Chrome 154 stable update patches 108 vulnerabilities, 11 critical; no exploitation reported

Google's September 22, 2026 Chrome 154 stable release fixes 108 vulnerabilities, 11 rated critical, including ANGLE buffer overflows and a GPU out-of-bounds write; Google provided no exploitation details, and Chrome 155 for Android has begun a limited Early…

On September 22, 2026, Google released Chrome 154 to the desktop stable channel — version 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and Mac — with 108 security fixes, 11 of them rated critical. Highlighted critical flaws include CVE-2026-95281 and CVE-2026-95350, buffer overflows in ANGLE (SecurityWeek counts three ANGLE buffer overflows among the criticals), and CVE-2026-95357, an out-of-bounds write in the GPU component; according to Malwarebytes, a crafted webpage could crash the browser or lead to code execution. Other critical issues include buffer overflows and out-of-bounds writes in WebGL plus use-after-free bugs in ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Thirty-two of the flaws were externally reported, earning researchers at least $18,000 in bug bounties so far. Neither source reports in-the-wild exploitation and Google provided no exploitation details, but users are urged to update immediately. Separately, Chrome 155.0.8059.16 for Android began a limited Early Stable rollout, and Chrome 155 is also available in Beta.

• Chrome 154 released to stable on September 22, 2026: 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and Mac.
• 108 total security fixes; 11 rated critical.
• CVE-2026-95281 and CVE-2026-95350 are buffer overflows in ANGLE; SecurityWeek counts three ANGLE buffer overflows among the critical flaws.
• CVE-2026-95357 is an out-of-bounds write in the GPU component; per Malwarebytes, a crafted page could crash the browser or lead to code execution.
• Other critical flaws: WebGL buffer overflows and out-of-bounds writes; use-after-frees in ServiceWorker, Fullscreen, WindowDialog, and AdFilter.
• 32 flaws were externally reported; at least $18,000 in bug bounties awarded so far.
• No in-the-wild exploitation mentioned by either source; Google provided no exploitation details.
• Chrome 155.0.8059.16 for Android began a limited Early Stable rollout; Chrome 155 is also in Beta.