Chrome 154 Security Update: 108 Fixes, 11 Critical and How to Update

Google released Chrome 154 to the Stable channel on Tuesday, September 22, 2026, and it is a big one: 108 security fixes, 11 of them rated Critical. The desktop build is version 154.0.8037.57 on Linux and 154.0.8037.57/.58 on Windows and Mac, and Google says it will roll out “over the coming days/weeks” — which means you should force the update now rather than wait for it.

It is the latest in a busy run of Chrome security releases this month, in which Google also had to patch two V8 flaws that attackers were already using. If you let your browser sit open for weeks at a time, there is a good chance you are still running an older build. Here is what changed, what the Critical bugs are, and how to make sure you are on the fixed version.

What is in the Chrome 154 security update?

According to the official Chrome 154 Stable channel announcement, the release “includes 108 security fixes.” Google lists each externally reported and internally found bug with a CVE number, a severity rating and, where applicable, the bug bounty paid. As usual, details of the bugs themselves are restricted “until a majority of users are updated with a fix,” so the public descriptions are one-line summaries such as “Use after free in ServiceWorker.”

Tallying the list in the post gives the following breakdown:

Many of the Medium and Low issues are credited to Google’s own teams and were reported months ago, which is normal for a milestone release: Google batches fixes for less urgent bugs into the next major version. The Critical and High issues are the ones that matter most for everyday users, because memory-corruption bugs in the graphics and rendering stack are the classic starting point for drive-by attacks from a malicious web page.

The 11 Critical bugs fixed in Chrome 154

Critical is the top rung of Chromium’s severity scale, generally reserved for bugs that could help an attacker break out of the browser’s protections with little or no user interaction. Chrome 154 fixes 11 of them, most concentrated in the graphics pipeline:

• CVE-2026-95350 — Buffer overflow in ANGLE, reported by researchers at STAR Labs SG (bounty: $5,000)
• CVE-2026-95281 and CVE-2026-95284 — two more buffer overflows in ANGLE, also from STAR Labs SG
• CVE-2026-95357 — Out-of-bounds write in GPU (bounty: $2,500)
• CVE-2026-95322 — Out-of-bounds write in GPU
• CVE-2026-95349 — Buffer overflow in WebGL (found by Google)
• CVE-2026-95329 — Out-of-bounds write in WebGL (found by Google)
• CVE-2026-95339 — Use after free in ServiceWorker
• CVE-2026-95313 — Use after free in Fullscreen
• CVE-2026-95356 — Use after free in WindowDialog
• CVE-2026-95310 — Use after free in AdFilter

ANGLE is the translation layer Chrome uses to turn web graphics calls (WebGL and WebGPU) into instructions for your operating system’s graphics drivers, which is why bugs there, in the GPU process and in WebGL tend to travel together. Nine of the 11 Critical bugs were reported between August 24 and September 16, so most of them went from report to fix in less than a month.

Notable High-severity fixes

Among the 25 High-rated bugs, a few stand out for ordinary users:

• Three V8 bugs — CVE-2026-95280 (race condition), CVE-2026-95304 (out-of-bounds write) and CVE-2026-95306 (type confusion). V8 is Chrome’s JavaScript engine, and it has been the target of both in-the-wild Chrome zero-days this month. The latter two were credited to OpenAI Codex Security.
• CVE-2026-95291 — UI misrepresentation in SecurityIndicators, the part of Chrome that shows you whether a connection is secure. Google paid $5,000 for it.
• CVE-2026-95301 — Missing authorization in Extensions, also rewarded with $5,000.
• CVE-2026-95338 — Use after free in PDFium, the built-in PDF viewer, which handles files you open from the web or email.

Google did not publish exploitation details for any of these, and none carries the “exploit exists in the wild” warning that Google attaches to actively exploited bugs.

Is any Chrome 154 bug being exploited?

No, not according to Google. When Google knows of active exploitation it says so explicitly in the release notes, as it did earlier this month. The Chrome 154 post contains no such statement. That makes this a routine — if large — security release rather than an emergency zero-day patch.

That distinction should not make you relaxed about updating, though. Once a fix ships, the code changes are visible in the open-source Chromium project, and attackers routinely study patches to build exploits for users who have not updated yet. That gap between the fix and the average user installing it is exactly why Google restricts bug details for a while.

