Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities
Google has released Chrome 154 on September 22, 2026, delivering 108 security fixes that resolve vulnerabilities across the browser's core components.
The update ships as version 154.0.8037.58 and 154.0.8037.57 for Windows and macOS, and 154.0.8037.57 for Linux. Eleven vulnerabilities are classified as Critical, the highest severity rating.
Critical issues include buffer overflows in ANGLE tracked as CVE-2026-95350, CVE-2026-95281, and CVE-2026-95284, plus out-of-bounds writes in the GPU component under CVE-2026-95357 and CVE-2026-95322.
Additional Critical fixes address Use-After-Free conditions in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL, along with memory corruption problems such as CVE-2026-95349 and CVE-2026-95329.
Twenty-five High severity vulnerabilities were also patched. These cover authorization bypasses in extensions, incorrect user-interface rendering in SecurityIndicators, race conditions, out-of-bounds writes, and type confusion in the V8 JavaScript engine.
Further Medium (47) and Low (25) severity issues were resolved in components including PDFium and WebAudio. The complete list of addressed CVEs spans from CVE-2026-95274 through CVE-2026-95385.
Google plans to distribute the update gradually over the next several days to weeks.
Related articles
GitLab Releases Security Updates Fixing 11 Vulnerabilities Including Two Critical Flaws
GitLab has issued critical security updates for its development platform to address 11 vulnerabilities across Community Edition and Enterprise Edition. The patches cover versions 19.4.1, 19.3.3, and 19.2.7 and were released on September 23, 2026. Two vulnerabilities rated Critical allow authenticated users to achieve arbitrary code execution on the server. CVE-2026-89078 involves a double-free issue in CI/CD configuration parsing triggered by crafted regular expressions, while CVE-2026-93577 is an integer overflow in the regular expression compiler. Additional High-severity issues include cross-site scripting in merge request diffs and unauthorized access to sensitive CI/CD variables via the Duo AI job troubleshooting feature. The update also resolves five Medium and two Low severity flaws.
WordPress Patches Critical Core Vulnerability CVE-2026-87902 Affecting All Versions from 4.7.0
WordPress has released patches for a critical vulnerability in the platform's core code, tracked as CVE-2026-87902 with a CVSS score of 9.2. The flaw impacts every version from 4.7.0 through 7.1.1, meaning virtually all unpatched installations remain exposed. Because the issue resides in the base system rather than plugins or themes, even sites without any extensions installed are at risk. The vulnerability allows an unauthenticated attacker to load arbitrary PHP files from outside theme directories, which can lead to remote code execution on certain server configurations. The bug was privately reported in July by researcher Robert Ressl through HackerOne and disclosed publicly on 22 September, with no confirmed exploitation observed so far. Administrators are urged to apply the updates immediately and keep automatic updates enabled.
Critical Microsoft SharePoint Vulnerability Allows Remote Code Execution via SafeControls Bypass
A vulnerability tracked as CVE-2026-65660 with a CVSS score of 8.8 affects Microsoft SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition. The flaw permits an authenticated low-privileged attacker to achieve arbitrary code execution on on-premises servers. It stems from improper handling of quotes in attacker-controlled Register directives within the ToolPane component, bypassing the SafeControls mechanism. This allows registration of dangerous .NET classes followed by deserialization-based remote code execution. Microsoft released patches on August 11, 2026, and initially reported no public disclosure or exploitation. Publication of a detailed technical analysis has now increased the risk for unpatched installations.
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Google is developing a queued restart capability for Chrome that lets the browser install updates after detecting user inactivity instead of forcing an immediate closure. The feature, tracked under the queued-restarts theme in Chromium code, offers users the choice to restart right away or wait for roughly five minutes of idle time. Chrome will automatically skip the restart if the browser is downloading files, playing audio or video, recording the screen, or using the camera. Notifications and a menu indicator labeled Scheduled Restart will inform users of the planned update, while additional reminders may appear when opening new tabs. The implementation currently lacks the ability to select a precise restart time like Windows Update and remains limited to the absence of activity. Google has previously committed to reducing the annoyance of mandatory browser restarts for security patches, though the feature has not yet reached the stable channel.