Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks
Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws that could enable remote code execution.
Google has released Chrome 154 to patch 108 security vulnerabilities, including 11 critical memory-safety flaws that could allow code execution via malicious web content. The critical bugs include buffer overflows in the ANGLE graphics layer (CVE-2026-95350, CVE-2026-95281, CVE-2026-95284) and out-of-bounds writes in the GPU component. The update also fixes high-severity type confusion and out-of-bounds write flaws in the V8 JavaScript engine. Google has restricted access to some bug details to mitigate exploitation risk before users update.
- Google patched 108 vulnerabilities in Chrome 154, including critical memory-safety flaws.
- Critical flaws in ANGLE, WebGL, and GPU components could enable remote code execution.
- Google awarded a $5,000 bounty for one of the most severe ANGLE buffer overflow bugs.
- The update also addresses high-severity issues in the V8 JavaScript engine.
Vulnerabilities mentionedAll →
- published —
- published —
- published —
Full article580 words · extracted from cybersecuritynews.com · click to collapse
Google has released Chrome 154 for Windows, macOS, and Linux, fixing 108 security vulnerabilities, including several critical memory-safety flaws that could potentially allow attackers to execute code through malicious web content.
The update is rolling out gradually as Chrome 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and macOS. The release addresses eleven critical vulnerabilities across Chrome components involved in graphics processing, browser services, WebGL rendering, and user-interface handling.
Several of these issues are memory-corruption bugs, a vulnerability category frequently used in browser exploitation chains because it can enable an attacker to alter application memory and potentially run attacker-controlled code.
Among the most severe fixes is CVE-2026-95350, a buffer overflow in ANGLE, Chrome’s graphics translation layer. The bug was reported by Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng of STAR Labs SG Pte. Ltd.
Chrome Patches 108 Vulnerabilities
Google awarded a $5,000 bug bounty for the finding. Chrome also patched CVE-2026-95281 and CVE-2026-95284, two additional critical buffer overflow flaws in ANGLE.
ANGLE is a key Chrome component that translates graphics commands for different platforms. A successful exploit against this layer could be triggered when a victim visits a crafted website that processes malicious graphics content.
Google also fixed critical buffer overflow flaws in WebGL, including CVE-2026-95349, and an out-of-bounds write bug tracked as CVE-2026-95329.
The update further resolves critical out-of-bounds write vulnerabilities in the GPU component, identified as CVE-2026-95357 and CVE-2026-95322.
Out-of-bounds write issues occur when software writes data beyond an allocated memory area. This can corrupt memory and, under certain conditions, lead to browser crashes, data exposure, or code execution.
Other critical fixes include use-after-free vulnerabilities in ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Use-after-free bugs arise when an application continues to access memory after it has been released. Attackers may exploit these flaws to manipulate memory and escape expected browser security boundaries.
Chrome 154 also contains a large number of high-severity fixes. These include a missing authorization flaw in Extensions, a UI misrepresentation issue in SecurityIndicators, and multiple use-after-free bugs in Browser, Aura, Chromecast, Bluetooth, HID, PDFium, Views, WebAudio, and GPU components.
Chrome 154 also fixes high-severity type confusion and out-of-bounds write flaws in the V8 JavaScript engine, which could potentially be exploited through specially crafted webpages to gain control of the browser process.
High-Severity Security Fixes :
| CVE ID | Vulnerability Type | Affected Component | Reward |
|---|---|---|---|
| CVE-2026-95350 | Buffer overflow | ANGLE | $5,000 |
| CVE-2026-95357 | Out-of-bounds write | GPU | $2,500 |
| CVE-2026-95339 | Use-after-free | ServiceWorker | TBD |
| CVE-2026-95281 | Buffer overflow | ANGLE | TBD |
| CVE-2026-95313 | Use-after-free | Fullscreen | TBD |
| CVE-2026-95349 | Buffer overflow | WebGL | N/A |
| CVE-2026-95284 | Buffer overflow | ANGLE | TBD |
| CVE-2026-95322 | Out-of-bounds write | GPU | TBD |
| CVE-2026-95329 | Out-of-bounds write | WebGL | N/A |
| CVE-2026-95356 | Use-after-free | WindowDialog | TBD |
| CVE-2026-95310 | Use-after-free | AdFilter | TBD |
Google fixed CVE-2026-95304, an out-of-bounds write in V8, and CVE-2026-95306, a type confusion vulnerability reported by OpenAI Codex Security.
Google said it is restricting access to some bug details until most users have installed the update. This reduces the risk of attackers using technical information to develop exploits before systems are patched.
Users should immediately update Chrome by opening the browser menu, selecting Help, then About Google Chrome, and relaunching when the update is ready. Organizations should verify that managed devices receive Chrome 154 through their endpoint-management platforms.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.