Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

Google released Chrome version 154 to the Stable channel for Windows, macOS, and Linux, fixing 108 security vulnerabilities. This update addresses 11 critical flaws, including memory-safety issues in the ANGLE, GPU, and WebGL components, which could be significant targets for browser-based exploitation.

For Linux users, Chrome version 154.0.8037.57 is being rolled out, while Windows and macOS users will receive versions 154.0.8037.57 and 154.0.8037.58, respectively.

Google has indicated that details about the bugs and related issues may remain restricted until most users have installed the fixes, limiting immediate access to technical information about potential exploits.

Critical Flaws Fixed

The most severe vulnerabilities include buffer overflows, out-of-bounds writes, and use-after-free conditions. These vulnerabilities can corrupt memory and may enable code execution, cause browser crashes, lead to sandbox escapes, or expose data, depending on their exploitability and the surrounding security context.

CVE	Component	Vulnerability type	Reporter	Reward
CVE-2026-95350	ANGLE	Buffer overflow	Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, Pan Zhenpeng, STAR Labs SG	$5,000
CVE-2026-95357	GPU	Out-of-bounds write	Anonymous	$2,500
CVE-2026-95339	ServiceWorker	Use-after-free	Andrew Boni	TBD
CVE-2026-95281	ANGLE	Buffer overflow	Muhammad Alifa Ramdhan, STAR Labs SG	TBD
CVE-2026-95313	Fullscreen	Use-after-free	WinD39 / Huynh Dinh Vu	TBD
CVE-2026-95349	WebGL	Buffer overflow	Google	N/A
CVE-2026-95284	ANGLE	Buffer overflow	Muhammad Alifa Ramdhan, STAR Labs SG	TBD
CVE-2026-95322	GPU	Out-of-bounds write	David Sievers (@loknop)	TBD
CVE-2026-95329	WebGL	Out-of-bounds write	Google	N/A
CVE-2026-95356	WindowDialog	Use-after-free	Xinyang Ge	TBD
CVE-2026-95310	AdFilter	Use-after-free	Xinyang Ge	TBD

The release addresses three critical vulnerabilities within ANGLE, which is Chrome’s graphics abstraction layer that translates graphics APIs for rendering tasks. An attacker could potentially exploit these flaws through malicious web content that triggers vulnerable rendering or graphics-processing pathways.

Additionally, Google has fixed two critical out-of-bounds write vulnerabilities in the GPU component and two memory-corruption flaws related to WebGL. Because GPU and WebGL handle web-accessible graphics content, they represent significant attack surfaces for users visiting untrusted or compromised websites.

High-Severity Bugs

In addition to the critical issues, Chrome version 154 also patches a considerable number of high-severity vulnerabilities affecting various components, including Extensions, Security Indicators, Navigation, PDFium, Video, IndexedDB, WebAudio, Bluetooth, HID, DevTools, and the V8 JavaScript engine.

Notable V8 fixes include a race condition, out-of-bounds writes, and a type-confusion vulnerability. The latter two were reported by OpenAI Codex Security researcher “amyb.” Memory-corruption defects within browser engines and graphics subsystems remain particularly notable because attackers frequently chain these vulnerabilities with others to bypass Chrome’s layered security controls.

Google also resolved high-severity use-after-free bugs within the browser, GPU, Aura, Chromecast, Views, Platform, WebAudio, Bluetooth, HID, and PDFium components, as well as a buffer overflow in the video stack and improper authorization issues in extensions.

Organizations should prioritize deploying Chrome version 154 across managed Windows, macOS, and Linux endpoints. Administrators should verify that installations reach version 154.0.8037.57 on Linux or versions 154.0.8037.57/.58 on Windows and macOS as the rollout progresses.

Users can manually check for the update by navigating to chrome://settings/help and then relaunching the browser to complete the installation. Security teams should treat this update as a high priority because of the prevalence of critical graphics-related bugs and the presence of various exploitable memory-safety vulnerability classes.

Google credited its use of AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL for helping to identify security defects during the development cycle of Chrome.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC