High

Google Chrome has released version 148 to the stable channel for Windows, Mac, and Linux, marking one of its most security-heavy updates in recent years. The new release, version 148.0.7778.96 for Linux and 148.0.7778.96/97 for Windows and Mac, patches a massive 127 security vulnerabilities. Among these fixes are three Critical-severity flaws, more than two dozen High-severity issues, and numerous Medium and Low-severity vulnerabilities. Google also awarded over $100,000 in bug bounty payments to external security researchers, highlighting the scale and importance of the security work behind this release.

The most severe vulnerabilities addressed include CVE-2026-7896, a Critical integer overflow flaw in Chrome’s Blink rendering engine that could potentially be exploited for arbitrary code execution. Two additional Critical use-after-free vulnerabilities, CVE-2026-7897 and CVE-2026-7898, affect Chrome’s Mobile component and Chromoting (Chrome Remote Desktop). These memory corruption issues are especially dangerous because attackers can exploit freed memory regions to execute malicious code, often through specially crafted web content or remote interactions. Such vulnerabilities represent significant risk for users who delay applying browser updates.

Several High-severity flaws were also patched, particularly within Chrome’s V8 JavaScript engine and ANGLE graphics layer. CVE-2026-7899, an out-of-bounds read/write vulnerability in V8, earned the highest individual bug bounty reward of $55,000 due to its serious exploitation potential. Additional issues include heap buffer overflow and use-after-free vulnerabilities in ANGLE (CVE-2026-7900 and CVE-2026-7901), along with CVE-2026-7902, another dangerous memory access flaw in V8. Beyond these, Google resolved multiple use-after-free vulnerabilities across core browser components such as SVG, DOM, GPU, WebRTC, Skia, Password Manager, ServiceWorker, PresentationAPI, and WebAudio, significantly reducing the browser’s attack surface.

The update also fixes Medium and Low-severity issues, including type confusion in WebRTC, object lifecycle problems in V8, and insufficient policy enforcement in DevTools, Extensions, and DirectSockets. A notable Low-severity flaw, CVE-2026-8022, could allow cross-origin data leakage through crafted MHTML pages if users perform specific UI interactions. Google credited security researchers, while emphasizing that many vulnerabilities were detected through advanced automated fuzzing tools such as AddressSanitizer, libFuzzer, and AFL. Users are strongly advised to update immediately through Chrome’s built-in update mechanism, as these fixes address vulnerabilities that could otherwise expose systems to drive-by attacks and remote code execution risks.