Chrome 154 hits stable with 108 security fixes
Google has promoted Chrome 154 to the stable channel with 108 security fixes, eleven of them rated critical, led by a buffer overflow in the ANGLE graphics translation layer reported by STAR Labs SG.
Chrome 154 is rolling out to Windows, Mac and Linux after Google promoted the release to the stable channel on 22 September 2026. The update carries 108 security fixes, eleven of them rated critical and a further 25 rated high, and will reach users over the coming days and weeks.
Version numbers are 154.0.8037.57 on Linux and 154.0.8037.57 or 154.0.8037.58 on Windows and Mac, so a machine that has not yet offered the update is not necessarily running an old build.
What the critical fixes cover
The headline entry is CVE-2026-95350, a buffer overflow in ANGLE, the translation layer Chrome uses to turn OpenGL ES calls into whatever graphics API the underlying system actually provides. Google credits Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan and Pan Zhenpeng of STAR Labs SG with the report and a $5,000 reward.
The rest of the critical list leans heavily on graphics and rendering: two further ANGLE buffer overflows tracked as CVE-2026-95281 and CVE-2026-95284, an out-of-bounds write in GPU (CVE-2026-95357), an out-of-bounds write in WebGL (CVE-2026-95329), a use-after-free in Fullscreen (CVE-2026-95313) and a use-after-free in AdFilter (CVE-2026-95310).
Below the criticals sit 25 high-severity fixes, among them use-after-free bugs in Bluetooth, HID, PDFium, Video and WebAudio, plus two V8 type-confusion flaws that Google credits to OpenAI Codex Security. Medium and low issues account for the remaining 72 fixes.
Why the graphics layer keeps breaking
ANGLE sits between the browser and the graphics driver, which makes it a rich target: a memory-safety mistake there is reachable from ordinary web content and does not depend on an exotic feature being switched on. Three of this month's eleven criticals are ANGLE buffer overflows, and the WebGL and GPU entries sit in the same layer.
That pattern matters most on hardware with older or less-tested drivers, where a browser's sandboxing and its shader validation are hardest to get right. Chrome updates itself, but managed fleets and lab machines can lag behind by weeks, so the version number is worth checking directly rather than assuming the browser has already caught up.
Our opinion
A Chrome release with eleven criticals would once have been treated as a five-alarm fire; this month it reads as routine, and that is the real story. The browser is the largest attack surface most people own, and Google is now shipping a hundred fixes at a time because fuzzing and paid research have turned vulnerability hunting into an industrial process. The uncomfortable half of that is what industrialisation implies: tooling good enough to find eleven criticals before attackers do is not unique to Mountain View, and the cheap versions of it are already circulating. Install the update when it arrives, then check the version rather than trusting an about page that only says the browser is up to date.