#V8

Massive Chrome 154 Update Drops Fixes for 108 Security Vulnerabilities Across Graphics Stack and V8 Engine

Google has rolled out Chrome version 154 to the Stable channel across Linux, Windows, and macOS endpoints to address a staggering 108 security vulnerabilities. The update brings Linux builds to version `154.0.8037.57` while pushing versions `154.0.8037.57` and `154.0.8037.58` to Windows and macOS environments. Included in this massive release are 11 critical-severity bugs primarily clustered around Chrome's graphics processing, user interface, and WebGL rendering pathways. Specifically, three critical buffer overflow flaws were mitigated within ANGLE—the internal abstraction layer responsible for translating graphics API calls—tracked as `CVE-2026-95350`, `CVE-2026-95281`, and `CVE-2026-95284`. The update also eliminates out-of-bounds write defects in the GPU subsystem with `CVE-2026-95357` and `CVE-2026-95322`, alongside WebGL memory-safety issues tracked as `CVE-2026-95349` and `CVE-2026-95329`. In addition to the graphics pipeline, several critical use-after-free conditions were corrected in components including `ServiceWorker` (`CVE-2026-95339`), `Fullscreen` (`CVE-2026-95313`), `WindowDialog` (`CVE-2026-95356`), and `AdFilter` (`CVE-2026-95310`). Beyond the critical category, the release patches high-severity issues in the V8 JavaScript engine, including an out-of-bounds write (`CVE-2026-95304`) and a type confusion flaw (`CVE-2026-95306`) reported by OpenAI Codex Security. Additional high-severity fixes span use-after-free bugs and authorization flaws in modules such as `PDFium`, `WebAudio`, `Bluetooth`, `HID`, `DevTools`, `Aura`, and the extensions framework. Google indicated that public access to in-depth bug details and exploit reproduction materials remains restricted until a significant portion of the user base has successfully applied the update.