September’s two actively exploited Chrome zero-days

If you have not updated Chrome at all this month, Chrome 154 also carries forward fixes for two V8 vulnerabilities that were exploited as zero-days:

• CVE-2026-85046 — a type confusion bug in V8. The NVD entry for CVE-2026-85046 says it affected Chrome before 152.0.7977.82 and allowed a remote attacker “to execute arbitrary code inside the sandbox via a crafted HTML page.” CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on September 4.
• CVE-2026-87491 — an out-of-bounds write in V8. When Google promoted Chrome 153 to Stable on September 8 with 230 security fixes, the Chrome 153 release notes stated that Google “is aware that an exploit for CVE-2026-87491 exists in the wild.” CISA added it to the Known Exploited Vulnerabilities catalog on September 9, with a September 23 deadline for US federal civilian agencies.

Both are fixed in every Chrome build released since, including Chrome 154.

Chrome security updates in September 2026

Chrome’s release cadence this month has been busy. Here are the Stable desktop security releases Google published from September 8 onward, based on the Chrome Releases blog. (The fix for CVE-2026-85046 shipped earlier in the month in a Chrome 152 update.)

The September 17 update is worth noting because it fixed two Critical bugs of its own (a use after free in Dawn and a buffer overflow in WebGL) plus a High-rated V8 type confusion bug, only five days before Chrome 154 arrived. Google also began an “early Stable” release of Chrome 155 (155.0.8059.12/.13) to a small percentage of Windows and Mac users on September 23, so another milestone is already on its way.

How to update Chrome to version 154 right now

Chrome downloads updates in the background but only applies them when the browser restarts. Google’s official Chrome update instructions are simple:

1. Open Chrome on your computer.
2. Click the three-dot More menu at the top right.
3. Choose Help > About Google Chrome. Chrome checks for updates as soon as this page opens.
4. When the download finishes, click Relaunch. If there is no Relaunch button, you are already on the latest version.
5. Confirm that the version number under the “Google Chrome” heading starts with 154.0.8037 (or higher).

Chrome reopens your normal tabs and windows after the relaunch, but Incognito windows are not restored, so save anything you need first. If the About page still shows a 153 build, the staged rollout may not have reached you yet; check again later in the day.

Chrome on Android and iPhone

Google released Chrome 154 (154.0.8037.57) for Android on September 22, saying it would become available on Google Play “over the next few days,” and noted that Android releases contain the same security fixes as the corresponding desktop release. Chrome Stable 154 for iOS (154.0.8037.55) went to the App Store the same day. On either platform, open the store app, search for Chrome and tap Update if it appears.

ChromeOS

Chromebooks follow their own schedule. The ChromeOS Stable update Google published on September 24 was OS version 16765.51.0 with browser version 152.0.7977.132, so Chromebook users will get the Chrome 154 fixes later. Keep your device set to update automatically and restart it when prompted.

Microsoft Edge and other Chromium browsers

Because Chrome’s engine is the open-source Chromium project, most of these bugs also affect other Chromium-based browsers. Microsoft’s Edge security release notes list Edge Stable version 154.0.4258.37, released September 24, 2026, which “incorporates the latest Security Updates of the Chromium project.” Microsoft says CVE details will be added as they become available.

To update Edge, open Settings and more (the three dots) > Help and feedback > About Microsoft Edge, or type edge://settings/help into the address bar. Edge normally updates automatically when you restart it, but Microsoft notes that updates can be held back on metered connections.

Other Chromium browsers such as Brave, Opera and Vivaldi ship Chromium security fixes on their own timetables. Check each browser’s About page, and do not assume you are protected just because Chrome itself has updated. Windows users should also make sure the operating system is current; our rundown of this month’s Windows 11 preview update covers what Microsoft has shipped on that side.

What about Extended Stable and managed PCs?

Organisations that use Chrome’s Extended Stable channel, which stays on an older milestone for longer, received version 152.0.7977.140 for Windows and Mac on September 22. That build remains on the Chrome 152 milestone, so administrators should check which fixes have been backported rather than assume it matches Chrome 154. IT teams that pin browser versions through policy should prioritise moving to 154.0.8037.57 or later, given the number of Critical fixes in this release.

Bottom line: should you update now?

Yes. Chrome 154 fixes 108 security vulnerabilities, including 11 Critical memory-safety bugs in core browser components, and it comes at the end of a month in which attackers exploited two separate V8 flaws before Google could patch them. Although Google has not flagged any Chrome 154 bug as exploited, the safest assumption is that attackers will start working on these fixes now that they are public.

The fix takes a minute or two: open About Google Chrome, let it download and click Relaunch. Do the same for Edge and any other Chromium browser you use, and update Chrome on your phone from the Play Store or App Store. Pair that with the other basic protections — a password manager and passkeys on your most important accounts — and a single browser bug becomes far less likely to turn into a full account takeover.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage