# Multiple Vulnerabilities in Google Chrome Patched in Stable Channel Update 154.0.8037.57 (GovCERT.HK A26-09-37)

> Google's Chrome 154 Stable Channel Update (154.0.8037.57/.58) fixes 108 security vulnerabilities, including 11 Critical memory-corruption bugs in ANGLE, WebGL, the GPU process, and ServiceWorker/Fullscreen/WindowDialog/AdFilter, plus 25 High-severity flaws. GovCERT.HK's Security Alert A26-09-37 warns that a remote attacker could exploit these issues via a crafted web page to achieve remote code execution, denial of service, or tampering; no in-the-wild exploitation or public PoC has been reported, and none of the affected CVEs currently appear in CISA's KEV catalog.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2662
- **ID:** TL-2026-2662
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-95274 to CVE-2026-95376, CVE-2026-95380 to CVE-2026-95382, CVE-2026-95384 to CVE-2026-95385, CVE-2026-95304, CVE-2026-95306, CVE-2026-95350

## Description

On 2026-09-22, Google shipped a Chrome Stable Channel Update for Desktop bringing Chrome to version 154.0.8037.57 on Linux and 154.0.8037.57/.58 on Windows and macOS. The release addresses 108 security vulnerabilities: 11 rated Critical, 25 rated High, 47 rated Medium, and 25 rated Low. Google's own security team found 76 of the 108 issues internally; the remaining 32 were reported by external researchers, who collectively received $18,000 in bug-bounty payouts. Chrome for Android (154.0.8037.57) and Chrome for iOS (154.0.8037.55) received the same fixes within the same release window.

The 11 Critical-rated bugs are concentrated in Chrome's graphics and process-isolation stack: three buffer overflows in ANGLE (Chrome's cross-platform graphics abstraction layer, including CVE-2026-95350, credited to a STAR Labs SG Pte. Ltd. team of Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng for a $5,000 bounty), a buffer overflow and an out-of-bounds write in WebGL, two out-of-bounds writes in the GPU process (one, CVE-2026-95357, paid a $2,500 bounty), and four use-after-free bugs spanning ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Among the 25 High-severity fixes are an out-of-bounds write (CVE-2026-95304) and a type-confusion bug (CVE-2026-95306) in the V8 JavaScript engine; CVE-2026-95306 was credited to 'OpenAI Codex Security,' a notable early example of an AI-assisted vulnerability-research effort receiving public credit in a Chrome security bulletin.

GovCERT.HK (Hong Kong's Government Computer Emergency Response Team) published Security Alert A26-09-37 on 2026-09-23, summarizing the update and warning that 'a remote attacker could entice a user to open a web page with specially crafted content on a vulnerable browser to exploit the vulnerabilities,' with potential impact of remote code execution, denial of service, or tampering. The advisory lists the affected CVEs as three ranges (CVE-2026-95274 to CVE-2026-95376, CVE-2026-95380 to CVE-2026-95382, CVE-2026-95384 to CVE-2026-95385) rather than a fully enumerated list, and does not assign a CVSS score or classify the alert as a 'High Threat' bulletin. Google's practice of withholding technical bug details until a majority of the installed base has updated means most individual CVEs in this batch are not yet indexed in NVD. As of this research, none of the CVE-2026-953xx range appears in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exploit code has surfaced; this distinguishes the batch from the unrelated, earlier V8 type-confusion zero-day (CVE-2026-85046, fixed in Chrome 152.0.7977.82/.83 and added to CISA KEV on 2026-09-04), which is a separate, already-patched issue from a prior release and is not part of this advisory.

Because Chromium is the shared upstream for Chrome, Chromium-based third-party browsers (Microsoft Edge, Brave, Opera, Vivaldi) and forks (Ungoogled Chromium, which shipped a matching 154.0.8037.57-1 build) inherit the same vulnerable ANGLE/WebGL/GPU/V8/ServiceWorker code paths and require their own vendor updates to receive equivalent fixes.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1587.004 Exploits
- T1204.001 Malicious Link
- T1203 Exploitation for Client Execution
- T1211 Exploitation for Stealth
- T1499.004 Application or System Exploitation
- T1608.004 Drive-by Target

## Sources

- [Security Alert (A26-09-37): Multiple Vulnerabilities in Google Chrome](https://www.govcert.gov.hk/en/alerts_detail.php?id=2079)
- [Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html)
- [Update Chrome: 108 security fixes for desktop, new release for Android](https://www.malwarebytes.com/blog/bugs/2026/09/update-chrome-108-security-fixes-for-desktop-new-release-for-android)
- [Chrome 154 fixes 108 security flaws, including 11 critical bugs](https://www.pcworld.com/article/3242182/chrome-154-fixes-108-security-flaws-including-11-critical-bugs.html)
- [Chrome Patches 108 Vulnerabilities Including Critical Flaws that Enable Code Execution Attacks](https://cybersecuritynews.com/chrome-patches-108-vulnerabilities/)
- [Chrome 154 Patches 108 Vulnerabilities](https://www.securityweek.com/chrome-154-patches-108-vulnerabilities/)
- [Chrome 154 Release Patches 108 Security Vulnerabilities](https://securityonline.info/chrome-154-security-vulnerabilities/)
- [Chrome 154: 108 Patches, 11 Critical GPU and V8 Flaws](https://byteiota.com/chrome-154-security-update/)
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2662