Google Chrome 148 fixes 127 flaws, including critical Blink and use-after-free bugs

Google has released Chrome 148 to the stable channel for Windows, macOS, Linux, and Android, patching 127 security vulnerabilities in one of the browser’s largest security update batches. The release fixes three Critical flaws: CVE-2026-7896, an integer overflow in Blink that could lead to heap corruption via a crafted HTML page, plus CVE-2026-7897 and CVE-2026-7898, two use-after-free bugs affecting Mobile and Chromoting. Google said no active exploitation had been reported at release, but urged users to update to 148.0.7778.96/97 immediately; Canada’s cyber agency also advised administrators to apply the update for affected desktop versions prior to those builds.

The advisory also covers more than two dozen high-severity issues across major Chromium components including V8, ANGLE, WebRTC, GPU, Skia, UI, DevTools, Printing, Audio, ChromeDriver, and AdFilter, many involving memory-safety errors such as use-after-free, type confusion, out-of-bounds access, and insufficient validation of untrusted input. Public CVE records tied to the release include CVE-2026-7987, CVE-2026-7988, CVE-2026-7991, CVE-2026-7992, CVE-2026-7995, CVE-2026-8000, CVE-2026-8001, CVE-2026-8002, CVE-2026-8016, and CVE-2026-8018, several of which could enable code execution inside Chrome’s sandbox or, in some cases, potential sandbox escape. Google credited internal testing tools such as fuzzers and sanitizers along with external researchers, paid at least $138,000 in bug bounties, and withheld details for some issues until most users receive fixes; because the bugs affect Chromium, downstream browsers and enterprise Chromium deployments may also need corresponding updates.