Chrome 154 fixes a critical WebGL flaw and ten more
Google reports no active exploitation, but the update rolls out in waves. One flaw was found by an Anthropic researcher with help from Claude.
Anyone who uses Chrome on a computer should open Settings > About Chrome and check that the version is 154.0.8037.97 or later. Google released that Stable channel build on October 1 with 11 security fixes, according to Chrome Releases, the browser's official blog. The patch exists, but the company warns it will reach users "over the coming days/weeks".
The version is 154.0.8037.97 or .98 for Windows and Mac, and 154.0.8037.97 for Linux. The browser downloads it on its own and applies it on restart. Chrome Releases covers desktop only: it does not confirm a version for Android or iOS.
The critical flaw is CVE-2026-103628, an out-of-bounds write in WebGL. That interface lets the browser draw 3D graphics. The advisory lists it as reported by Google on August 21, 2026. The other ten are nine rated high and one medium, in components such as V8, Skia, WebRTC, SVG and FedCM.
What Google does not say
Google's advisory gives no numeric score and does not say whether attacks are under way. SecurityOnline, a specialist outlet that covered the update on October 2, cites a CVSS score of 9.6 for the WebGL flaw. It says the bug would allow code to run outside the sandbox, the isolation that contains each tab, through a crafted page. It also says there is no confirmed exploitation and no entry for the flaw in CISA's catalog. Those three points come only from SecurityOnline and were not checked against the NVD.
Google keeps the technical details closed on purpose: access to the reports "may be kept restricted" until most users have the fix. That is why the advisory gives only the component, the type of error and the severity, and why this article does not describe how to exploit any of the flaws.
A find made with Claude's help
Among the high-severity flaws, CVE-2026-103631 is a buffer overflow in WebRTC, the technology behind video calls in the browser. Chrome Releases credits it to Xinyang Ge, of Anthropic, "assisted by Claude", with a report date of September 28.
Edge, Opera and other browsers built on Chromium, Chrome's engine, ship their own versions separately and almost always later. None of the sources consulted mentions releases for that group yet.
