Advisories
Google Issues Emergency Chrome Desktop Update Addressing 108 Security Flaws
Google has rolled out Chrome version 154 for desktop platforms, patching 108 security vulnerabilities, including 11 critical severity bugs. SecOps and system administrators should immediately enforce browser updates across all Windows, macOS, and Linux endpoints. Concurrently, an early stable rollout of Chrome 155 is underway for Android devices.
What happened
Google has issued an out-of-cycle Stable Channel update for desktop environments, bumping Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and macOS. This release patches a massive batch of 108 distinct security vulnerabilities, with 11 categorized as critical. Additionally, an early stable build (version 155.0.8059.16) is beginning a staged rollout for Android users, featuring early performance patches and stability enhancements.
Impact
Among the addressed issues is CVE-2026-95350, a critical buffer overflow vulnerability residing in ANGLE, which serves as Chrome's graphics-translation layer. Because the browser processes untrusted web content directly, memory safety flaws in rendering and translation components like ANGLE expose endpoints to severe risks. If exploited via a specially crafted malicious webpage, attackers can trigger memory corruption, force browser crashes, or potentially achieve arbitrary code execution within the context of the application.
What to do
Defenders and system administrators must ensure that all enterprise endpoints running Google Chrome are updated immediately to mitigate active exposure windows. While automatic updates will apply the patches over the coming days, relying solely on background triggers can leave long-running instances vulnerable due to pending relaunch requirements.
- Force a manual check for updates by navigating to the browser settings menu, selecting Help, and opening 'About Google Chrome'.
- Ensure endpoints fully restart the browser application to apply version 154.0.8037.57 (Linux) or 154.0.8037.58 (Windows/macOS).
- Monitor software deployment pipelines and endpoint management tools to flag any stale browser instances hindered by extensions or blocked processes.
- Keep watch for the wide release of Chrome 155 on Android devices via Google Play to ensure mobile endpoints remain current.
Related vulnerabilities
Chrome 155.0.8059.79/80 Update Addresses 37 Vulnerabilities, 7 Critical
Google released Chrome 155.0.8059.79/80 on Oct 13‑14, patching 37 security flaws including seven rated Critical. The update fixes code‑execution vulnerabilities that could be triggered by malicious web pages. Defenders should apply the update immediately on Windows, macOS, Linux, and Android devices.
Read briefing
Critical Cisco Hardening Release: ASA, FTD, FMC Patch Internal Exploits
Cisco’s security team has rolled out a hardening update for its Secure Firewall Adaptive Security Appliance, Threat Defense, and Management Center software, addressing a suite of internally discovered flaws. Eight CVEs (CVE‑2026‑20329 through CVE‑2026‑20336) cover issues ranging from static credential exposure to authentication bypass, with two vulnerabilities already being actively exploited. No workarounds exist; customers must install the patches promptly to mitigate the critical risk.
Read briefing
Google Chrome Faces 20+ CVEs – Update Now to Patch Critical Vulnerabilities
The French CERT has issued an urgent alert after discovering a bundle of 20+ CVEs in Google Chrome that can be exploited to trigger unspecified security failures. Affected are all Chrome releases older than 153.0.8010.47 on Linux and Windows, and 153.0.8010.48 on macOS. The vulnerabilities were disclosed in a Google release on 15 September 2026. Immediate upgrade to the latest stable channel is mandatory to close the gaps.
Read briefing
Microsoft Patch Tuesday: 972 CVEs, 113 Critical, 2 Zero‑Day Exploits – Immediate Patching Urgently Needed
Microsoft’s September 2026 Patch Tuesday saw a massive rollout of 972 security fixes, including 113 critical issues and two zero‑day vulnerabilities that have already been leveraged by threat actors. The patches cover a broad range of products, from Windows Server and Office to Azure services. The most dangerous flaws affect remote desktop, SMB, and kernel components, enabling remote code execution and privilege escalation. Organizations must apply the updates without delay, verify integrity, and monitor for suspicious activity. Failure to patch exposes systems to active exploitation and could
Read briefing