Google Chrome 154 Addresses 108 Vulnerabilities, Including Critical Memory Safety Flaws
Google Chrome 154 has been released with patches for 108 vulnerabilities, including 11 critical-severity bugs related to memory safety and corruption.
Google has rolled out Chrome version 154 to its stable channel, delivering fixes for a substantial 108 security vulnerabilities. Among these, 11 have been classified as critical severity, highlighting the importance of this update for user security.
The most severe flaws addressed in this release include several memory corruption issues. Specifically, the update patches buffer overflows in ANGLE and WebGL, out-of-bounds writes in the GPU and WebGL components, and use-after-free vulnerabilities affecting ServiceWorker, Fullscreen, WindowDialog, and AdFilter functionalities. These types of vulnerabilities are often exploited to gain control over a system or to crash applications, leading to potential data breaches or denial-of-service conditions.
External security researchers played a significant role in identifying these critical weaknesses, with nine of the critical flaws reported by individuals outside of Google. In total, 32 of the newly patched vulnerabilities were discovered and reported by external parties, while the remaining were found internally by Google's security teams. Google has acknowledged these contributions by awarding bug bounty rewards totaling $18,000 so far, though the final amounts for many externally reported bugs are still under review.
Beyond the critical issues, Chrome 154 also resolves 25 high-severity vulnerabilities. These include a dozen use-after-free defects, alongside multiple instances of type confusion, uninitialized resource handling, and buffer overflow vulnerabilities. Additionally, high-severity flaws related to missing authorization, UI misinterpretation, incorrect authorization checks, improper output encoding, race conditions, and out-of-bounds writes have been fixed.
The remaining vulnerabilities patched in this update range from medium to low severity. These address issues such as authorization problems, inadequate input validation, UI misrepresentation, further memory corruption, information leaks, and general memory safety concerns. While Google has not reported any active exploitation of these vulnerabilities in the wild, users are strongly advised to update their browsers promptly to protect against potential threats.
The latest iteration of Google Chrome is currently rolling out to users worldwide. The update is available as version 154.0.8037.57/.58 for Windows and macOS operating systems, and as version 154.0.8037.57 for Linux users. Keeping browsers updated is a fundamental step in maintaining a secure online presence, as they are frequent targets for attackers seeking to exploit software weaknesses.
This release follows closely on the heels of other significant browser updates, underscoring the continuous efforts required to maintain web security. Users should ensure their Chrome browser is set to auto-update or manually initiate the update process to benefit from these crucial security patches. Proactive patching remains one of the most effective defenses against the ever-evolving landscape of cyber threats.