Google has rolled out Chrome version 154 for Windows, macOS, and Linux, resolving a total of 108 security vulnerabilities. Notably, this update tackles numerous critical memory-safety flaws that could permit attackers to execute arbitrary code simply by serving malicious web content. The upgrades are being released gradually, arriving as Chrome 154.0.8037.57 for Linux, and versions 154.0.8037.57/.58 for Windows and macOS.
Critical Vulnerabilities in ANGLE, WebGL & GPU
Among the most serious bugs addressed is a buffer overflow in ANGLE (the graphics translation layer within Chrome), tracked as CVE-2026-95350, which was reported by security researchers from STAR Labs SG. Additional critical buffer overflows were found in ANGLE under CVE-2026-95281 and CVE-2026-95284. Because ANGLE converts graphics commands across different platforms, such flaws could allow code execution when users visit crafted websites displaying malicious graphics content.
Other significant fixes target WebGL, with a buffer overflow vulnerability identified as CVE-2026-95349 and an out-of-bounds write under CVE-2026-95329. In the GPU component, critical out-of-bounds write bugs—CVE-2026-95357 and CVE-2026-95322—have been patched. These types of errors occur when software writes data outside its allocated memory, which may lead to browser crashes, data corruption, or arbitrary code execution.
High-Severity Fixes: Use-After-Free, Type Confusion & More
The release also plugs multiple high-severity vulnerabilities, including use-after-free bugs affecting components like ServiceWorker, Fullscreen, WindowDialog, and AdFilter. These arise when code references freed memory, a common exploit pathway. A permissions bypass in Extensions, and UI misrepresentation in SecurityIndicators, were also corrected, alongside flaws in Browser, Aura, Chromecast, Bluetooth, HID, PDFium, Views, WebAudio, and GPU.
Chrome’s V8 JavaScript engine receives updates too. Several high-severity type-confusion and out-of-bounds write issues have been addressed there—these could allow attackers to take control via malicious web pages. Among the patched items are CVE-2026-95304, an out-of-bounds write in V8, and CVE-2026-95306, a type-confusion vulnerability reported by OpenAI’s Codex Security.
Mitigation & What Users Should Do
To lower the window of risk, Google is withholding detailed technical information for some bugs until a majority of users have upgraded. Users can manually update Chrome by navigating to Help → About Google Chrome in the browser menu and restarting once the update is applied. For organizations, patches should be delivered via endpoint-management tools to ensure managed devices receive version 154.
The breadth of these vulnerabilities — spanning graphics, rendering, memory safety, browser UI, and more — underscores how multifaceted Chrome’s attack surface has become as more services are consolidated under the same browser architecture. This update in version 154 demonstrates Google’s continued focus on securing complex components like ANGLE and V8, which have become particularly attractive targets. As web features grow richer, keeping browsers current is no longer optional—it’s a critical line of defense. Stay alert for upcoming security bulletins, especially for any zero-day exploits tied to these bugs.
