CERT-In has rated a set of Google Chrome desktop vulnerabilities critical and advised users to apply the relevant updates. The Indian agency's notice, issued on 6 October, covers Windows, Mac and Linux. Checking only the browser's major version number is insufficient because the warning identifies particular builds within Chrome 154.
For Windows and Mac, advisory CIVN-2026-0490 lists affected versions as those before 154.0.8037.97/.98. For Linux, it lists versions before 154.0.8037.97. These are the advisory's fixed-version thresholds, not a claim that those builds are the newest versions available when a reader checks for updates.
What the October advisory covers
The notice lists 11 vulnerability identifiers, from CVE-2026-103621 through CVE-2026-103631. Affected components include Compositing, WebGL, FileSystem, V8, Skia and WebRTC. CERT-In says a crafted web request could lead to arbitrary code execution, information disclosure, a security-restriction bypass or denial of service. It does not report an Indian breach, a victim count or observed exploitation.
Two Chrome-supplied records in the US National Vulnerability Database give more specific descriptions. CVE-2026-103621 concerns an integer overflow in Compositing before 154.0.8037.97. The record says specially crafted HTML could allow cross-origin data to leak. It was published on 2 October and modified on 5 October, before CERT-In issued its warning.
The record for CVE-2026-103631 describes a WebRTC buffer overflow before the same build. It says crafted HTML could permit code execution inside the sandbox. That qualification matters: the record does not establish that this flaw alone takes over the entire computer. Its publication date is 2 October, with a modification dated 6 October.
Chromium rates each of these two individual vulnerabilities high. CERT-In's critical classification applies to its combined desktop advisory; the labels describe different scopes and should not be substituted for one another.
Dalimss News' earlier September Chrome warning covered CIVN-2026-0474 and a different patch threshold. Installing the build discussed in that older article does not establish that the October requirements have been met. The notice number and full installed version are more useful checks than remembering that Chrome was updated recently.
Check About Chrome and finish the restart
Google's official update instructions direct desktop users to the menu, Help and About Google Chrome. The page displays the full version and checks for an update. If a download is ready, the Relaunch control applies it. A downloaded update waiting for restart is not the same as an update already running.
Google says Chrome normally updates in the background when it is closed and reopened. Postponing the restart leaves the update waiting. Browser tabs and windows reopen after relaunch, but Incognito windows do not. Users should account for that difference before restarting an active session rather than assuming every window will return.
On Linux, Google points users to their package manager. Its supported-platform requirements list macOS 13 Ventura or later for Mac, Windows 10 or later for Intel-based Windows machines, and Windows 11 or later for ARM-based Windows machines. Those are Chrome's requirements; they do not establish the operating-system vendor's own security-support status.
When the update check fails
Google's update troubleshooting page distinguishes updates disabled by an administrator from an unavailable update server, a check that cannot start and a failed download. These messages describe different problems. If computer permissions prevent an update, Google directs the user to the administrator rather than treating the restriction as proof that Chrome is current.
The troubleshooting guidance also says restarting the computer can finish an incomplete update. Older platforms, including Windows 7, Windows 8, Windows 8.1, macOS 11 and macOS 12, are outside the listed support requirements. An installation unable to obtain a current browser build needs its platform compatibility checked as well as the immediate error message.
This warning is specifically about desktop Chrome on the three named operating systems. It should not be applied to Chromebook operating-system updates or used as an Android security-patch date. Dalimss News' separate October Android advisory report explains that other check. For this notice, users should return to About Chrome after the update and restart, then compare the full displayed build with the relevant desktop threshold.
