Chrome 154 reaches Stable with 108 security fixes

Google has begun rolling out Chrome 154 on the Stable channel for Windows, macOS and Linux, with 108 security fixes in the release. Google rates 11 of the entries Critical.

The rollout started on 22 September 2026 and was continuing over the following days and weeks. Google identified the updated desktop builds as 154.0.8037.57 for Linux and 154.0.8037.57 or 154.0.8037.58 for Windows and macOS.

Release availability does not mean every installation has already moved to a fixed build. Chrome normally downloads updates in the background, but desktop users must relaunch the browser before an available update takes effect. Staged distribution and organisational update policies can also leave devices on different versions temporarily.

Eleven Critical memory-safety flaws

Google’s published inventory divides the 108 fixes into 11 Critical, 25 High, 47 Medium and 25 Low entries. That distribution matters because the total does not represent 108 vulnerabilities of equal severity, nor does it establish that all of them are being actively exploited.

The 11 Critical entries are memory-safety defects spread across graphics, browser-service and interface components. They comprise four buffer overflows, three out-of-bounds writes and four use-after-free flaws.

The buffer overflows include CVE-2026-95350, CVE-2026-95281 and CVE-2026-95284 in ANGLE, as well as CVE-2026-95349 in WebGL. Google also listed out-of-bounds write flaws CVE-2026-95357 and CVE-2026-95322 in GPU, and CVE-2026-95329 in WebGL.

The four Critical use-after-free issues are CVE-2026-95339 in ServiceWorker, CVE-2026-95313 in Fullscreen, CVE-2026-95356 in WindowDialog and CVE-2026-95310 in AdFilter.

Google has not supplied numerical CVSS scores or complete attack prerequisites for the listed issues in the release material. It also said access to bug details may remain restricted until a majority of users have updated. Restrictions can last longer when a flaw affects a third-party library that has not yet been fixed.

A count of the reporter and reward fields in Google’s list shows that external researchers reported 32 issues, while Google reported 76. Disclosed rewards total US$18,000 so far, although several remain marked as yet to be determined.

No active exploitation reported by Google

Google’s release post does not identify any of the 108 vulnerabilities as being exploited in the wild. That is not the same as authoritative confirmation that exploitation has never occurred, and the restricted technical records make broader conclusions difficult at this stage.

Google also did not publish exact earlier affected-version ranges or per-platform applicability for every vulnerability. That limits conclusions about which older builds contain each flaw and the practical requirements for exploiting individual issues.

The figures should therefore be read as a security-fix inventory, not evidence of 108 active attacks. Google’s severity labels identify important differences within the package, but the company has not published equivalent exploitability and impact details for every entry.

Android shares the fixes, but iOS is separate

Google also released Chrome 154.0.8037.57 for Android. The company states that Android releases contain the same security fixes as their corresponding desktop releases unless it notes otherwise, connecting that Android build to the desktop security package.

The position is different for iOS. Google issued Chrome Stable 154.0.8037.55 for iOS through a separate release notice that mentions stability and performance improvements. That notice does not associate the iOS build with the 108 vulnerabilities documented for desktop, so the same security coverage should not be assumed from the available information.

Extended Stable is another distinct channel. Google updated it to 152.0.7977.140 for Windows and macOS on 22 September, but its release note does not identify that build as carrying the same 108-fix package. The absence of that statement does not prove the parallel releases contain no security changes. It means only that Google has not documented them as the same package.

How to make sure the desktop update is applied

Desktop users can open Chrome’s menu and go to Help, then About Google Chrome, to check for an available update. Once Chrome has downloaded it, the browser must be relaunched to switch the running application to the new version.

Users can then verify the displayed build against the platform-specific release. Linux should show 154.0.8037.57, while Windows and macOS may show 154.0.8037.57 or 154.0.8037.58.

For administrators, the staged rollout means release announcements and device status remain separate questions. A fixed version can be available while managed systems still await distribution, validation or a user relaunch. Exact behaviour can vary with organisational policies and software distribution arrangements.

The immediate check is whether each installation is running the documented fixed build, rather than simply whether Chrome 154 has been released. Relaunching Chrome and confirming the displayed version establishes that the available desktop update has taken effect without treating the size of the fix list as evidence of active attacks.

Want to interpret a browser fix inventory without conflating release availability, severity labels and exploitation evidence? The Hack Academy's online cybersecurity training programme offers self-paced learning in cybersecurity fundamentals and internet vulnerabilities, with practical exercises alongside theory.