Chrome 154 brings 108 security fixes and no headline features
Neowin first reported the release. SecurityWeek, PCWorld and several security trade outlets have since confirmed the same total: Chrome 154 is rolling out as versions 154.0.8037.57/.58 for Windows and macOS, and as version 154.0.8037.57 for Linux. PCWorld reports that Chrome 154 doesn't offer any new features beyond these security improvements. For admins, that makes this a patch rollout, with no feature testing to plan around.
Two sources give the same severity split. PCWorld says eleven vulnerabilities are classified as critical, and a further 25 vulnerabilities are classified as high risk, 47 as medium risk, and 25 as low risk. A security-tracking issue in the v8go open-source project, built from Google's release post, lists the same numbers: 108 (Critical: 11, High: 25, Medium: 47, Low: 25).
| Severity | Count in Chrome 154 |
|---|---|
| Critical | 11 |
| High | 25 |
| Medium | 47 |
| Low | 25 |
| Total | 108 |
PCWorld also reports who found the bugs. Google's own teams found 76. The remaining 32 vulnerabilities were identified and reported by external security researchers, and Google has so far awarded them a total of $18,000 in bounties. That total will probably go up, because several critical entries still show rewards as "TBD." PCWorld also says none of them have been exploited in attacks yet. That matches Google's notice, which does not mention in-the-wild exploitation for any of the 108 bugs.
Google is also keeping details back on purpose. It has said that details about the bugs and related issues may remain restricted until most users have installed the fixes. For now, most public entries are a one-line description plus a component name, and that will stay true until the rollout is mostly done.
ANGLE and the GPU process account for most critical bugs in CVE-2026-95350 and its neighbours
Most of the critical bugs are in graphics code. ANGLE is the layer Chrome uses to translate WebGL and other graphics calls into whatever API the operating system provides. On Windows, that makes it the path from a web page to the GPU driver. Three of them are buffer overflows in the Angle graphics library for WebGL, per PCWorld. Cybersecuritynews names them: CVE-2026-95350, plus CVE-2026-95281 and CVE-2026-95284, two additional critical buffer overflow flaws in ANGLE.
CVE-2026-95350 has the largest public bounty in this release. The bug was reported by Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng of STAR Labs SG Pte. Ltd. Google awarded a $5,000 bug bounty for the finding. Google's notice says the report came in on August 24, 2026. The second named payout, $2,500, went for CVE-2026-95357, a critical out-of-bounds write in the GPU component credited to a researcher listed as "Anymous" and reported on July 1, 2026.
The other critical bugs are spread across more of the browser. Cyberpress reports that additional critical flaws hit the GPU process, WebGL, ServiceWorker, Fullscreen, WindowDialog, and AdFilter components. Google's notice includes CVE-2026-95339, a use-after-free in ServiceWorker, and CVE-2026-95313, a use-after-free in Fullscreen. Both still show rewards as "TBD."
These bugs share a type. Buffer overflows, out-of-bounds writes and use-after-free bugs (where code keeps using memory after it has been freed) all corrupt memory. GBHackers notes that bugs like these can corrupt memory and may enable code execution, cause browser crashes, lead to sandbox escapes, or expose data, depending on their exploitability. The Hong Kong Computer Emergency Response Team (HKCERT) lists the possible impacts across the whole set as remote code execution, security restriction bypass, denial of service, information disclosure, spoofing, cross-site scripting and data manipulation. That list covers all 108 bugs together, so no single CVE can do all of those things. HKCERT still rates the bulletin Medium Risk, which fits with no known exploitation.
Neowin describes the release as focused heavily on memory safety. The named critical bugs support that. The published figures show a narrower picture for the whole release: PCWorld says the most common types of fixed security vulnerabilities are use-after-free flaws (34), UI misrepresentation issues (12). So memory-corruption bugs make up the biggest group and most of the critical tier, but the release also fixes a real number of logic and UI-spoofing problems.
Chrome 154 also fixes V8 bugs, including one found by OpenAI Codex Security
The high-severity tier includes bugs in V8, Chrome's JavaScript engine. Cybersecuritynews reports that Chrome 154 fixes high-severity type confusion and out-of-bounds write flaws in the V8 JavaScript engine, which could potentially be exploited through specially crafted webpages. The named fixes include CVE-2026-95304, an out-of-bounds write in V8, and CVE-2026-95306, a type confusion vulnerability reported by OpenAI Codex Security. The v8go tracker lists more V8 entries: CVE-2026-95280, a high-severity race condition, plus two low-severity bugs, CVE-2026-95380 (type confusion) and CVE-2026-95342 (missing authorization).
The high-severity tier also covers many other parts of the browser. The fixes include a missing authorization flaw in Extensions, a UI misrepresentation issue in SecurityIndicators, and multiple use-after-free bugs in Browser, Aura, Chromecast, Bluetooth, HID, PDFium, Views, WebAudio, and GPU components. For enterprise admins, PDFium and Extensions matter most here, because users open PDFs in the browser and run extensions every day.
