Google Releases Chrome 154 with 108 Security Fixes Including 11 Critical Vulnerabilities
Google has released Chrome 154 on September 22, 2026, delivering 108 security fixes that resolve vulnerabilities across the browser's core components.
The update ships as version 154.0.8037.58 and 154.0.8037.57 for Windows and macOS, and 154.0.8037.57 for Linux. Eleven vulnerabilities are classified as Critical, the highest severity rating.
Critical issues include buffer overflows in ANGLE tracked as CVE-2026-95350, CVE-2026-95281, and CVE-2026-95284, plus out-of-bounds writes in the GPU component under CVE-2026-95357 and CVE-2026-95322.
Additional Critical fixes address Use-After-Free conditions in ServiceWorker, Fullscreen, WindowDialog, AdFilter, and WebGL, along with memory corruption problems such as CVE-2026-95349 and CVE-2026-95329.
Twenty-five High severity vulnerabilities were also patched. These cover authorization bypasses in extensions, incorrect user-interface rendering in SecurityIndicators, race conditions, out-of-bounds writes, and type confusion in the V8 JavaScript engine.
Further Medium (47) and Low (25) severity issues were resolved in components including PDFium and WebAudio. The complete list of addressed CVEs spans from CVE-2026-95274 through CVE-2026-95385.
Google plans to distribute the update gradually over the next several days to weeks.
Related articles
Why Traditional Vulnerability Scanners Fail in Kubernetes and Cloud Environments
Traditional vulnerability management approaches break down when applied to containers and cloud infrastructure because containers are ephemeral, internal networks are invisible from the outside, and misconfigurations can be introduced at build time. The article highlights the 2018 Tesla Kubernetes incident where an exposed dashboard allowed cryptomining via stolen AWS credentials without any code vulnerabilities. Container security tools are required to scan images during build, enforce policies at deployment, and monitor runtime behavior, unlike classic scanners that only examine running workloads. Key configuration risks include privileged pods, missing NetworkPolicy objects, and overly broad RBAC roles such as cluster-admin. Supply chain protections like Sigstore image signing and SBOM generation are presented as essential for preventing compromised base images and hidden dependencies. Cloud environments add shared responsibility models, dynamic scaling challenges, and regulatory constraints that further limit the effectiveness of legacy VM tools. Specialized platforms such as CNAPP solutions are recommended alongside Russian domestic tools like PT Container Security and Kaspersky Container Security.
Google Releases Chrome 156 Fixing 353 Vulnerabilities Including Six Critical Issues
Google has released Chrome 156 for Windows, macOS, and Linux, addressing a total of 353 vulnerabilities tracked via CVE identifiers. Six of these flaws received the highest Critical severity rating, primarily involving memory corruption in components such as Skia, Accessibility, CSS, Paint, and WebRTC. One additional Critical issue is a Use-After-Free vulnerability in Accessibility reported by Anthropic researcher Xinyang Ge with assistance from Claude. Sixty-one High severity vulnerabilities were also fixed across V8, ANGLE, WebRTC and other modules, covering memory corruption, use-after-free conditions, and input validation problems. The update further resolves 197 Medium and 89 Low severity issues. Patches are being deployed gradually over the coming days and weeks to all supported platforms.
Multiple Critical Vulnerabilities Found in PHP, Fixes Scheduled for October 21
The PHP security team has confirmed two serious vulnerabilities in the PHP scripting language. Both issues received a CVSSv4.0 base score of 9.2, placing them in the Critical severity category. The team announced the upcoming security update on October 20, 2026, and plans to release the patched versions at 14:00 UTC on October 21, which corresponds to 23:00 Japan time. Specific technical details, affected components, and vulnerable versions remain undisclosed until the patches are published. The team urges administrators to prepare for immediate updates once the fixes become available. Earlier release is possible if vulnerability details leak or active exploitation is detected.
Mozilla Releases Firefox 158.0.1 Security Update Fixing High-Severity Vulnerabilities and Compromised Certificates
Mozilla Foundation has published Firefox 158.0.1 on October 20, 2026, delivering fixes for four CVEs rated at high overall severity. Two vulnerabilities received a High rating, including a boundary condition flaw in the SVG component tracked as CVE-2026-113399 and a certificate blocklist issue identified as CVE-2026-113470. The update also refreshes the OneCRL list to block an intermediate certificate from eMudhra that was compromised earlier in the month. Mozilla delivered the updated blocklist via RemoteSettings on October 17 and embedded the changes directly into the browser release. This approach ensures compromised certificates remain blocked even when RemoteSettings is disabled or network access is unavailable. One Moderate and one Low severity issue complete the set of addressed flaws.