Google Chrome Stable Update Fixes Eight High-Severity Memory Safety Vulnerabilities

What happened

Google released a Stable Channel update for Chrome on desktop that fixes eight separate vulnerabilities. These include use-after-free flaws in the Updater, AdFilter, Views, and ServiceWorker components; an out-of-bounds write issue in WebGL, GPU, and ANGLE; and a free-of-non-heap-memory issue in Fonts. Each was assigned its own CVE identifier (CVE-2026-95347, CVE-2026-95311, CVE-2026-95329, CVE-2026-95357, CVE-2026-95310, CVE-2026-95277, CVE-2026-95339, and CVE-2026-95331). All were resolved in the same release.

Technical cause

The vulnerabilities fall into a few memory-safety categories. Use-after-free conditions (CWE-416) affect the Updater (CVE-2026-95347), AdFilter (CVE-2026-95310), Views (CVE-2026-95277), and ServiceWorker (CVE-2026-95339) components, where memory is accessed after it has already been freed. Out-of-bounds write issues (CWE-787) affect WebGL (CVE-2026-95329), GPU (CVE-2026-95357), and ANGLE (CVE-2026-95331), where data can be written outside the bounds of an allocated buffer. A separate free-of-non-heap-memory issue (CWE-590) affects Fonts (CVE-2026-95311). In several cases the vendor description notes that exploitation would require a crafted HTML page or, for the Updater issue, crafted network traffic, and in most cases some form of user interaction or social engineering.

Why it matters

Several of these issues carry a Chromium-assigned severity of Critical (WebGL, GPU, AdFilter, ServiceWorker), meaning Google's own engineering team judged that successful exploitation could potentially allow an attacker to execute arbitrary code outside Chrome's sandbox. Others are rated High (Views) or Medium (Updater, Fonts, ANGLE). All eight affect a widely used browser and were scored by NVD with a CVSS base score of 9.6, reflecting the potential impact of a successful exploit, though most require a user to visit a crafted web page or, for the Updater flaw, be affected by a network traffic scenario.

Who is affected

Users running Google Chrome on desktop prior to version 154.0.8037.57 are affected. The vendor advisory specifically notes the Updater issue (CVE-2026-95347) affects Chrome on Mac, and the WebGL (CVE-2026-95329) and GPU (CVE-2026-95357) issues affect Chrome on Android. The remaining vulnerabilities are described generally for Google Chrome without a specific platform qualifier in the available text.

Affected versions

All eight vulnerabilities affect Google Chrome versions prior to 154.0.8037.57. No earlier affected version range was specified in the available data.

Fixes and mitigation

Google has fixed all eight vulnerabilities in Google Chrome version 154.0.8037.57, distributed through the Stable Channel update for desktop. No workarounds or mitigations other than updating were described in the available information.

Recommended action

Update Google Chrome to version 154.0.8037.57 or later as soon as possible. Chrome typically updates automatically, but users and administrators should verify the installed version via the browser's "About Chrome" menu and restart the browser to apply the update.