Reported by 9 outlets
Google Chrome 154 patches 108 security vulnerabilities, including critical memory corruption flaws. Update your browser immediately to stay
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Google shipped Chrome 154 to the Stable desktop channel with fixes for 32 security vulnerabilities, rolling out as 154.0.8037.92/.93 on Windows and macOS and 154.0.8037.92 on Linux. The most severe issue is CVE-2026-102331, a critical buffer overflow in ANGLE, the graphics translation layer Chrome uses for cross-platform rendering; memory corruption there is reachable when a user processes malicious web content. The release also fixes 25 high-severity bugs across V8, the GPU stack, WebGPU, WebGL, Mojo IPC, Bluetooth, Skia, Media, and other components, including use-after-free and uninitialized-resource flaws.
One detail stands out: three high-severity V8 type-confusion bugs, CVE-2026-102323, CVE-2026-102326, and CVE-2026-102328, were reported by a researcher credited as amyb from OpenAI Codex Security, a notable data point in AI-assisted vulnerability discovery at browser scale. Mozilla shipped Firefox 157 in the same cycle with patches for roughly 76 vulnerabilities, 38 of them high severity, mostly use-after-free and sandbox escape bugs, bringing the combined count past 100.
Google reports none of the Chrome flaws as publicly exploited or in the wild yet. Patch both browsers promptly anyway: the ANGLE bug is critical and the V8 type-confusions are the classic prelude to exploit chains. Watch whether any of the 32 gains a CVE in CISA's KEV catalog, which would change the urgency.
Timeline
-
original reporting
Google Chrome 154 patches 108 security vulnerabilities, including critical memory corruption flaws. Update your browser immediately to stay
securityonline.info · 21d ago · September 23rd, 2026
Google Chrome 154 patches 108 security vulnerabilities, including critical memory corruption flaws. Update your browser immediately to stay
via Mastodon https://securityonline.info/chrome-154-security-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social
-
update from chromereleases.googleblog.com
Stable Channel Update for Desktop
chromereleases.googleblog.com · 22d ago · September 22nd, 2026
The vendor advisory behind the story headline, posted September 22, 2026, promoted Chrome 154 to stable as 154.0.8037.57/.58 for Windows and Mac and 154.0.8037.57 for Linux with 108 security fixes, 11 of them critical. The criticals are all memory-safety defects: three ANGLE buffer overflows including CVE-2026-95350 (a $5,000 bounty, reported by STAR Labs researchers on 2026-08-24), CVE-2026-95281, and CVE-2026-95284, plus GPU out-of-bounds writes, WebGL bugs, and use-after-free defects in ServiceWorker, Fullscreen, WindowDialog, and AdFilter. It also credits OpenAI Codex Security researcher amyb with two V8 bugs, CVE-2026-95304 and CVE-2026-95306, reported on 2026-09-12, and notes bug details may stay restricted until a majority of users are updated.
-
update from chromereleases.googleblog.com
Extended Stable Update for Desktop
chromereleases.googleblog.com · 22d ago · September 22nd, 2026
Posted September 22, 2026 alongside the Chrome 154 promotion, this advisory updated the Extended Stable channel to 152.0.7977.140 for Windows and Mac. Enterprise fleets pinned two milestones back received their fixed build on the same day as the 108-fix promotion rather than with the September 29 point release.
-
update from chromereleases.googleblog.com
Chrome for Android Update
chromereleases.googleblog.com · 22d ago · September 22nd, 2026
A same-day vendor post, dated Tuesday, September 22, 2026, announcing Chrome 154.0.8037.57 for Android rolling out over the next few days. It states that Android releases contain the same security fixes as the corresponding desktop release unless otherwise noted and links directly to the desktop stable channel advisory, so the 108-fix patch set extended to Android the day before this story was first seen.
