Google Chrome 154 Addresses 108 Vulnerabilities, Including Critical Memory Safety Flaws

Google has rolled out Chrome version 154 to its stable channel, delivering fixes for a substantial 108 security vulnerabilities. Among these, 11 have been classified as critical severity, highlighting the importance of this update for user security.

The most severe flaws addressed in this release include several memory corruption issues. Specifically, the update patches buffer overflows in ANGLE and WebGL, out-of-bounds writes in the GPU and WebGL components, and use-after-free vulnerabilities affecting ServiceWorker, Fullscreen, WindowDialog, and AdFilter functionalities. These types of vulnerabilities are often exploited to gain control over a system or to crash applications, leading to potential data breaches or denial-of-service conditions.

External security researchers played a significant role in identifying these critical weaknesses, with nine of the critical flaws reported by individuals outside of Google. In total, 32 of the newly patched vulnerabilities were discovered and reported by external parties, while the remaining were found internally by Google's security teams. Google has acknowledged these contributions by awarding bug bounty rewards totaling $18,000 so far, though the final amounts for many externally reported bugs are still under review.

Beyond the critical issues, Chrome 154 also resolves 25 high-severity vulnerabilities. These include a dozen use-after-free defects, alongside multiple instances of type confusion, uninitialized resource handling, and buffer overflow vulnerabilities. Additionally, high-severity flaws related to missing authorization, UI misinterpretation, incorrect authorization checks, improper output encoding, race conditions, and out-of-bounds writes have been fixed.

The remaining vulnerabilities patched in this update range from medium to low severity. These address issues such as authorization problems, inadequate input validation, UI misrepresentation, further memory corruption, information leaks, and general memory safety concerns. While Google has not reported any active exploitation of these vulnerabilities in the wild, users are strongly advised to update their browsers promptly to protect against potential threats.

The latest iteration of Google Chrome is currently rolling out to users worldwide. The update is available as version 154.0.8037.57/.58 for Windows and macOS operating systems, and as version 154.0.8037.57 for Linux users. Keeping browsers updated is a fundamental step in maintaining a secure online presence, as they are frequent targets for attackers seeking to exploit software weaknesses.

This release follows closely on the heels of other significant browser updates, underscoring the continuous efforts required to maintain web security. Users should ensure their Chrome browser is set to auto-update or manually initiate the update process to benefit from these crucial security patches. Proactive patching remains one of the most effective defenses against the ever-evolving landscape of cyber threats.

This update from SecurityWeek provides further detail on the vulnerabilities patched in Google Chrome, specifically mentioning a critical-severity buffer overflow in ANGLE (CVE-2026-102331) and 25 high-severity weaknesses including uninitialized resource and use-after-free bugs. It also notes that 15 of the patched holes were reported by external researchers, with bounties ranging up to $1,000 for a low-severity authorization flaw.

This latest Chrome update, version 154.0.8037.92/.93, significantly expands the scope of patched vulnerabilities compared to the previous release. It addresses a total of 32 security flaws, including a critical ANGLE buffer overflow (CVE-2026-102331) and multiple high-severity issues within the V8 JavaScript engine, such as type confusion and buffer overflow vulnerabilities. The update also rectifies memory-safety issues across various components like GPU, Bluetooth, and UI, alongside a cross-site scripting flaw in WebUI.