Google Chrome 154.0.8037.97 fixes 11 security issues, including a critical WebGL flaw

What's fixed in this release

Google's release notes confirm 11 security fixes in this build. Two have been disclosed with specifics: CVE-2026-103628, a critical out-of-bounds write vulnerability in WebGL, and CVE-2026-103626, a high-severity incorrect authorization issue in the FileSystem component. Both were reported internally by Google, on August 21 and August 26, 2026 respectively. As is standard practice, Google is withholding details on the remaining fixes until most users have updated, and may keep restrictions longer where a fix depends on a third-party library shared with other projects.

Why it matters for your stack

An out-of-bounds write in WebGL is a serious class of memory-safety bug that can potentially be leveraged for code execution simply by visiting a malicious or compromised web page, since WebGL content runs automatically in many sites. The FileSystem authorization issue could allow unintended access to data that should otherwise be restricted. Any product embedding Chromium, or any environment where users browse the open web, should treat this update as a priority rather than routine maintenance.

How to update

Chrome updates automatically in the background on most systems; a full restart of the browser applies the new version immediately. You can also trigger the check manually via Settings > About Chrome, which will download and prompt for a restart if an update is pending. For managed fleets, IT teams should confirm that enterprise policies aren't delaying rollout, given the critical-severity fix included here.