Google Chrome 154 Patches 108 Security Flaws Including 11 Critical Vulnerabilities

Google has rolled out Chrome 154 to the Stable channel for Windows, Mac, and Linux, delivering fixes for 108 security vulnerabilities.

The update, version 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and Mac, addresses one of the largest security patch batches Chrome has shipped in recent memory, including 11 flaws rated Critical severity

The most severe issues affect Chrome’s graphics and rendering stack. Multiple critical bugs were found in ANGLE, Chrome’s cross-platform graphics abstraction layer, including buffer overflows.

Google Chrome 154 Patches 108 Security Flaws

Additional critical flaws hit the GPU process, WebGL, ServiceWorker, Fullscreen, WindowDialog, and AdFilter components, with largely use-after-free and out-of-bounds write issues that could allow an attacker to achieve remote code execution or sandbox escape via a malicious web page.

Google awarded a $5,000 bounty for the ANGLE buffer overflow (CVE-2026-95350), and $2,500 for the GPU out-of-bounds write (CVE-2026-95357), while several critical reports remain pending reward decisions (TBD).

Beyond the critical tier, 33 High-severity bugs span V8 (Chrome’s JavaScript engine), DevTools, PDFium, Bluetooth, HID, WebAudio, and IndexedDB, with type confusion and use-after-free patterns recurring frequently.

Notably, OpenAI’s Codex Security team reported two High-severity V8 flaws (CVE-2026-95304 and CVE-2026-95306), reflecting growing use of AI-assisted vulnerability discovery.

The remaining fixes fall into Medium (46 bugs) and Low (18 bugs) severity, covering authorization gaps, UI spoofing, and information-leak issues across Navigation, DevTools, Payments, and Passwords components.

Chrome updates automatically, but users and administrators should verify their version reads 154.0.8037.57 or later and restart the browser to apply the patch immediately, given the high concentration of memory-corruption bugs that could enable exploitation through crafted web content.

Enterprises managing fleets via policy should prioritize forced updates given the volume of Critical and High findings in this release.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team