Google has released the latest version of its Chrome browser, version 154, for Windows, Mac, and Linux systems. This update addresses a total of 108 security vulnerabilities, including 11 critical flaws. According to Google, none of these vulnerabilities were currently being exploited in the wild when the update was released. This follows a similar update earlier this month, when Chrome 153 fixed 230 vulnerabilities, including a zero-day flaw that had already been exploited in the V8 engine, which is responsible for running JavaScript and WebAssembly in Chrome.
The latest update includes a range of patches across the entire browser, with some of the most critical issues found in ANGLE, a graphics engine used by Chrome to translate graphics instructions like WebGL into hardware-compatible commands. Google discovered 76 of the vulnerabilities internally, while 32 were identified by external researchers, who were collectively awarded $18,000 in bug bounties. Among the 108 vulnerabilities, 11 are critical, 25 are high risk, 47 are medium risk, and 25 are low risk.
Some of the most common issues involve "use-after-free" errors, which occur when the browser continues to use a block of memory after it has been freed, potentially leading to crashes or, in rare cases, allowing malicious code to run. There are also permission-related problems, with 12 cases where permissions were incorrectly granted and 11 where they were missing. Additionally, 12 instances were found where web pages displayed misleading interfaces—showing one thing but executing something else. Three critical vulnerabilities affecting ANGLE involved buffer overflow issues, where data was written beyond the allocated memory space, risking corruption of other data.
Among the critical bugs, CVE-2026-95350, a buffer overflow in ANGLE, was reported by the STAR Labs SG team and earned them $5,000. Another critical flaw, CVE-2026-95357, involved an out-of-bounds write in Chrome's GPU process and was rewarded $2,500. Other high-risk fixes primarily targeted the V8 engine, with issues like type confusion and out-of-bounds writes detected using both automated tools and external audits, including one by OpenAI Codex Security.
The update is available automatically for most users, but can also be manually triggered by going to the three-dot menu, then selecting Help > About Google Chrome. Chrome for Android and iOS have also been updated to version 154. The next major release, Chrome 155, is expected in about two weeks.
Google Releases Chrome 154 with 108 Security Fixes, Including 11 Critical Vulnerabilities
AI-rewritten from original reportingHow it works
chromesecurityvulnerabilitiesgooglepatchesv8-engine



