Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
Google released Chrome 154 to the Stable channel, fixing 108 security vulnerabilities including 11 critical flaws. The critical bugs involve memory-safety issues in the ANGLE, GPU, and WebGL components, which could allow code execution or sandbox escapes. Organizations should prioritize deployment as exploit details may remain restricted until patches are widely adopted.
- Google Chrome 154 patches 108 vulnerabilities, including 11 critical flaws.
- Critical bugs affect ANGLE, GPU, and WebGL components, posing significant browser exploitation risks.
- Patches also address high-severity issues in V8, PDFium, and other components.
Vulnerabilities mentionedAll →
- published —
- published —
- published —
Full article593 words · extracted from gbhackers.com · click to collapse
Google released Chrome version 154 to the Stable channel for Windows, macOS, and Linux, fixing 108 security vulnerabilities. This update addresses 11 critical flaws, including memory-safety issues in the ANGLE, GPU, and WebGL components, which could be significant targets for browser-based exploitation.
For Linux users, Chrome version 154.0.8037.57 is being rolled out, while Windows and macOS users will receive versions 154.0.8037.57 and 154.0.8037.58, respectively.
Google has indicated that details about the bugs and related issues may remain restricted until most users have installed the fixes, limiting immediate access to technical information about potential exploits.
Critical Flaws Fixed
The most severe vulnerabilities include buffer overflows, out-of-bounds writes, and use-after-free conditions. These vulnerabilities can corrupt memory and may enable code execution, cause browser crashes, lead to sandbox escapes, or expose data, depending on their exploitability and the surrounding security context.
| CVE | Component | Vulnerability type | Reporter | Reward |
|---|---|---|---|---|
| CVE-2026-95350 | ANGLE | Buffer overflow | Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, Pan Zhenpeng, STAR Labs SG | $5,000 |
| CVE-2026-95357 | GPU | Out-of-bounds write | Anonymous | $2,500 |
| CVE-2026-95339 | ServiceWorker | Use-after-free | Andrew Boni | TBD |
| CVE-2026-95281 | ANGLE | Buffer overflow | Muhammad Alifa Ramdhan, STAR Labs SG | TBD |
| CVE-2026-95313 | Fullscreen | Use-after-free | WinD39 / Huynh Dinh Vu | TBD |
| CVE-2026-95349 | WebGL | Buffer overflow | N/A | |
| CVE-2026-95284 | ANGLE | Buffer overflow | Muhammad Alifa Ramdhan, STAR Labs SG | TBD |
| CVE-2026-95322 | GPU | Out-of-bounds write | David Sievers (@loknop) | TBD |
| CVE-2026-95329 | WebGL | Out-of-bounds write | N/A | |
| CVE-2026-95356 | WindowDialog | Use-after-free | Xinyang Ge | TBD |
| CVE-2026-95310 | AdFilter | Use-after-free | Xinyang Ge | TBD |
The release addresses three critical vulnerabilities within ANGLE, which is Chrome’s graphics abstraction layer that translates graphics APIs for rendering tasks. An attacker could potentially exploit these flaws through malicious web content that triggers vulnerable rendering or graphics-processing pathways.
Additionally, Google has fixed two critical out-of-bounds write vulnerabilities in the GPU component and two memory-corruption flaws related to WebGL. Because GPU and WebGL handle web-accessible graphics content, they represent significant attack surfaces for users visiting untrusted or compromised websites.
High-Severity Bugs
In addition to the critical issues, Chrome version 154 also patches a considerable number of high-severity vulnerabilities affecting various components, including Extensions, Security Indicators, Navigation, PDFium, Video, IndexedDB, WebAudio, Bluetooth, HID, DevTools, and the V8 JavaScript engine.
Notable V8 fixes include a race condition, out-of-bounds writes, and a type-confusion vulnerability. The latter two were reported by OpenAI Codex Security researcher “amyb.” Memory-corruption defects within browser engines and graphics subsystems remain particularly notable because attackers frequently chain these vulnerabilities with others to bypass Chrome’s layered security controls.
Google also resolved high-severity use-after-free bugs within the browser, GPU, Aura, Chromecast, Views, Platform, WebAudio, Bluetooth, HID, and PDFium components, as well as a buffer overflow in the video stack and improper authorization issues in extensions.
Organizations should prioritize deploying Chrome version 154 across managed Windows, macOS, and Linux endpoints. Administrators should verify that installations reach version 154.0.8037.57 on Linux or versions 154.0.8037.57/.58 on Windows and macOS as the rollout progresses.
Users can manually check for the update by navigating to chrome://settings/help and then relaunching the browser to complete the installation. Security teams should treat this update as a high priority because of the prevalence of critical graphics-related bugs and the presence of various exploitable memory-safety vulnerability classes.
Google credited its use of AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL for helping to identify security defects during the development cycle of Chrome.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.