Abstract:
Google has officially pushed the Google Chrome 154 major version update to Windows, macOS and Linux platforms. This update focuses on fixing up to 108 security vulnerabilities, including 11 "critical" flaws with the highest risk level, involving security risks in graphics processing, rendering engines and core components.
The official security bulletin shows that a large number of vulnerabilities fixed this time are concentrated in the fields of memory security and memory corruption, including Buffer Overflow, Out-of-bounds Write, Use-After-Free and other types of vulnerabilities that are common in vulnerability exploit chains. Among the 11 serious vulnerabilities, some are located in the graphics conversion layer ANGLE (such as CVE-2026-95350), WebGL rendering module and GPU processing components. Hackers can trigger the above-mentioned memory corruption vulnerability by inducing users to visit carefully constructed malicious web pages, thereby breaking through the browser sandbox isolation and executing arbitrary malicious code on the victim device or causing the browser to crash. In addition, high-risk vulnerabilities in system components such as ServiceWorker, Fullscreen mode (Fullscreen), pop-up dialog box (WindowDialog), and ad filtering (AdFilter) have also been patched in this version.
Of the 108 security vulnerabilities fixed this time, 32 were reported by external independent security researchers. Google has issued a basic vulnerability bounty reward of US$18,000 for this purpose. As subsequent evaluations progress, the final reward amount is expected to increase significantly. The remaining vulnerabilities were discovered during routine audits by Google's internal security team and automated testing tools. In addition to serious flaws, the new version also fixes 25 high-risk vulnerabilities, covering type confusion issues in the V8 JavaScript engine and extension permission verification flaws.
Currently, Google has not received any reports of the above vulnerabilities being exploited by hackers in the wild. However, in order to prevent threat actors from reverse engineering attacks on the vulnerabilities after the technical details are released, the official has set access restrictions on the technical documents of specific flaws. The latest Chrome 154 version is being pushed to users around the world in the form of a full update. The Windows and macOS version numbers have been upgraded to 154.0.8037.57/.58, and the Linux version number has been upgraded to 154.0.8037.57. Network security experts recommend that individual users and corporate IT administrators complete the upgrade as soon as possible to prevent potential network unauthorized access and code execution risks.
Comments