#WebGL — insecure by design

high2 sourcesCVE-2026-95281 CVE-2026-95284 +11

Massive Chrome 154 Update Drops Fixes for 108 Security Vulnerabilities Across Graphics Stack and V8 Engine

Google has rolled out Chrome version 154 to the Stable channel across Linux, Windows, and macOS endpoints to address a staggering 108 security vulnerabilities. The update brings Linux builds to version `154.0.8037.57` while pushing versions `154.0.8037.57` and `154.0.8037.58` to Windows and macOS environments. Included in this massive release are 11 critical-severity bugs primarily clustered around Chrome's graphics processing, user interface, and WebGL rendering pathways. Specifically, three critical buffer overflow flaws were mitigated within ANGLE—the internal abstraction layer responsible for translating graphics API calls—tracked as `CVE-2026-95350`, `CVE-2026-95281`, and `CVE-2026-95284`. The update also eliminates out-of-bounds write defects in the GPU subsystem with `CVE-2026-95357` and `CVE-2026-95322`, alongside WebGL memory-safety issues tracked as `CVE-2026-95349` and `CVE-2026-95329`. In addition to the graphics pipeline, several critical use-after-free conditions were corrected in components including `ServiceWorker` (`CVE-2026-95339`), `Fullscreen` (`CVE-2026-95313`), `WindowDialog` (`CVE-2026-95356`), and `AdFilter` (`CVE-2026-95310`). Beyond the critical category, the release patches high-severity issues in the V8 JavaScript engine, including an out-of-bounds write (`CVE-2026-95304`) and a type confusion flaw (`CVE-2026-95306`) reported by OpenAI Codex Security. Additional high-severity fixes span use-after-free bugs and authorization flaws in modules such as `PDFium`, `WebAudio`, `Bluetooth`, `HID`, `DevTools`, `Aura`, and the extensions framework. Google indicated that public access to in-depth bug details and exploit reproduction materials remains restricted until a significant portion of the user base has successfully applied the update.

high2 sourcesCVE-2026-84323 CVE-2026-84324 +24

Google ships patches for 26 Chrome security flaws including critical memory bugs in WebGL and Shared Tab Groups

Google has rolled out an update for Chrome's desktop Stable Channel addressing 26 security vulnerabilities across the browser ecosystem. The update bumps Chrome to version 152.0.7977.75/.76 for Windows and macOS, alongside versions 152.0.7977.75 or 152.0.7977.76 on Linux. Leading the release are two critical memory safety defects, tracked as `CVE-2026-84353` and `CVE-2026-84352`. `CVE-2026-84353` represents a critical use-after-free bug in the Shared Tab Groups component, while `CVE-2026-84352` is a use-after-free flaw inside Chrome’s WebGL graphics rendering pipeline. In addition to the critical items, the release resolves nine high-severity vulnerabilities affecting subsystems like `V8`, `Skia`, `Omnibox`, `FileSystem`, and the GPU process. These high-severity flaws include an uninitialized resource condition in `V8` (`CVE-2026-84326`), a GPU buffer overflow (`CVE-2026-84351`), and an incorrect authorization bug in `FileSystem` (`CVE-2026-84354`). The update also mitigates fifteen medium and low-severity defects spanning components like WebRTC, TabStrip, Navigation, and FullScreen UI handling. Google indicated that public bug details remain restricted until a majority of active desktop clients apply the fixes. Furthermore, neither Google nor tracking sources noted any evidence of active exploitation in the wild for these specific CVEs prior to patch deployment.