Google Releases Chrome 154/155 with 108 Security Fixes Including 11 Critical CVEs
What Happened – Google rolled out Chrome 154 (desktop) and Chrome 155 (Android) in September 2026. The desktop update brings 108 security fixes, 11 of them rated Critical, including CVE‑2026‑95350, CVE‑2026‑95281, and CVE‑2026‑95357. The Android release is an early‑stable rollout with additional stability and performance improvements.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous patch‑management control that tracks, validates, and records timely remediation of critical browser vulnerabilities.
- Provides a concrete example of why organizations must collect defensible evidence of patch status to satisfy audit requirements across multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Highlights the role of Verisq’s Control Mapping capability in automating evidence collection and mapping remediation actions to the underlying control objective.
Who Is Affected – All enterprise users of Google Chrome across industries (technology, finance, healthcare, retail, etc.).
Recommended Actions
- Enable automatic Chrome updates on all endpoints and enforce the policy via endpoint‑management tools.
- Verify that the critical CVEs are patched by scanning browsers with a vulnerability‑assessment tool.
- Capture and retain patch‑status logs as audit evidence; map the remediation to the “Patch Management & Vulnerability Remediation” control objective in your control‑assurance program.
Technical Notes – The critical flaws are buffer‑overflow and out‑of‑bounds write bugs in Chrome’s ANGLE graphics‑translation layer and GPU component. A crafted malicious webpage could trigger memory‑safety violations, potentially leading to browser compromise or arbitrary code execution. Source: Malwarebytes Labs