Ungoogled Chromium Ships Chromium 154's 108 Security Fixes
The Google-free browser gets the latest Chromium security updates, and the privacy trade-offs stay put.
Ungoogled-chromium 154.0.8037.57-1 is out. It carries forward one of the more stubborn ideas in mainstream browsing: you can run essentially the same browser billions of people use daily while cutting nearly every back channel to Google's servers.
The new build rides on Chromium 154.0.8037.57. That's the point release Google pushed to its stable channel on September 22, and it ships with 108 security fixes. Not a typo. It's one of the biggest single-patch counts Google has ever managed, and it includes a healthy number of Critical flaws touching the GPU, the graphics stack, and memory handling.
What the project actually removes
Here's the part most people get wrong. Ungoogled-chromium isn't a fork with its own flair. It doesn't add features or push an ideology. It takes stock Chromium and excises Google dependencies, then quietly tacks on privacy tweaks that all sit off by default until you flip them on.
The maintainers list three goals, in descending order of importance. Remove the dependency on Google web services first. Keep the default Chromium feel as close as possible second. Add transparency tweaks third, though those need manual activation.
The clever bit is a technique called domain substitution. Rather than hunting down every source line that mentions a Google domain, the project just rewrites them wholesale. Any known Google web domain gets swapped for something ending in a made-up top-level domain, qjz9zk. Since that domain never resolves, no request can get through even if a single patch slips.
And that's the design. Spot a qjz9zk notification? That's an alarm bell. It means some unpatched code path tried to reach Google and got caught mid-request. The project deliberately leaves sensitive lists like the HSTS preload list alone, though, so basic browsing doesn't collapse.
This release itself went out via GitHub automation and was committed by the project's main maintainer, Ahrotahn. The commits carry a verified GPG signature. In a project where trust rests on reproducible binaries, that detail's worth more than it might seem at first glance.
The trade-offs you'll hit
Ungoogled-chromium trades convenience for control, and it says so plainly.
Safe Browsing is off by default because it phones home to Google to pull threat lists. The project nudges you toward something like uBlock Origin instead. Cookies and site data clear on exit, which is fine for privacy but means you'll have to enable a setting to stay logged in anywhere. WebRTC is limited by default, protecting your real IP behind a VPN but potentially breaking some web apps. And the Chrome Webstore won't install extensions through the normal interface anymore.
None of it is accidental. Privacy here is earned through configuration, not handed out like candy.
However, at the same time, that 108-fix update lands at exactly the right moment. With Safe Browsing disabled, you've lost Google's active threat detection, so up-to-date engine patching becomes far more important. Chromium brings its full security posture along, and 108 fixes is a serious pile of armor.
For what it's worth, Google isn't exactly sharing the details either. The standard play is to hold back write-ups until most users have patched, which keeps threat actors from weaponizing a bug while the install base trails. Earlier this month Chrome shipped 42 fixes, then 16 more, and now this 108-fix behemoth. If you're keeping score, Google's in a full sprint.
Several of the fixes carry real bounties. There's a $5,000 payout for an ANGLE buffer overflow, plus another $5,000 for missing authorization in extensions and one for a UI misrepresentation in security indicators. A broad spread of High-severity issues hit the V8 engine, GPU, Bluetooth, PDFium, and WebAudio.
How to get it
If you want to try it, the project runs through most of the usual channels. Linux users can hit the AUR, Debian's OBS, Ubuntu's XtraDeb PPA, Fedora's COPR, Gentoo, or openSUSE. Cross-platform folks are covered by Flatpak, Guix, and NixOS.
Head here to the GitHub release page.
