Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks

Google has released Chrome 154 for Windows, macOS, and Linux, fixing 108 security vulnerabilities, including several critical memory-safety flaws that could potentially allow attackers to execute code through malicious web content.

The update is rolling out gradually as Chrome 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and macOS. The release addresses eleven critical vulnerabilities across Chrome components involved in graphics processing, browser services, WebGL rendering, and user-interface handling.

Several of these issues are memory-corruption bugs, a vulnerability category frequently used in browser exploitation chains because it can enable an attacker to alter application memory and potentially run attacker-controlled code.

Among the most severe fixes is CVE-2026-95350, a buffer overflow in ANGLE, Chrome’s graphics translation layer. The bug was reported by Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng of STAR Labs SG Pte. Ltd.

Chrome Patches 108 Vulnerabilities

Google awarded a $5,000 bug bounty for the finding. Chrome also patched CVE-2026-95281 and CVE-2026-95284, two additional critical buffer overflow flaws in ANGLE.

ANGLE is a key Chrome component that translates graphics commands for different platforms. A successful exploit against this layer could be triggered when a victim visits a crafted website that processes malicious graphics content.

Google also fixed critical buffer overflow flaws in WebGL, including CVE-2026-95349, and an out-of-bounds write bug tracked as CVE-2026-95329.

The update further resolves critical out-of-bounds write vulnerabilities in the GPU component, identified as CVE-2026-95357 and CVE-2026-95322.

Out-of-bounds write issues occur when software writes data beyond an allocated memory area. This can corrupt memory and, under certain conditions, lead to browser crashes, data exposure, or code execution.

Other critical fixes include use-after-free vulnerabilities in ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Use-after-free bugs arise when an application continues to access memory after it has been released. Attackers may exploit these flaws to manipulate memory and escape expected browser security boundaries.

Chrome 154 also contains a large number of high-severity fixes. These include a missing authorization flaw in Extensions, a UI misrepresentation issue in SecurityIndicators, and multiple use-after-free bugs in Browser, Aura, Chromecast, Bluetooth, HID, PDFium, Views, WebAudio, and GPU components.

Chrome 154 also fixes high-severity type confusion and out-of-bounds write flaws in the V8 JavaScript engine, which could potentially be exploited through specially crafted webpages to gain control of the browser process.

High-Severity Security Fixes :

Google fixed CVE-2026-95304, an out-of-bounds write in V8, and CVE-2026-95306, a type confusion vulnerability reported by OpenAI Codex Security.

Google said it is restricting access to some bug details until most users have installed the update. This reduces the risk of attackers using technical information to develop exploits before systems are patched.

Users should immediately update Chrome by opening the browser menu, selecting Help, then About Google Chrome, and relaunching when the update is ready. Organizations should verify that managed devices receive Chrome 154 through their endpoint-management platforms.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Chrome Patches 108 Vulnerabilities Including Crticial Flaws that Enable Code Execution Attacks appeared first on Cyber Security News.