Chrome 154 is a security update that fixes 108 vulnerabilities, including eleven critical ones. According to PCWorld, none of the patched flaws have been exploited by attackers in real-world attacks so far.
Chrome 154 Security Update
The new versions are labeled 154.0.8037.57/58 for Windows and macOS, and 154.0.8037.57 for Linux. Aside from security fixes, Chrome 154 does not introduce any new features, PCWorld reports. According to the same source, Google discovered 76 vulnerabilities on its own, while the remaining 32 were reported by external researchers. The company has so far paid out a total of $18,000 in rewards to these researchers. SecurityWeek noted that the final amount could be higher, as decisions regarding rewards for most externally reported flaws are still pending.
Critical Bugs in ANGLE and Other Components
Three of the critical vulnerabilities involve buffer overflows in the ANGLE graphics library for WebGL. This is confirmed by CybersecurityNews, GBHackers, SecurityWeek, and PCWorld. Among the critical issues are also use-after-free bugs in the ServiceWorker, Fullscreen, WindowDialog, and AdFilter components, according to CybersecurityNews and SecurityWeek.
The most severe patched flaw, according to CybersecurityNews, is CVE-2026-95350, a buffer overflow in ANGLE. It was reported by Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng from STAR Labs SG Pte. Ltd., and the reward for it was $5,000. In the V8 JavaScript engine, Google fixed type confusion and out-of-bounds write errors. The vulnerability CVE-2026-95306 was reported by OpenAI Codex Security, according to CybersecurityNews and GBHackers.
Severity Distribution
- 11 critical vulnerabilities
- 25 high-risk
- 47 medium-risk
- 25 low-risk
According to PCWorld, the fixes predominantly include use-after-free errors (34), followed by 12 cases of improper rendering in the user interface, 12 authentication errors, and 11 missing permissions. SecurityWeek reported that nine critical bugs were reported by external researchers. GBHackers mentioned tools that help Google in finding flaws: AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.
Mobile Versions and Chrome 155
This week, Google also released Chrome for Android version 154.0.8037.57 and Chrome for iOS version 154.0.8037.55. The Android version addresses the same vulnerabilities as the desktop versions. The Extended Stable channel for Windows and macOS now contains Chromium 152.0.7977.140, and Chrome 155 is expected to be released in about two weeks. According to CybersecurityNews and GBHackers, Google is limiting access to details about some vulnerabilities until the majority of users have installed the update. In a blog post on Chrome Releases, Srinivas Sista lists all 108 fixed vulnerabilities and notes that Google discovered 76 of them on its own, PCWorld reported.