Chrome 154 patches 108 flaws including 11 critical, nearly all memory bugs
The stable rollout of Chrome 154, which began September 22, 2026, closes 108 security flaws including 11 critical, almost all use-after-free and buffer-overflow bugs in the GPU and rendering layers. None is confirmed exploited, but their sandbox-escape potential makes them an immediate deployment priority across every browser in the fleet.
September 22, 2026. Google begins rolling out Chrome 154 to the stable channel for Windows, macOS, and Linux. September 29, 2026. The NVD and CVE Brief publish the associated critical set, mostly use-after-free flaws rated CVSS 9.6. September 30, 2026. CVE Brief puts Chrome at the top of the day’s critical disclosures, with eight flaws at 9.6 published in a single delivery. Why it matters: a month after the exploited V8 zero-day in Chrome 153, this time a whole battery of memory flaws lands at once, and several allow code execution outside the sandbox.
108 fixes, 11 critical
The raw number already tells the story: Chrome 154 carries 108 security fixes in its first stable promotion, 11 of them rated critical by Google. The affected builds are 154.0.8037.57 for Linux and 154.0.8037.57 or .58 for Windows and macOS, with later increments up to 154.0.8037.92 over the course of the cycle.
The distribution of critical flaws is strikingly uniform: almost all are use-after-free or buffer-overflow bugs, concentrated in the graphics and rendering layers. CVE-2026-95350, CVE-2026-95281, and CVE-2026-95284 are three buffer overflows in ANGLE, the OpenGL ES shader translator, all found by researchers at STAR Labs SG. CVE-2026-102304 is a use-after-free in the password manager that enables code execution outside the sandbox. CVE-2026-102306 hits Bluetooth, CVE-2026-102309 fullscreen, CVE-2026-102331 an overflow in ANGLE on Android, and CVE-2026-95277 the Views layer.
The exploitation mechanics are identical across the board: a crafted HTML page, user interaction, no privileges required. It is the web’s most common vector, and exactly the one a firewall cannot block.
Use-after-free: the class that will not die
Use-after-free dominates this release, and not by accident. A use-after-free happens when a program frees a region of memory and then keeps accessing it; if an attacker can place controlled data at that address in between, they get memory corruption, then potentially code execution. The class is structurally tied to C++ and manual memory management, and it has been the leading cause of critical flaws in Chrome for years.
Google knows this. Across recent versions the browser has been migrating components to memory-safe languages, and mechanisms like MiraclePtr and site isolation shrink the exploitable surface. But this delivery shows the job is far from done: the ANGLE, GPU, WebGL, ServiceWorker, and Views layers remain reservoirs of flaws, often inherited from historical code that is hard to rewrite.
The contrast with last month
The contrast with September is instructive. On September 8, 2026, Google shipped Chrome 153 with 230 fixes and a single headline: CVE-2026-87491, an out-of-bounds write in the V8 engine already exploited in the wild, the seventh exploited Chrome zero-day of 2026.
A month later the shape of the risk has changed. Chrome 154 has, so far, no flaw confirmed exploited in the wild — the September 30 CVE Brief lists eight Chrome flaws at CVSS 9.6, but none appears in CISA’s KEV catalog. What changed is the volume: from one isolated zero-day to a dozen simultaneous criticals. For defenders, that shifts the priority from “patch this one flaw” to “keep the fleet current, permanently.”
The browser, blind spot of the perimeter
This release is a reminder of a reality security teams prefer to forget: the browser is the most exposed and hardest-to-control component of the workstation. A use-after-free in the password manager, or a flaw that runs outside the sandbox, bypasses the separation that protects the operating system, and merely visiting a site is enough to trigger it.
The consequence is operational. Chrome updates itself, but the real fleet is heterogeneous: Edge, Brave, Opera, Vivaldi, and embedded webviews share the Chromium engine and follow their own schedules. A flaw fixed in Chrome stays open for days or weeks in a third-party browser or an app that bundles an aging Chromium. Verification must cover everything that renders a web page, not just the Chrome icon.
The memory migration, the other project
If the use-after-free flaws keep arriving, it is because patch-by-patch fixes are not enough. Google knows this and has been running a multi-year effort: rewriting the most exposed components in Rust, generalizing MiraclePtr to neutralize a large share of use-after-free, and tightening site isolation to contain the blast radius of a flaw.
The reality of this delivery is that the graphics layers — ANGLE, GPU, WebGL — remain the leakiest. These components move memory buffers at speeds where a memory-safe rewrite is hard, and they ingest web-supplied data continuously. Until that migration finishes, every monthly release will keep bringing its batch of memory flaws, and use-after-free will stay the dominant critical class.
For defenders this changes the doctrine. You never “finish” patching a browser: you keep it continuously updated, restrict extensions to the essential few, and treat embedded Chromium — webviews, desktop clients, Electron components — as a surface of its own with its own patch schedule. An outside-the-sandbox flaw in this month’s list is enough to justify that rigor.
The enterprise playbook on patch day
For a fleet, the work is less about Chrome itself than about everything built on Chromium. The stable build auto-updates, but enterprises should still verify the rollout: confirm endpoints land on 154.0.8037.57 or later, force a restart for users who keep a browser session alive for weeks, and push the matching updates for Edge, Brave, Opera, and any line-of-business app that embeds a webview.
The hardest part is inventory. Webviews and Electron apps do not advertise their engine version, and a single unpatched component that renders web content inherits the same use-after-free class. A quick win is to audit which applications bundle Chromium and to prefer vendors that ship engine updates on time.
None of this needs new tooling. It needs treating the browser estate the way teams already treat the operating system estate: known versions, enforced updates, and a short window between disclosure and deployment.
Verdict
If you manage an enterprise fleet, force the update to 154.0.8037.57 or later and check Edge, Brave, Opera, and webviews in the same pass: the Chromium fix does not propagate on its own. If you administer isolated or unmanaged endpoints, schedule a manual catch-up — none of these flaws requires privileges, and the presence of an outside-the-sandbox bug in the list raises the stakes above a mere browsing crash. And if you track the numbers, watch less the count of exploited zero-days than the steady drift of use-after-free: that is what tells you whether Chrome’s memory migration is making progress, or merely patching over.
References
- Chrome Releases — Stable Channel Update for Desktop (Chrome 154)
- The Hack Academy — Chrome 154 security fixes: 108 in the Stable release
- Cyber Security News — Chrome Patches 108 Vulnerabilities Including Critical Flaws
- ByteIota — Chrome 154: 108 Patches, 11 Critical GPU and V8 Flaws
- CVE Brief — September 30, 2026