Google has released a new update for Chrome that addresses 32 vulnerabilities across Windows, macOS, and Linux users. Among these is a critical buffer overflow flaw in ANGLE that could allow remote attackers to execute code by corrupting memory. High-severity bugs were also patched in Chrome’s JavaScript engine V8 and various UI, GPU, and multimedia components.
The update arrives as Chrome versions 154.0.8037.92 and 154.0.8037.93 for Windows and macOS; Linux users will receive version 154.0.8037.92. The rollout will take place over several days to weeks. Users are urged to update immediately to stay protected.
Main Vulnerabilities Fixed
The most severe issue, tracked as CVE-2026-102331, is a buffer overflow in the ANGLE graphics layer that permits memory corruption and potential remote code execution within the browser context. Other serious fixes include multiple type confusion bugs in V8 (CVE-2026-102299, CVE-2026-102321, CVE-2026-102323, CVE-2026-102326, CVE-2026-102328), and a buffer overflow in V8 (CVE-2026-102302) that could allow a malicious webpage to crash the browser or worse.
Beyond V8, Chrome’s update includes fixes for memory-safety issues in GPU, WebGPU, WebGL, Dawn, Skia, and media handling. Several use-after-free flaws were addressed in components like Bluetooth, Views, and FullScreen, all of which can be chained with other vulnerabilities to expand an attack’s impact. A high-severity cross-site scripting flaw was also corrected in WebUI, along with improvements in privilege enforcement in Mojo, CORS, Payments, WebView, and SiteIsolation. UI misrepresentation problems impacting Omnibox, TabStrip, and SignIn were among the fixes.
How Chrome is Protecting Users
To reduce the risk of exploits before most users are updated, Google has delayed public disclosure of technical details for several vulnerabilities until the majority of users receive the patch. Users can update immediately by going to Help → About Google Chrome. The browser will then download the latest version and prompt a relaunch.
These kinds of patches are part of Google’s ongoing efforts to close gaps in Chrome’s complex architecture, which handles everything from media playback and graphics rendering to plugin interfaces and user authentication. Keeping these foundational components secure is critical, given Chrome’s reach across desktop environments.
For users and organizations alike, this update serves as a reminder of the ever-present risk posed by memory safety bugs, especially in systems that process web content and user input. With these fixes in place, Chrome closes off numerous attack vectors—but staying current with updates remains the single best defense.
What to watch next: Researchers and defenders will likely focus on scanning for exploitation attempts of the now-patched ANGLE and V8 vulnerabilities, especially in malicious web content. Also relevant are future disclosures—once most users are patched, Google may release fuller technical details that reveal exploitability and mitigation strategies.
