By ByteBot
Chrome 154 is out with 108 patches, 11 of them critical. All the critical flaws are memory-corruption bugs — buffer overflows, out-of-bounds writes, and use-after-free vulnerabilities spread across the GPU pipeline, WebGL renderer, ANGLE translation layer, and a handful of browser UI components. No active exploitation has been confirmed yet. That window will not stay open. Update now.
The Graphics Layer Is the New Attack Frontier
Five of the eleven critical vulnerabilities live in the browser’s graphics stack. Three are buffer overflows in ANGLE, Chrome’s abstraction layer that translates WebGL and WebGPU calls to native graphics APIs — Direct3D on Windows, Metal on macOS, Vulkan on Linux. Two more are out-of-bounds writes in the GPU component, and two additional flaws — one buffer overflow, one out-of-bounds write — hit WebGL directly.
Every browser tab running 3D content, a WebGL-based map, a game, or hardware-accelerated canvas goes through ANGLE. The exploit path is drive-by: an attacker crafts a page with malicious WebGL content, a visitor loads it, the browser renders it, and code executes in the renderer process. Sandbox escape from there is the goal — and it has been achieved before.
ANGLE has been a reliable source of high-severity Chrome bugs throughout 2025 and 2026. CVE-2026-14425 was an ANGLE use-after-free rated CVSS 9.6 that enabled sandbox escapes earlier this year. The three critical ANGLE buffer overflows in this release — CVE-2026-95350, CVE-2026-95281, CVE-2026-95284, all discovered by researchers at STAR Labs SG — follow the same pattern. One ANGLE flaw hits Windows, macOS, and Linux simultaneously, and every Chromium-based browser (Edge, Brave, Arc, Opera) inherits the vulnerability until each ships its own update.
The underlying driver is predictable: browsers are using the GPU for more than rendering. AI inference in the browser via WebGL and WebGPU, hardware-accelerated video decoding, and the march toward WebGPU as the dominant graphics API all increase the volume of untrusted content flowing through the graphics pipeline. More surface area, more bugs.
ServiceWorker and UI Use-After-Frees
Four more critical bugs are use-after-free vulnerabilities in ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Use-after-free means memory was freed but a pointer to it was kept alive — an attacker who can place controlled data in the right memory location can take over execution when that dangling pointer gets dereferenced.
The ServiceWorker one deserves attention from web developers specifically. Service workers persist across page navigations, run in the background, and handle push notifications, offline caching, and background sync. A UAF in ServiceWorker is not just a browser problem; it is a web application problem. Across all 108 patches in this release, use-after-free is the single most common vulnerability class with 34 instances.
V8 Has Two More Memory Bugs
V8 picks up two high-severity fixes: CVE-2026-95306 (type confusion) and CVE-2026-95304 (out-of-bounds write). V8 type confusion is worth flagging because it was the exact vulnerability class in CVE-2026-85046 — an actively exploited V8 zero-day patched just three weeks ago in Chrome 152. When attackers have a working exploit template for a bug class, the time from patch to next weaponized attempt compresses significantly. These two V8 fixes are rated high rather than critical, but the proximity to an active exploit is not a coincidence you should ignore.
How to Update
On desktop, go to Help → About Google Chrome or navigate to chrome://settings/help. The update installs and a browser restart completes it. Target versions:
- Windows / macOS: 154.0.8037.57 or .58
- Linux: 154.0.8037.57
- Android: 154.0.8037.57
- iOS: 154.0.8037.55
Enterprise teams managing Chrome via MDM (Intune, Jamf, Group Policy) should validate deployment within 48–72 hours. The Extended Stable channel still receives security patches immediately — the delay only applies to feature releases. Full release notes are at Chrome Enterprise release notes.
No active exploitation of these vulnerabilities has been confirmed at the time of release. This is not a “drop everything” emergency. But eleven critical memory-corruption bugs with a proven drive-by exploit path is not something to defer past the end of the week.
The Pattern Worth Watching
Chrome 151 in July fixed 370 vulnerabilities — the largest patch batch in Chrome history. Chrome 152 patched an actively exploited V8 zero-day that hit the CISA Known Exploited Vulnerabilities catalog. Chrome 154 now closes 108 more, with nearly half the critical bugs concentrated in the graphics pipeline.
The graphics layer is where browser security battles are being fought right now. ANGLE alone has contributed critical bugs in multiple 2025 and 2026 releases. As WebGPU adoption accelerates and more compute shifts to the browser’s GPU path, the attack surface will keep growing. Keep the browser updated — and if you build web applications using WebGL or WebGPU, start paying attention to what these vulnerability patterns mean for your own code’s interaction with browser graphics APIs.
