Chrome Releases: Stable Channel Update for Desktop

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2026-102330Google Chrome: Incorrect Authorization
• CVE-2026-102310Google Chrome: Missing Authorization
• CVE-2026-102320Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page
• CVE-2026-102329Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page
• CVE-2026-102312UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page
• CVE-2026-102317Google Chrome: Improper Privilege Management
• CVE-2026-102306Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page
• CVE-2026-102299Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
• CVE-2026-102323Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
• CVE-2026-102326Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
• CVE-2026-102316Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page
• CVE-2026-102304Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
• CVE-2026-102309Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
• CVE-2026-102308Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page
• CVE-2026-102301Google Chrome: Out-of-bounds Write
• CVE-2026-102324Google Chrome: Use After Free
• CVE-2026-102302Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
• CVE-2026-102321Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
• CVE-2026-102331Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page
• CVE-2026-102327Google Chrome: Incorrect Authorization
• CVE-2026-102328Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
• CVE-2026-102313Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
• CVE-2026-102307Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
• CVE-2026-102311Google Chrome: Use of Uninitialized Resource
• CVE-2026-102319Google Chrome: Use of Uninitialized Resource
• CVE-2026-102318Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
• CVE-2026-102315Google Chrome: Use of Uninitialized Resource
• CVE-2026-102314UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page
• CVE-2026-102303Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
• CVE-2026-102300Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
• CVE-2026-102325Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
• CVE-2026-102305UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page

Source and provenance

Original title: Chrome Releases: Stable Channel Update for Desktop. Captured 29 Sept 2026, 20:25 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.