Google Chrome 154 Stable Fixes Thirty-Two Security Vulnerabilities
Tech GuruQuick Answer
Google's September 29, 2026 Chrome Stable desktop release contains 32 security fixes. The listed builds are 154.0.8037.92 or 154.0.8037.93 for Windows/macOS and 154.0.8037.92 for Linux. Both Windows/macOS builds are listed releases; the notice does not say that .92 remains vulnerable merely because .93 is also offered.
Confirm Scope And Apply The Supported Fix
What to do now: update through the supported channel for the endpoint, save browser work and relaunch to activate the new version. On managed machines, check update policy and rollout failures rather than treating an assigned deployment as proof that every running browser changed.
Last verified: October 2, 2026 UTC against Google's release post and update documentation. No browser was tested.
Scope And Authority
| Product scope | Google Chrome Stable for Windows, macOS, and Linux |
|---|---|
| Advisory | Chrome 154 Stable Desktop 2026-09-29 |
| CVEs | CVE-2026-102299, CVE-2026-102300, CVE-2026-102301, CVE-2026-102302, CVE-2026-102303, CVE-2026-102304, CVE-2026-102305, CVE-2026-102306, CVE-2026-102307, CVE-2026-102308, CVE-2026-102309, CVE-2026-102310, CVE-2026-102311, CVE-2026-102312, CVE-2026-102313, CVE-2026-102314, CVE-2026-102315, CVE-2026-102316, CVE-2026-102317, CVE-2026-102318, CVE-2026-102319, CVE-2026-102320, CVE-2026-102321, CVE-2026-102323, CVE-2026-102324, CVE-2026-102325, CVE-2026-102326, CVE-2026-102327, CVE-2026-102328, CVE-2026-102329, CVE-2026-102330, CVE-2026-102331 |
| Authoritative release date | 2026-09-29 18:38:51.470 UTC |
| Authority revision date | 2026-09-29 18:38:51.470 UTC |
| Affected versions | Earlier Chrome Stable desktop builds requiring this update. Google lists 154.0.8037.92/.93 for Windows/macOS and 154.0.8037.92 for Linux; it does not identify .92 as vulnerable on Windows/macOS. |
| Fixed version | Windows/macOS: 154.0.8037.92 or 154.0.8037.93; Linux: 154.0.8037.92. Use the current supported channel rather than pinning permanently to this historical release. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Critical to Low |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The release includes Critical CVE-2026-102331 in ANGLE and High-severity memory, privilege and UI defects across components including V8, Mojo and Omnibox. Not every authorization issue is High: Google rates the listed CORS issue Medium and the Payments, WebView and SiteIsolation authorization issues Low. Bug-detail restrictions are not evidence of exploitation.
What To Validate Now
- Identify the channel and endpoint. Record Chrome desktop version and OS, keeping Android, ChromeOS, Chromium derivatives and other channels outside this specific release mapping.
- Use the documented update path. Open More > Help > About Google Chrome to view the version and update state, following Google's update instructions. Linux updates use the package manager; managed fleets use their approved deployment process.
- Relaunch after saving work. Use Relaunch when offered. Incognito windows will not reopen, so preserve needed work first. A pending restart is not the same as a running fixed browser.
- Read back and test. Reopen About to confirm the running version, then test required SSO, browser extensions and ordinary work sites. Do not disable sandboxing or other protections as a compatibility workaround.
- Track coverage. Retain endpoint/version and workflow results, with unsupported or policy-held machines explicitly unresolved. The advisory does not establish that any particular endpoint was exploited.
Operational Cautions
Keep a controlled path for application regressions without silently downgrading to a vulnerable browser. A later supported Stable security release may supersede these builds. Browser update success does not validate all extensions or prove absence of earlier compromise.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
