Chrome 154 tackles 108 vulnerabilities, with critical bugs found in its graphics and browser components.
TECH
On Tuesday, September 22, 2026, Google released chrome 154, bringing with it fixes to 108 security vulnerabilities including 11 bugs classified as critical.
Google is rolling out Chrome 154 as versions 154.0.8037.57/.58 for Windows and macOS, and version 154.0.8037.57 for Linux. The company says the update will be distributed progressively over the coming days and weeks.
While the number is enough to justify an immediate update, the more revealing story is where several of the critical flaws were found: in ANGLE, WebGL and GPU components that allow ordinary webpages to reach complex native graphics code.
That makes Chrome 154 more than a routine browser patch. It highlights a persistent security challenge: how to safely process graphics instructions supplied by potentially malicious websites.
Chrome 154’s critical fixes
The update addresses 108 security flaws in total. The 11 critical vulnerabilities include:
Three buffer overflows in ANGLE.
One buffer overflow in WebGL.
Two out-of-bounds writes in GPU components.
One out-of-bounds write in WebGL.
Use-after-free vulnerabilities in ServiceWorker, Fullscreen, WindowDialog and AdFilter.
Google’s release notes identify the critical issues with CVE numbers ranging from CVE-2026-95281 through CVE-2026-95357, including CVE-2026-95350, a critical ANGLE buffer overflow, and CVE-2026-95349, a critical WebGL buffer overflow.
The distinction matters because these are not merely interface or configuration bugs. Buffer overflows, out-of-bounds writes and use-after-free vulnerabilities are memory-safety problems. Depending on the conditions, they can cause crashes, corrupt data or become part of a larger exploit chain.
The hidden path from a webpage to the GPU
Many people think of a browser as an application that displays text, images and videos. Modern browsers are also powerful graphics platforms.
Websites use WebGL for interactive 2D and 3D content, including games, maps, product visualizers, data dashboards and virtual reality applications. A simplified version of the processing path looks like this:
The important detail is that the process begins with input controlled by a webpage. A site does not need to install a traditional program to exercise this part of Chrome. It can submit graphics commands, shader data, texture information and buffer parameters through browser APIs.
That does not mean visiting a website automatically compromises a device. It means the graphics pipeline is reachable from untrusted web content and must carefully validate complex input at every stage.
Why ANGLE and WebGL keep producing bugs
ANGLE is a translation bridge
ANGLE, short for Almost Native Graphics Layer Engine, translates graphics commands between WebGL or OpenGL ES and native graphics backends such as Direct3D, Metal or OpenGL.
This translation is necessary because Chrome runs on different operating systems and hardware configurations. However, it also creates additional code paths and assumptions.
A graphics request that is valid at the WebGL level may need to be represented differently by a native backend. ANGLE must account for differences in:
Buffer layouts.
Texture formats.
Shader behavior.
Memory alignment.
Integer sizes.
GPU capabilities.
Error handling.
Resource lifetimes.
Every conversion is an opportunity for a mismatch. If one stage calculates a buffer size differently from another stage, the program may allocate too little memory and later write beyond the allocation.
Graphics calculations involve many dimensions
Graphics operations commonly combine several attacker-influenced values:
memory required=width×height×channels×bytes per channel
A malicious input may use unusually large dimensions or values designed to create an integer overflow. If the calculation wraps around, the result can appear smaller than the true amount of data required.
The software may then allocate an undersized buffer while later processing the original, larger input. That mismatch can lead to a buffer overflow or out-of-bounds write. Chromium security research has documented this general type of risk in graphics-related processing.
WebGL exposes complicated native code to websites
WebGL is valuable precisely because it gives websites access to hardware-accelerated graphics. That benefit also increases the amount of native code that can be reached through a browser page.
The code must process:
Shaders.
Vertex and index buffers.
Textures.
Compressed images.
Framebuffers.
Dimensions and offsets.
Graphics state changes.
Hardware-specific limitations.
Each object has its own size, format and lifecycle. A mistake in one validation check can produce memory corruption later in the pipeline.
The difficulty is compounded by the need to support a wide range of GPUs, drivers and operating systems. A path that behaves safely on one device may expose a different edge case on another.
Why attackers value this attack surface
Chrome uses process isolation and sandboxing to limit the damage caused by a compromised browser component. Graphics-related vulnerabilities can still be valuable because the rendering pipeline crosses several security and software boundaries.
A possible attack chain might involve:
A malicious webpage supplies crafted graphics input.
A memory-safety flaw corrupts a renderer or GPU-related process.
The attacker attempts to gain control of that process.
A separate vulnerability is used to bypass the sandbox or reach more privileged functionality.
The existence of a buffer overflow does not prove that this entire chain is practical. Exploitation depends on the specific bug, process permissions, platform protections and whether reliable exploit code exists.
Nevertheless, the graphics stack is attractive because it combines two important properties: it is broadly reachable through web content and technically complex enough to contain subtle memory-management defects.
Chrome 154’s bug pattern is more important than its bug count
The 108 vulnerabilities include weaknesses across many Chrome components, but the critical flaws show a noticeable concentration in memory-safety issues.
A buffer overflow occurs when software writes beyond the memory allocated for a buffer. An out-of-bounds write is closely related: the program accesses memory outside the permitted range.
Use-after-free is different. It occurs when software continues using an object after that object has already been released. In browser software, asynchronous operations and complex page lifecycles can make object ownership difficult to manage.
These bugs do not all have the same exploitation path, but they share a common theme: software is processing untrusted input while managing complex memory and object lifecycles.
External Researchers found most flaws
The release also illustrates the importance of independent browser security research. Nine of Chrome 154’s 11 critical issues were reported by external researchers. Overall, external researchers reported 32 of the newly fixed vulnerabilities. Google said it had paid $18,000 in bug bounty rewards so far, with additional amounts still to be determined for several reports .
Google’s release notes also say that many Chrome security bugs are found using tools and techniques including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL.
What Chrome users should do
Users should update Chrome as soon as the update becomes available.
To check manually:
Open Chrome.
Select the three-dot menu.
Choose Help.
Select About Google Chrome.
Allow Chrome to download the update.
Relaunch the browser when prompted.
Affected versions should be updated to Chrome 154.0.8037.57 or later on Linux and Chrome 154.0.8037.57/.58 or later on Windows and macOS, according to the Hong Kong Computer Emergency Response Team’s advisory.
Organizations should verify that managed devices have received the new version rather than relying only on the browser’s automatic rollout. This is particularly important for systems used to access sensitive business, financial or administrative services.
Users should also remember that browser extensions, operating-system updates and graphics drivers form part of the broader security picture
thenatdw © 2026
thenatdw is a website that focuses on tech, science ai news