Loading story…
Google released Chrome Stable 154.0.8037.92/.93 for Windows and macOS and 154.0.8037.92 for Linux, remediating 32 security vulnerabilities. The most severe issue, CVE-2026-102331, is a critical buffer overflow in ANGLE that can corrupt memory and potentially enable code execution in Chrome’s browser context.
The update also fixes 26 high-severity issues, including V8 type-confusion and buffer-overflow flaws potentially reachable through malicious webpages, along with use-after-free, out-of-bounds, and uninitialized-resource bugs. Affected components include GPU, WebGPU, Mojo, Bluetooth, Passwords, WebUI, CORS, Payments, WebView, and SiteIsolation. Google is restricting some technical details until adoption increases; it reported no active exploitation and advised users to update and relaunch Chrome promptly.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Researcher @mfx reported CVE-2026-102331, a critical buffer-overflow vulnerability in Chrome's ANGLE component, to Google.
Google released Chrome Stable 154.0.8037.92/.93 for Windows and macOS and 154.0.8037.92 for Linux, remediating 32 security vulnerabilities. The fixes include critical ANGLE buffer overflow CVE-2026-102331 and 26 high-severity issues affecting V8, GPU, WebGPU, Mojo, Bluetooth, WebUI, Passwords, and other components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome 154 for Windows, macOS, and Linux, fixing **108 vulnerabilities**, including 11 critical memory-safety defects that malicious web content could potentially exploit for crashes, information disclosure, or attacker-controlled code execution. The critical issues include buffer overflows, out-of-bounds writes, and use-after-free conditions in ANGLE, WebGL, GPU components, ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Updated builds are rolling out as `154.0.8037.57` for Linux and `154.0.8037.57/.58` for Windows and macOS. The release also addresses browser-boundary and data-exposure weaknesses affecting V8, WebGPU, CORS, credential previews, extensions, DevTools, WebView, WebNFC, DRM capture controls, Android WebAPKs, and the macOS updater. Notable fixes prevent cross-origin GPU shader and framebuffer-memory disclosure, a CORS preflight-cache bypass that could enable blind CSRF-style state changes, cross-domain username leakage from grouped credentials, extension isolated-world boundary breaches, DevTools privilege escalation, and a Qualcomm GPU-driver-triggered write crash. Organizations should expedite Chrome updates across managed endpoints and ensure separately deployed Google Updater components are current on macOS.
Sep 29, 2026
Google released Chrome 151 to fix **41 newly identified vulnerabilities** affecting the browser on Windows, macOS, and Linux, including **six critical flaws** and **35 high-severity issues**. The patched bugs include five **use-after-free** vulnerabilities in **WebGL, Aura, Skia, and Views**, as well as an **out-of-bounds write** in the **ANGLE** graphics engine. Google said the update is rolling out as versions **`151.0.7922.108/.109`** for Windows and macOS and **`151.0.7922.108`** for Linux. The vulnerabilities could lead to **arbitrary code execution, information disclosure, privilege escalation, security restriction bypass, denial of service, crashes, and data corruption**, with more than two dozen tied to memory-safety weaknesses. Google did not report active exploitation in the wild, but users and organizations were urged to update systems running versions prior to the patched releases as soon as possible.
Aug 7, 2026
Google released Chrome 153 to the Stable channel, fixing 42 security vulnerabilities, including three **Critical** memory-safety flaws: use-after-free vulnerabilities in Internals (`CVE-2026-91721`) and Workers (`CVE-2026-91749`), plus an out-of-bounds read in WebGL (`CVE-2026-91726`). The update also addresses 27 High-severity issues affecting components including V8, ServiceWorker, Core, Extensions, Skia, ANGLE, PDF, WebPackaging, and Input. High-severity use-after-free bugs include `CVE-2026-87639` in WebPackaging, reported by amyb of OpenAI Codex Security, and `CVE-2026-87542` in Input, reported by BigSleep@Grape. Google has not reported active exploitation of any of the fixed vulnerabilities and withheld technical exploit details. Organizations should deploy Chrome `153.0.8010.47/.48` on Windows and macOS or `153.0.8010.47` on Linux, confirm managed endpoints have completed the update and restarted the browser, and investigate devices delayed by update policies or incomplete rollout.
Sep 18, 2026