Qutzl LLC LogoQutzl

Advertisement

5 min read

Chrome 154.0.8037.97 security update: Critical WebGL fix, install and verify

Google's October 1, 2026 Stable desktop update ships Chrome 154.0.8037.97/.98 with 11 security fixes, including Critical CVE-2026-103628 (out-of-bounds write in WebGL). Android is 154.0.8037.126. Update, relaunch, confirm chrome://version.

By Michael NarehoodSoftware & Releases

If Chrome is your daily browser, you are not done just because you already jumped to Chrome 154 last week. Google shipped another Stable security package on October 1, 2026, and this one includes a Critical WebGL bug.

This is a newer build than our 154.0.8037.92 mid-cycle note. Same major version train. Different version number. Different CVE list. Update again.

What Google shipped

Google’s Stable Channel Update for Desktop (Thursday, October 1, 2026) updated Stable to:

  • Windows / Mac: 154.0.8037.97 or 154.0.8037.98
  • Linux: 154.0.8037.97

The same note says the rollout takes days or weeks, and counts 11 security fixes.

The top item is Critical CVE-2026-103628: an out of bounds write in WebGL. Google reported it internally. NVD’s summary for that CVE (linked from the GitHub advisory database entry for CVE-2026-103628) describes a remote attacker being able to execute arbitrary code outside the sandbox via a crafted HTML page. That is the kind of browser bug you do not leave parked on “Later.”

The October 1 desktop notice also lists High issues across FileSystem, Compositing, FedCM, V8, Contextual Tasks, Skia, SVG, MediaStream, and WebRTC, plus a Medium SVG information leak. You do not need to memorize the IDs. You need the new process running.

The same day, Google released Chrome 154.0.8037.126 for Android through Google Play. Android Stable notes say Android gets the same security fixes as the matching desktop package unless Google says otherwise.

Why .92 is not enough anymore

If chrome://version still shows 154.0.8037.92 or .93, you are on last week’s security package, not this one. The Critical ANGLE fix from September 29 mattered. This Critical WebGL fix is a separate reason to move again.

Same habit every time:

  1. Update
  2. Fully quit and relaunch
  3. Prove it with chrome://version

Downloaded is not running. The address bar is the receipt.

How to update and verify on a home PC or Mac

  1. Open Google Chrome on the computer you actually browse on.
  2. Check for updates:
    • Windows / Linux: Menu (three dots) → Help → About Google Chrome.
    • Mac: Chrome menu → About Google Chrome.
  3. Stay on that page until the download finishes and Chrome offers a relaunch, or until it already shows 154.0.8037.97 or .98 (Linux: .97).
  4. Relaunch when prompted. Do not click Later and leave old windows open for hours.
  5. If the version still looks old, fully quit Chrome (every window). On Windows, confirm no leftover chrome.exe in Task Manager. On Mac, use Chrome → Quit Google Chrome. Open Chrome again.
  6. Type chrome://version in the address bar. You want 154.0.8037.97 or 154.0.8037.98 (Linux: .97).
  7. Repeat on other machines you use, including the laptop that sleeps with Chrome still open and any shared family PC.

If About Chrome says an update is coming but does not offer .97/.98 yet, give Stable a day, then check again. Google stages these.

Android Chrome (Google Play), separately

If you browse in Chrome on an Android phone or tablet:

  1. Open the Google Play store (or your Play updates list).
  2. Update Chrome to 154.0.8037.126 when it appears. Google said it would roll out over the next few days after the October 1 note.
  3. Open Chrome once after the update so the new build actually launches.

A desktop update does not patch your phone. An Android update does not patch your PC. iOS Chrome follows the App Store on its own schedule.

Do this / don’t do that

Do

  • Force About Google Chrome, relaunch, and confirm chrome://version shows .97 or .98 (Linux .97).
  • Update Android Chrome from Google Play to 154.0.8037.126 if that is how you browse on the phone.
  • Update each Chromium browser you actually use (Edge, Brave, and so on) on its own schedule. Updating Chrome does not update them.
  • Treat a Critical WebGL bug as “install today,” not “install when I remember on Sunday.”

Don’t

  • Do not stop at .92/.93 because you already “did the Chrome 154 update.”
  • Do not leave old Chrome windows or background helpers running after an update prompt.
  • Do not skip the version check because the About page looked green for a second.
  • Do not confuse this package with the Chrome 154 Stable promotion from September 22. That was the major jump. This is a later security bump on the same train.

Bottom line

Google’s October 1, 2026 Stable update ships Chrome 154.0.8037.97/.98 (Linux .97) with 11 security fixes, including Critical CVE-2026-103628 (out of bounds write in WebGL) (official Stable Channel Update). Android Chrome 154.0.8037.126 carries the matching security set (Android note). This is beyond the earlier .92 package. On your own computer: update, fully quit and relaunch, confirm chrome://version. That is the whole job.

Image: Google Chrome marketing homepage art (google.com/chrome).

Advertisement