Loading story…
Google released Chrome 154 for Windows, macOS, and Linux, fixing 108 vulnerabilities, including 11 critical memory-safety defects that malicious web content could potentially exploit for crashes, information disclosure, or attacker-controlled code execution. The critical issues include buffer overflows, out-of-bounds writes, and use-after-free conditions in ANGLE, WebGL, GPU components, ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Updated builds are rolling out as 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and macOS.
The release also addresses browser-boundary and data-exposure weaknesses affecting V8, WebGPU, CORS, credential previews, extensions, DevTools, WebView, WebNFC, DRM capture controls, Android WebAPKs, and the macOS updater. Notable fixes prevent cross-origin GPU shader and framebuffer-memory disclosure, a CORS preflight-cache bypass that could enable blind CSRF-style state changes, cross-domain username leakage from grouped credentials, extension isolated-world boundary breaches, DevTools privilege escalation, and a Qualcomm GPU-driver-triggered write crash. Organizations should expedite Chrome updates across managed endpoints and ensure separately deployed Google Updater components are current on macOS.
See real exploitation activity before you spend the cycle.
30 events from the most recent confirmed update back to the earliest known activity.
Google accepted and fixed the macOS updater issue by deferring DataPipeDrainer deletion to the execution sequence instead of destroying it inside the active client callback.
NH DEV reported that Chrome's preflight cache used the raw request initiator instead of the tainted request's serialized origin, allowing a preflight approved for Origin: null to potentially authorize a later credentialed state-changing request.
Chrome launched password suggestions based on grouped affiliations, the feature later found to expose username previews for weakly affiliated cross-domain credentials.
Project Fortify reported that WebNFC permission handling could associate an opaque-origin document with its visible URL, potentially permitting a compromised renderer to reuse an existing WebNFC grant for a victim origin.
Qualcomm fixed the underlying Adreno graphics-driver flaw behind the Chrome Android mutable-3D-texture out-of-bounds write issue before July 21.
An anonymous reporter filed a Chrome Android issue showing that valid WebGL/OpenGL ES calls increasing a mutable 3D texture's depth could trigger a SIGSEGV write in the privileged GPU process through a Qualcomm Adreno driver.
A streamed-download change introduced a use-after-free condition in the macOS Google Updater fallback stream reader when destination-file write failures caused its active DataPipeDrainer to be destroyed during a callback.
The experimental Flapjack security project reported that DesktopCaptureAccessHandler failed to record the true captured surface, potentially allowing an extension with desktopCapture permission to record DRM-protected screen or window content.
A report identified that a sideloaded app spoofing the retired Maps Lite WebAPK package could potentially claim arbitrary origins and receive delegated web-push notification objects, including sensitive notification content.
Project Fortify reported that a compromised chrome-untrusted://lens renderer could use powerful WebView APIs to create spoofed HTTP(S)-origin content, bypass Private Network Access or CORS protections for local endpoints, and execute fresh-session script under arbitrary HTTPS origins.
Google released Chrome 154 for Windows, macOS, and Linux, addressing 108 vulnerabilities including critical memory-safety flaws in ANGLE, WebGL, GPU components, and browser features. The rollout versions were 154.0.8037.57 for Linux and 154.0.8037.57/.58 for Windows and macOS.
Google registered CVEs including CVE-2026-95275, CVE-2026-95290, CVE-2026-95300, CVE-2026-95302, CVE-2026-95312, CVE-2026-95332, CVE-2026-95342, CVE-2026-95347, CVE-2026-95353, CVE-2026-95357, CVE-2026-95359, CVE-2026-95374, and CVE-2026-95375, and set their vulnerability release-note targets to Chrome M154.
The Chrome Vulnerability Rewards Program panel concluded that the macOS Google Updater use-after-free report did not qualify for a reward because it found no clear exploitation path.
The Chrome Vulnerability Reward Program awarded the anonymous reporter $2,500 for the Qualcomm GPU vulnerability report.
V8 extended its security-token filtering to all 19 CallSitePrototype getters and WebAssembly frames, returning filtered values for incompatible realms.
Chromium committed checks preventing remotely loaded DevTools frontends from invoking privileged operations such as browser restart, Chrome-flag changes, file-system actions, port forwarding, and device updates.