Most of the fixes came from Google's own tooling. Google credits AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL with finding bugs during the Chrome 154 cycle. That fits PCWorld's figure of 76 bugs found internally. A credit to OpenAI Codex Security on a V8 bug shows AI-assisted code auditing now appearing in Chrome's credits. That is one credit on one bug, though, and says nothing broader about how Chrome's bugs get found.
Why some Windows PCs get Chrome 154.0.8037.57 and others get .58
The build numbers are where Neowin's report goes wrong. It said Windows and Linux move to 154.0.8037.57 and that macOS also gets .57. Google's release notice lists 154.0.8037.57 for Linux and 154.0.8037.57/.58 for both Windows and Mac. HKCERT confirms the same split and tells users to update to those versions or later. Some secondary coverage phrases this as if Windows gets .57 and Mac gets .58. Google does not split it that way. Either build number is a patched Chrome 154 on Windows or macOS.
For anyone checking versions across many machines, the rule is simple. A Windows or Mac endpoint on 154.0.8037.57 or 154.0.8037.58 is patched. A Linux endpoint needs 154.0.8037.57 or later. Anything on Chrome 153 or earlier is not patched.
The rollout is staged, so a machine on the old version is not necessarily broken. PiunikaWeb notes that the update is rolling out over the next few days and weeks, so don't be surprised if it doesn't hit your machine right away. Opening the About page asks the update server for the new build, but it can't get ahead of the rollout if Google hasn't released the build to that device yet.
Other channels have their own releases. PCWorld reports Chrome for Android 154.0.8037.57 and Chrome for iOS 154.0.8037.55 this week, and says the Android version addresses the same vulnerabilities as the desktop versions. Organisations on the slower Extended Stable channel have a different target: the Extended Stable Channel for Windows and macOS now includes Chromium 152.0.7977.140. An Extended Stable machine on Chrome 152 is on its own supported track, so it shouldn't be flagged just because it isn't on 154.
One more point, and it's our inference rather than something Google has said: Microsoft Edge and other browsers built on Chromium share much of this code. Their users should look for those vendors' own advisories and build numbers. Chrome's version numbers don't tell you whether Edge is patched.
Getting Chrome 154 on Windows, macOS and Linux: what to do now
Nobody needs emergency action for this release, but every desktop running Chrome should get it on a normal schedule. Chrome downloads updates silently in the background. The patch only takes effect after the browser restarts, and a browser left open for weeks is the usual reason a machine stays unpatched.
Updating a single PC
- In Chrome on Windows or macOS, open the three-dot menu at the top right and choose Help > About Google Chrome. Typing chrome://settings/help in the address bar opens the same page.
- Opening that page checks for the update and starts the download on Windows and macOS.
- Click Relaunch when it appears. Restarting the browser completes the installation process. Chrome reopens your tabs, but save any unsent work in web forms before you restart.
- Open the About page again. You're patched if it shows 154.0.8037.57 or .58 on Windows or macOS.
- If it still shows Chrome 153 and says it's up to date, your device probably hasn't been included in the staged rollout yet. Check again later.
On Linux, Neowin says to use your distribution's update manager instead of the browser. How Chrome is packaged differs between distributions, so the browser's own update page may not install anything there. The target is 154.0.8037.57 or later.
Managed fleets
Cyberpress advises that enterprises managing fleets via policy should prioritize forced updates given the volume of Critical and High findings in this release. The sources don't name specific Chrome Enterprise policies or deadlines, so use whatever channel you already use to deploy Chrome. Then check your inventory for machines that have downloaded 154 but haven't restarted, because those will still report the old version.
- Chrome 154 fixes 108 vulnerabilities, including 11 critical and 25 high-severity bugs, and none is publicly known to be exploited.
- On Windows and macOS, either 154.0.8037.57 or 154.0.8037.58 counts as patched; Linux needs 154.0.8037.57 or later.
- Several critical fixes involve ANGLE, the GPU process and WebGL, including CVE-2026-95350 ($5,000 bounty) and CVE-2026-95357 ($2,500).
- Help > About Google Chrome starts the update on Windows and macOS, but the fix doesn't apply until you click Relaunch.
- A machine that says it's up to date but still runs Chrome 153 is probably waiting for the staged rollout to reach it.
- Extended Stable machines should be on Chromium 152.0.7977.140, not 154.
Chrome 154 fixes a large number of bugs that Google has so far described only in one-line summaries. Those summaries will become more detailed as the rollout finishes and Google lifts its restrictions, and researchers will be able to study the fixes more closely. Anyone still on Chrome 153 by then will be more exposed. Neowin and PCWorld both say Chrome 155 is due in about two weeks. PCs updated and restarted now will move to 155 as a routine update instead of needing to catch up.