37 fixes, about one in five.

What does a CVSS score of 9.6 mean, and why doesn't it match Chrome's own count?

A CVSS (Common Vulnerability Scoring System) base score of 9.0 to 10.0 is the Critical band under the industry-standard v3.1 specification. NVD assigns its own CVSS score to each CVE independently of Chrome's label, and this run found NVD's own scoring marks far more October 2026 Chrome entries Critical than Chrome's own team does: 62 of the 658, against Chrome's 19. Almost every one of those extra 43 shares the identical score, 9.6, and the identical vector, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — the same generic remote-attacker, crafted-HTML-page, code-execution-outside-the-sandbox template NVD applies across the whole Chrome catalog, rather than a bespoke read of each flaw.

This site's own security glossary explains what CVSS does and does not measure: technical severity, not confirmed real-world exploitation. A reader filtering Chrome's October patches by CVSS Critical alone would flag more than three times as many flaws as Chrome's own security team calls Critical. Either count is defensible on its own terms; conflating them is not.

What kinds of flaws make up Chrome's own Critical list?

Use-after-free bugs account for 12 of the 19, the largest single category; memory corruption accounts for 5 more, with one buffer overflow and one out-of-bounds write filling out the list. A use-after-free bug happens when code keeps using a piece of memory after Chrome has already freed it for reuse; an attacker who can control what gets written into that freed memory can sometimes turn the bug into arbitrary code execution. No single browser component dominates: the 19 are spread across Browser, Accessibility (two each), and single entries in WebGL, ANGLE, PDF, SVG, Media, Network, Core, Prerender, CSS, Paint, WebRTC, Skia, Chromecast, Track and Navigation.

Most of the 19 require the browser to render attacker-controlled content, typically described in the CVE text as "via a crafted HTML page." A handful also need user interaction to trigger, meaning the attacker needs the person to visit a page or click something, not just have Chrome open in the background.

Is any of October's Critical list being actively exploited?

Not according to CISA. This run checked CISA's live KEV catalog, version 2026.10.23, released October 23, 2026, directly, and none of the 19 Chrome entries from this window (or any of the other 639 fixes) appears in it. CISA's catalog does carry six Chrome vulnerabilities today, but every one is a 2019 or 2020 CVE, added between November 2021 and May 2022 — none from this year. This site's own must-patch tracker lists the live KEV catalog in full and confirms the same thing: no October 2026 Chrome CVE on it as of this run.

Why patch now if nothing is confirmed exploited yet?

Because KEV listing is a lagging signal, not a leading one. This site's own exploit-lag tracker measures how long a flaw sits as an ordinary CVE before CISA confirms attackers are using it against the current 45-day KEV window, and some gaps there run past ten years. A vulnerability does not need a KEV entry to be used against you; it needs one only after someone gets caught using it. Chrome's own Critical label already means Google's security team judged the flaw capable of remote code execution with no special privileges, which is the category of bug KEV entries are drawn from later, not a different one.

How do you check that Chrome is up to date, and update it?

Open Chrome, click the three-dot menu at the top right, then go to Help and About Google Chrome. Chrome checks for an update while that page is open; if one exists, a Relaunch button appears, and clicking it applies the update and reopens your tabs. If no Relaunch button appears, the installed version is already current. On Windows, close every open Chrome window before relaunching so the update can finish; on Linux, Chrome updates through the system's own package manager rather than this in-browser check.

How often does Chrome ship security updates?

Five times in October 2026 alone, which is typical: Chrome's Stable channel for desktop gets a scheduled update roughly every two to three weeks, plus unscheduled releases when a more urgent fix is needed. The five October releases in the table above were not evenly spaced — three landed within nine days of each other (October 6, 13 and 15) — which this run did not find an announced reason for; Chrome's own release posts for that stretch were not reachable with the User-Agent this network's sourcing rules require, so that gap is stated here as unexplained rather than guessed at.

Related: the security glossary defines CVE, CVSS, KEV and EPSS from their own source bodies; Patch Tuesday tracks Microsoft's monthly fixes the same way this page tracks Chrome's.