Google marked the Qualcomm-driven Chrome Android GPU out-of-bounds write vulnerability fixed after driver remediation and Chrome/ANGLE mitigations were available.
V8 patched CallSite getFunction(), getThis(), and getFunctionName() to reject values from incompatible security-token contexts, preventing untrusted Error.prepareStackTrace handlers from obtaining trusted functions.
Chromium rolled the fixed ANGLE revision containing the mutable-3D-texture mitigation into chromium/src for the Qualcomm GPU issue.
Chromium added opaque-origin checks in NFCHost and NfcPermissionContext to deny WebNFC binding and permissions to sandboxed or otherwise opaque-origin documents.
Chromium removed the deprecated Maps Lite allowlist from WebApkValidator, preventing sideloaded apps from abusing the unauthenticated package-validation path for notification delegation.
V8 changed FastIterateArray to preserve iteration state in DirectHandle objects and handle scopes across callbacks that can trigger compacting garbage collection, addressing a potential stale-pointer use-after-free.
Chromium banned loadDataWithBaseUrl, executeScript, and other high-risk WebView APIs for chrome-untrusted pages, closing the Lens WebUI origin-spoofing and PNA-bypass path.
Chromium changed Region Capture APIs to keep separate ScriptPromiseResolvers for each caller ScriptState, preventing webpages from receiving Promises and objects created in an extension isolated world.
ANGLE merged a workaround that recreates mutable 3D textures and copies their existing levels when glTexImage3D increases texture depth, mitigating the Qualcomm driver issue.
Dawn changed the SPIR-V handling of subgroupBroadcast so an out-of-range subgroup ID returns an indeterminate value rather than potentially returning register data to JavaScript.
Chromium passed the resolved DesktopMediaID into capture setup and invoked UpdateTarget(), ensuring full-screen and window captures are correctly tracked for output-protection decisions.
Chromium added texture sample-count and layer fields to framebuffer-completeness cache signatures, preventing incomplete framebuffers from inheriting a cached complete status and potentially exposing uncleared GPU memory.
Chromium committed a fix using an opaque origin as the cache key for tainted requests, preventing tainted Origin: null preflight entries from being reused by untainted requests.
Chromium removed username previews for grouped credentials after determining that the suggested-password popup could send a cross-domain credential's full username to the renderer before user confirmation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
16 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcenessus.org
Open sourcecrbug.com
Open sourcecrbug.com
Open sourcecrbug.com
Open sourcecrbug.com
Open sourcecrbug.com
Open sourcecrbug.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome 153 to the Stable channel, fixing 42 security vulnerabilities, including three **Critical** memory-safety flaws: use-after-free vulnerabilities in Internals (`CVE-2026-91721`) and Workers (`CVE-2026-91749`), plus an out-of-bounds read in WebGL (`CVE-2026-91726`). The update also addresses 27 High-severity issues affecting components including V8, ServiceWorker, Core, Extensions, Skia, ANGLE, PDF, WebPackaging, and Input. High-severity use-after-free bugs include `CVE-2026-87639` in WebPackaging, reported by amyb of OpenAI Codex Security, and `CVE-2026-87542` in Input, reported by BigSleep@Grape. Google has not reported active exploitation of any of the fixed vulnerabilities and withheld technical exploit details. Organizations should deploy Chrome `153.0.8010.47/.48` on Windows and macOS or `153.0.8010.47` on Linux, confirm managed endpoints have completed the update and restarted the browser, and investigate devices delayed by update policies or incomplete rollout.
Sep 18, 2026
Google released Chrome 152.0.7977.75/.76 for Windows and macOS and 152.0.7977.75 for Linux, patching 26 vulnerabilities. The fixes include critical use-after-free flaws in Shared Tab Groups (`CVE-2026-84353`) and WebGL (`CVE-2026-84352`), which could allow malicious web content to crash the browser, disclose information, or potentially execute code in the browser process. The release also addresses nine high-severity issues and additional flaws affecting FileSystem, Skia, Omnibox, V8, GPU, WebRTC, Downloads, and TabStrip, including risks of code execution and security-control bypass. Google has not reported active exploitation; organizations should verify managed endpoints update to Chrome 152.0.7977.75 or later as the Stable-channel rollout progresses.
Sep 5, 2026
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026