Chrome 154 Fixes 108 Flaws, 11 Critical

Google pushed Chrome 154 to the stable channel on Tuesday, closing out 108 vulnerabilities in one of the browser's larger single-release patch hauls. Eleven of those bugs carry a critical severity rating, and Google is advising users to update immediately even though it says none of the flaws have been exploited in the wild.

The release touches every supported desktop platform, arriving as versions 154.0.8037.57/.58 for Windows and macOS and as version 154.0.8037.57 for Linux. As with most Chrome stable releases, the fixes will roll out to users over the coming days and weeks rather than all at once.

A cluster of memory-safety defects

The critical-severity list is dominated by classic memory-safety bugs. Google's advisory describes three buffer overflows in ANGLE and one in WebGL, two out-of-bounds writes in GPU and another in WebGL, plus use-after-free flaws in ServiceWorker, Fullscreen, WindowDialog, and AdFilter.

Those categories matter because they are the kinds of bugs attackers tend to favor. Buffer overflows and out-of-bounds writes can let a malicious page corrupt memory in ways that lead to code execution, while use-after-free defects can be triggered when a browser component frees an object and then keeps using it. Chrome's sandbox and site-isolation architecture are designed to blunt the impact of exactly these classes of bugs, but critical ratings still reflect the potential severity if a working exploit is developed.

Nine of the eleven critical issues were reported by external researchers, according to Google. That's a notable share coming from outside the company's own security team, and it reflects the outside research community's continued focus on Chrome's rendering and GPU layers.

External reports and the bounty tally

Of the 108 flaws patched in Chrome 154, 32 were reported externally. The remainder were found by Google's own engineers and security staff. Google said it paid $18,000 in bug bounty rewards to the reporting researchers so far, but it cautioned that the final figure could climb substantially because it has not yet settled the amounts owed for most of the externally reported bugs.

That gap is common in Chrome releases. Bounty determinations often lag the patch itself, especially when a single report covers multiple issues or when researchers request specific disclosure timing. The $18,000 figure therefore represents only the rewards Google has finalized at the time of the release announcement, not the full cost of the batch.

"Google says it handed out $18,000 in bug bounty rewards to the reporting researchers, but the final amount could be much higher, as the company has yet to determine the amounts to be paid for most of the externally reported bugs."

That language comes directly from the source coverage, which attributes the payout detail to Google's own release announcement. Google has not published a full breakdown of which researchers received which awards for this batch.

The high-severity tier

Below the critical bugs, 25 vulnerabilities were rated high severity. That group includes a dozen use-after-free defects along with multiple type confusion, uninitialized resource, and buffer overflow issues.

Google also resolved high-severity problems tied to missing authorization, UI misinterpretation, incorrect authorization, improper output encoding, race conditions, and an out-of-bounds write. Several of those categories — authorization and UI misinterpretation in particular — point to logic and interface flaws rather than pure memory corruption, which can be harder to catch with automated tooling alone.

The remaining bugs patched in Chrome 154 fall into medium- and low-severity buckets. Google groups those under authorization, input validation, UI misrepresentation, memory corruption, information leak, and memory safety headings. Individually they are lower risk, but collectively they represent the long tail of issues that accumulate in a browser as complex as Chrome.

No sign of active exploitation

Google makes no mention of any of the 108 vulnerabilities being exploited in the wild. That's a meaningful distinction: Chrome patches frequently include at least one bug that Google confirms has been used in real attacks, and those releases tend to carry sharper urgency. Chrome 154 does not appear to be one of them based on the advisory.

Even so, Google's standing guidance is to update browsers as soon as possible. Users who rely on Chrome's automatic update mechanism will receive the new build without action, but those who have disabled auto-updates or are running older builds may need to trigger a manual check. Enterprise administrators managing Chrome through policy should verify that the new version has propagated to their fleets.

Platform-specific rollout details

The version numbers differ slightly by platform, which is typical for Chrome releases. Windows and macOS users receive 154.0.8037.57/.58, while Linux users receive 154.0.8037.57. The dual version number on Windows and macOS reflects the fact that Google sometimes ships minor build variations within the same stable release.

Users can confirm their version by opening the browser's settings and navigating to the About Chrome page. If the update is available, that page will begin downloading it and prompt for a restart to complete installation.

Why the memory bugs keep coming

The critical list in Chrome 154 reads like a catalog of the bug classes that have long plagued browsers built primarily in C and C++. Buffer overflows, out-of-bounds writes, and use-after-free conditions all stem from manual memory management, where a single miscalculated pointer or a mistimed free can open a path to exploitation.

Google has invested heavily in mitigations for these categories, including sandboxing, site isolation, and its own memory-safety tooling. Those defenses reduce the likelihood that a memory corruption bug becomes a full compromise, but they do not eliminate the underlying flaws. The 11 critical bugs in this release — spread across ANGLE, WebGL, GPU, ServiceWorker, Fullscreen, WindowDialog, and AdFilter — show that the attack surface remains broad.

ANGLE and WebGL in particular sit close to graphics rendering, a layer that has drawn repeated researcher attention because of its complexity and its proximity to the GPU process. The three ANGLE buffer overflows and the WebGL out-of-bounds write and buffer overflow in this batch fit that pattern.

Where the fixes landed

Google's advisory organizes the patched bugs by severity rather than by component, so a full component-by-component map isn't available from the release notes alone. What is clear is that the fixes span browser internals well beyond the graphics stack, reaching into service worker handling, fullscreen behavior, dialog management, and ad filtering.

Rounding out the medium- and low-severity set, Google fixed issues related to input validation, information leaks, and general memory safety. Those lower-severity categories tend to be fixed quietly and rarely make headlines, but they make up the bulk of the 108 total.

What the release means for defenders

For most organizations, the practical takeaway is straightforward: verify that Chrome 154 has reached endpoints and that update policies haven't silently blocked it. Because none of the flaws are confirmed as exploited in the wild, the immediate pressure is lower than it would be for an actively attacked zero-day, but a large batch of critical memory-safety bugs is still worth closing quickly.

The unsettled bounty amounts also point to something worth watching. Google's final payouts for this batch will likely exceed the $18,000 disclosed so far, and the eventual totals offer one imperfect measure of how much external research value went into the release. For security teams, the more useful signal is the composition of the haul itself: a steady flow of critical memory-safety defects in a browser that has been hardened for years suggests that browser exploitation research remains a durable area of interest.

That is an inference, not a confirmed trend — the source article reports only this single release. But the concentration of critical bugs in graphics-adjacent components is consistent with where browser researchers have long focused their efforts, and it is a reminder that keeping browsers current remains one of the least glamorous and most effective things an organization can do.