Google promoted Chrome 154 to the stable channel on 22 September, and the release notes carry 108 security fixes. Eleven are rated critical, Google's top severity band.
Seven of those eleven sit in the same place: the code that talks to the graphics card.
Three are buffer overflows in ANGLE, the layer that translates a web page's graphics calls into whatever the machine's own driver speaks. Two more are out-of-bounds writes in the GPU process, and two are memory-safety bugs in WebGL. The remaining four are use-after-free flaws, where code keeps using a piece of memory after it has been released, in ServiceWorker, Fullscreen, WindowDialog and AdFilter.
Eleven identifiers, eleven short descriptions
The graphics cluster is CVE-2026-95350, CVE-2026-95281 and CVE-2026-95284 in ANGLE, CVE-2026-95357 and CVE-2026-95322 in the GPU process, and CVE-2026-95349 and CVE-2026-95329 in WebGL. The use-after-free set is CVE-2026-95339 in ServiceWorker, CVE-2026-95313 in Fullscreen, CVE-2026-95356 in WindowDialog and CVE-2026-95310 in AdFilter.
That one-line summary is all Google publishes for now, and deliberately so. Srinivas Sista's release post repeats the standing note that access to bug details and links stays restricted until a majority of users have updated, and stays restricted longer when the bug lives in a third-party library other projects also depend on. Nothing in the post says any of the eleven has been exploited, which is the one difference worth holding onto against the Chrome 153 release earlier this month, where a V8 flaw was already under attack when the fix shipped. HKCERT picked the release up on 23 September and rates it medium risk.
Who found them
External researchers reported most of the critical set. STAR Labs SG accounts for the three ANGLE overflows, with Muhammad Alifa Ramdhan on all three and Billy Jheng Bing Jhong and Pan Zhenpeng joining him on CVE-2026-95350, the only critical carrying a disclosed reward at 5,000 dollars. Xinyang Ge reported two of the use-after-free bugs, and David Sievers, Andrew Boni and Huynh Dinh Vu one each. Google's own teams found two of the graphics bugs. Most of the remaining bounty amounts are still listed as to be decided.
The oldest report in the critical group was filed on 1 July, the newest on 16 September, six days before the release shipped.
Update to 154.0.8037.57, then check it took
The fixed builds are 154.0.8037.57 on Linux and 154.0.8037.57 or .58 on Windows and Mac. Google says the release rolls out over the coming days and weeks, so a browser left alone can sit on an older build for a while. Check the version rather than wait for it. Chromium-based browsers pick these fixes up on their own schedules, which means Edge, Brave, Opera and Vivaldi users are waiting on their own vendors rather than on Google.
The graphics stack keeps returning. We covered a critical ANGLE flaw in Chrome 152 at the end of August, in a release that also carried ten criticals, and three of this month's eleven are in that same component again. ANGLE is the part of the browser that hands input from an untrusted web page to a graphics driver written by somebody else, and it is doing the hardest job in the product.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.