Chrome 154 Stable Ships With 108 Security Fixes

Google promoted Chrome 154 to the stable channel for Windows, macOS and Linux on September 22, 2026. The initial desktop stable builds are 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and macOS, with Google saying the rollout will continue over the coming days and weeks.

The security side of this release is unusually substantial: Google lists 108 security fixes in the Chrome 154 desktop update. The public advisory identifies 11 critical-severity vulnerabilities, including buffer overflows, out-of-bounds writes and use-after-free bugs across graphics and browser components.

Seven of the 11 critical issues Google lists are in ANGLE, GPU or WebGL. ANGLE is the graphics translation layer used by Chromium, while WebGL exposes web graphics APIs and the GPU process isolates graphics work from the main browser process. That concentration makes the update relevant even to users who do not think of Chrome as a graphics-heavy application: modern web pages routinely use hardware-accelerated rendering paths.

The remaining critical entries cover ServiceWorker, Fullscreen, WindowDialog and AdFilter. Google is withholding some bug details while the update reaches more users, a standard Chrome security practice intended to reduce the usefulness of vulnerability details before most installations are patched.

Below the critical group, Google lists high-severity issues across Extensions, SecurityIndicators, Navigation, Aura, Browser, Chromecast, GPU, Tint, DevTools, Platform, Views, Bluetooth, HID, PDFium, Video, Bindings, IndexedDB, WebAudio and V8. The V8 entries include a race condition, an out-of-bounds write and a type-confusion flaw.

The headline count should not be read as 108 equally severe or independently exploitable browser takeovers. Chrome’s release post spans critical, high, medium and low severities, and Google keeps details for some issues restricted during rollout. The defensible takeaway is that Chrome 154 closes a broad set of security defects, not that every listed fix carries the same practical risk.

Chrome normally updates itself, but users can open Chrome’s About page to trigger an update check and confirm the installed version after the browser restarts. Because Google is rolling Chrome 154 out over days and weeks, the stable build may not appear on every machine at the same moment.

For managed PCs, browser deployment policy may control when the new stable build arrives. The release announcement establishes the fixed versions and vulnerability list; it does not establish that bypassing an organization’s update policy is appropriate. Administrators should use their normal managed-browser update process and verify the deployed version rather than assuming every endpoint updated automatically.