Chrome 154's 11 critical fixes: seven in webpage-reachable graphics code, four use-after-free bugs elsewhere
Google shipped 108 security fixes to the Chrome stable channel on September 22, eleven of them rated Critical and seven of those in graphics components a crafted page can drive. None were reported as exploited.
The Watch · Security desk
What happened
- Google's September 22 Chrome stable channel update for desktop carries 108 security fixes, 11 of them rated Critical, as versions 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and Mac.
- Malwarebytes says a crafted webpage could trigger CVE-2026-95350, a buffer overflow in Chrome's ANGLE graphics-translation layer, with outcomes from a browser crash to possible code execution.
- A day later Google pushed Chrome 155.0.8059.16 to a small share of Android users as an Early Stable rollout, describing it as stability and performance improvements.
Why it matters
- Who's exposed exposure An endpoint stays on the old build until the Chrome process actually restarts, so the long-running session belonging to the busiest user is the one still reachable from a web page.
- Who has to decide decision Fleet owners choose between a forced relaunch inside business hours and the staged rollout, and the staged option has no fixed completion date to report to a risk owner.
- What it limits constraint Reading this release CVE by CVE does not change the action available, because the only thing an admin can enforce is the version string and the only evidence of compliance is a restarted browser.
Next story · Security · 2d ago
XBOW built a Windows Chrome exploit chain in six days with about $40,000 of AI computeConfirmed4 publishers
ANGLE is the layer that translates Chrome's graphics calls for the host system, and it holds three of the eleven Critical entries [5]. Malwarebytes flags a second of them, CVE-2026-95281, as the same buffer overflow class in the same component, reachable by a malicious webpage [12]. A third, CVE-2026-95357, is an out-of-bounds write in the GPU component, the part of Chrome that talks to the machine's graphics processor [13]. Sort the Critical list by component and seven of the eleven sit in graphics code: three ANGLE overflows, one in WebGL, two out-of-bounds writes in GPU, one more in WebGL [5][18]. The remaining four are use-after-free bugs [5].
Below the Critical tier sit 25 high-severity bugs, a dozen of them use-after-free, which leaves 72 of the 108 in the medium and low bands [8][19]. Google did not report any of the 108 as exploited in the wild, according to SecurityWeek, and told users to update as soon as possible [9].
The release rolls out over days and weeks rather than landing at once [4]. Malwarebytes notes two ways a machine falls behind anyway: a browser that is never closed, and an extension that blocks the update [16]. The manual path is About Google Chrome from the settings or Help menu, then Relaunch [17].
Thirty-two of the 108 came from external researchers, including nine of the eleven Critical bugs, so Google's own people found 76 [6][20]. Google says it has handed out $18,000 in bounties so far and has yet to set the amounts for most of the externally reported bugs [7]. Divided across the 32 external reports, the figure disclosed to date works out to roughly $560 each [21].
Android moved separately. On September 23, one day after the desktop release, Google pushed Chrome 155.0.8059.16 to a small share of Android users as an Early Stable rollout, and described the contents as stability and performance improvements [14][22]. Malwarebytes says it may not be on Google Play for everyone yet [14]. Chrome 155 is also in the Beta channel, which runs roughly four to six weeks ahead of Stable and is meant for testing [15].
What makes this a same-week action is the entry point: a page in a tab hitting graphics code in eleven bugs Google rated Critical [5][11].
What to watch
- Whether any of the 11 Critical bugs turns up in exploitation reporting or on CISA's KEV list, which would move this from scheduled patching to incident work.
- The final bounty total once Google sets amounts for the remaining externally reported bugs, against the $18,000 disclosed at release.
- Whether Chrome 155 graduates from Early Stable on Android with its own security fix list, or stays a stability and performance release.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption55
- Hype gap+10
- Incentives42
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On September 22 Google released a Stable Channel Update for Desktop bringing Chrome to version 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and Mac.
- [2]
The Chrome desktop stable update includes 108 security fixes, including 11 rated Critical.
- [3]
SecurityWeek reported that Google announced Chrome 154 to the stable channel on Tuesday with patches for 108 vulnerabilities, including 11 critical-severity bugs.
- [4]
Google said the desktop update will roll out over the coming days and weeks.
- [5]
The critical defects are buffer overflows (three in ANGLE and one in WebGL), out-of-bounds writes (two in GPU and one in WebGL), and use-after-free bugs in ServiceWorker, Fullscreen, WindowDialog and AdFilter.
- [6]
Nine of the critical issues were reported by external researchers; in total 32 of the newly patched flaws were reported externally, and the rest were discovered by Google.
- [7]
Google says it handed out $18,000 in bug bounty rewards to the reporting researchers, but the final amount could be much higher, as the company has yet to determine the amounts to be paid for most of the externally reported bugs.
- [8]
Twenty-five of the remaining vulnerabilities are high-severity bugs, including a dozen use-after-free defects.
- [9]
Google makes no mention of any of these vulnerabilities being exploited in the wild, but users are advised to update their browsers as soon as possible.
- [10]
CVE-2026-95350 is a buffer overflow flaw in ANGLE, Chrome's graphics-translation layer.
- [11]
A crafted webpage could potentially trigger CVE-2026-95350, which could lead to memory safety bugs including browser crashes or possible code execution.
- [12]
CVE-2026-95281 is another Critical buffer overflow bug in ANGLE; a malicious webpage could potentially reach the vulnerable graphics-processing code, and Google has not provided exploitation details.
- [13]
CVE-2026-95357 is an out-of-bounds write in Chrome's GPU component, the part of Chrome that handles how graphics work with the computer's graphics processor.
- [14]
On September 23 Google released Chrome 155 for Android, version 155.0.8059.16, to a small percentage of users as an Early Stable rollout; Google says it includes stability and performance improvements, and it may not be available on Google Play for everyone yet.
- [15]
Chrome 155 is also available in the Beta channel, a prerelease version roughly four to six weeks ahead of Stable that is relatively polished but can still contain bugs and is best suited to testing.
- [16]
Users can end up lagging behind on Chrome updates if they never close the browser or if something goes wrong, such as an extension preventing the update.
- [17]
To update manually, open About Google Chrome from Chrome's settings or Help menu; Chrome checks for updates and the user clicks Relaunch to apply it.
- [18]
Seven of the 11 critical bugs are in graphics components: three ANGLE buffer overflows, one WebGL buffer overflow, two GPU out-of-bounds writes and one WebGL out-of-bounds write.
- [19]
Seventy-two of the 108 patched flaws fall in the medium and low severity bands.
- [20]
Google's own researchers found 76 of the 108 patched flaws.
- [21]
The $18,000 disclosed so far averages about $560 per externally reported bug.
- [22]
The Chrome 155 Android release came one day after the Chrome 154 desktop stable release.
Sources
2 independent publishers whose own reporting we read for this story.
- malwarebytes.comUpdate Chrome: 108 security fixes for desktop, new release for Android
1 article · September 24, 2026
- securityweek.comChrome 154 Patches 108 Vulnerabilities
1 article · September 23, 2026
Topics and entities
Topics
- Browser security
- Memory Safety Bugs
- Patch And Redeploy Latency