-
mentioned by gbhackers.com
Chrome just patched 108 vulnerabilities at once - including critical flaws in GPU, WebGL and ANGLE. What is notable: the surface
gbhackers.com · 20d ago · September 23rd, 2026
-
update from securityweek.com
Chrome 154 Patches 108 Vulnerabilities
securityweek.com · 20d ago · September 23rd, 2026
Nine of the critical issues were reported by external researchers. In total, 32 of the newly patched flaws were reported externally, while the rest were discovered by Google. Google says it handed out $18,000 in bug bounty rewards to the reporting researchers, but the final amount could be much higher, as the company has yet to determine the amounts to be paid for most of the externally reported bugs. Twenty-five of the remaining vulnerabilities are high-severity bugs, including a dozen use-after-free defects and multiple type confusion, uninitialized resource, and buffer overflow issues. High-severity missing authorization, UI misinterpretation, incorrect authorization, improper output encoding, race condition, and out-of-bounds write flaws were also resolved. The remaining security holes are medium- and low-severity weaknesses related to authorization, input validation, UI misrepresentation, memory corruption, information leak, and memory safety. Google makes no mention of any of these vulnerabilities being exploited in the wild, but users are advised to update th
-
update from beyondmachines.net
Google Patches 108 Vulnerabilities in Chrome 154 Update Google released Chrome 154 to address 108 security vulnerabilities, including 11 cri
beyondmachines.net · 19d ago · September 24th, 2026
Google Patches 108 Vulnerabilities in Chrome 154 Update Google released Chrome 154 to address 108 security vulnerabilities, including 11 cri
via Mastodon https://beyondmachines.net/event_details/google-patches-108-vulnerabilities-in-chrome-154-update-x-u-7-r-b/gD2P6Ple2L
-
update from malware.news
Chrome: 108 security fixes for desktop, new release for Android
malware.news · 19d ago · September 24th, 2026
Over the last few days, Google issued several different Chrome updates. It will roll out over the coming days and weeks. One day later, Google released Chrome 155 for Android , version 155.0.8059.16 , to a small percentage of users. It may not be available on Google Play for everyone yet, but keep an eye out for it. Google says it includes stability and performance improvements. The Android release is an Early Stable rollout, meaning Google sends it to a small share of users first, to spot unexpected compatibility or reliability issues before expanding it to everyone. Beta is a separate prerelease version for people who want to try upcoming features roughly four to six weeks before Stable. It is relatively polished but can still contain bugs, so it is best suited to testing rather than everyday use. How to update Chrome The easiest option is to al
-
mentioned by www.malwarebytes.com
(malwarebytes.com) Google Chrome Rolls Out Critical Security Updates Addressing 108 Vulnerabilities Including 11 Critical Flaws In brief - T
www.malwarebytes.com · 19d ago · September 24th, 2026
-
update from cyberpress.org
Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug
cyberpress.org · 13d ago · September 30th, 2026
The most severe issue, tracked as CVE-2026-102331, is a critical buffer overflow in ANGLE , the component Chrome uses to translate graphics API calls for cross-platform rendering. Memory-safety flaws of this type can be particularly serious because they may allow an attacker to corrupt memory when a user processes malicious web content. Google Chrome 154 Update Fixes 32 Security Flaws The release also remediates 25 high-severity issues across Chrome’s V8 JavaScript engine , GPU stack, WebGPU, WebGL, Mojo IPC framework, Bluetooth implementation, Views user-interface framework, Passwords, FullScreen, Picture-in-Picture, WebUI, Skia, Media, and Omnibox. The company may also retain restrictions for bugs affecting third-party libraries until other dependent projects have deployed patches. No vulnerabi
-
mentioned by gbhackers.com
Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug
gbhackers.com · 13d ago · September 30th, 2026
-
update from securityweek.com
Chrome, Firefox Updates Patch Over 100 Vulnerabilities
securityweek.com · 13d ago · September 30th, 2026
Google and Mozilla on Tuesday announced fresh Chrome and Firefox updates that address over 100 vulnerabilities. The browser update also fixes high-severity improper privilege management, UI misconfiguration, out-of-bounds read/write, cross-site scripting (XSS), and buffer overflow issues. The fresh Firefox update also resolves high-severity incorrect boundary conditions, uninitialized memory, privilege escalation, information disclosure, invalid