Google Releases Chrome 154 Patching 108 Flaws Including 11 Critical Bugs

Google has rolled out Chrome 154 to the stable channel, addressing 108 security vulnerabilities across desktop and mobile platforms. The update includes 11 patches rated as critical severity and another 25 designated as high severity, targeting memory safety issues in core graphics and rendering components.

The stable release, designated as version 154.0.8037.57 for Linux and versions 154.0.8037.57 and 154.0.8037.58 for Windows and macOS, began deploying on September 22. Google also released version 154.0.8037.57 for Android via Google Play alongside version 154.0.8037.55 for iOS devices, ensuring broad parity across operating systems.

SecurityWeek reported that among the 108 fixes, the 11 critical vulnerabilities center heavily on memory safety, buffer management, and component isolation. Crucial patches include CVE-2026-95350, a critical buffer overflow in ANGLE, which serves as Chrome's graphics translation layer. Google awarded a $5,000 bug bounty to researchers from STAR Labs SG for reporting the flaw.

Additional critical entries include CVE-2026-95357, an out-of-bounds write affecting the GPU component, and CVE-2026-95339, a use-after-free vulnerability located within the ServiceWorker subsystem. Other critical advisories cover WebGL, WindowDialog, and AdFilter, encompassing further out-of-bounds writes and use-after-free conditions that could otherwise be leveraged by crafted web pages.

Google confirmed through its release documentation that none of the 108 vulnerabilities patched in version 154 are currently recorded as being actively exploited in the wild. This contrasts with earlier security cycles this year, which required urgent responses to zero-day attacks.

To minimize risk while users apply updates, Google is temporarily restricting public access to technical details for several patched flaws. This restriction remains in place until a sufficient percentage of the active browser install base receives the updates, preventing malicious actors from weaponizing the disclosed code against unpatched endpoints.

While Chrome automatically checks for updates in the background, pending packages require a browser restart to take full effect. Individual users can manually check for the build by navigating to the menu, selecting Help, and opening About Google Chrome to prompt the relaunch sequence.

For enterprise IT administrators managing corporate endpoints, the release underscores the necessity of verifying deployed versions rather than relying solely on automated background cycles. Organizations running browser-based business applications are urged to audit managed Windows, macOS, and Linux endpoints to ensure complete migration to the Chrome 154 builds.