Google Chrome 148 Update: 79 Security Flaws Fixed – What You Need to Know

Google recently released Chrome version 148.0.7778.167/168 for Windows and macOS, and 148.0.7778.167 for Linux, along with updates for Android and iOS. This update patches a staggering 79 security vulnerabilities, with 14 critical flaws. Importantly, none of these vulnerabilities are known to be actively exploited in the wild. The update also reflects Google's increasing reliance on AI-driven vulnerability detection and a push toward memory-safe programming languages. Below, we answer key questions about this significant security patch.

What specific versions of Chrome were released in this update?

For desktops, Google released Chrome version 148.0.7778.167/168 for Windows and macOS, and 148.0.7778.167 for Linux. The Extended Stable Channel for Windows and macOS also received an update to Chromium version 148.0.7778.168. Mobile users weren't left out: Chrome for Android version 148.0.7778.167 and Chrome for iOS version 148.0.7778.166 were released this week. The Android version addresses the same vulnerabilities as the desktop versions, ensuring cross-platform protection. As always, updates roll out automatically, but users can check manually via Help → About Google Chrome. The next milestone, Chrome 149, is expected in early June.

How many vulnerabilities were fixed, and who discovered them?

A total of 79 vulnerabilities were patched. Google's internal security teams discovered 59 of these—a number that AI models specializing in vulnerability detection helped identify. The remaining 20 flaws were reported by external security researchers from the bug bounty community. Google has so far paid out $112,000 in bounties for these externally reported vulnerabilities. The significant increase in total vulnerabilities found compared to previous updates is largely attributed to Google's use of AI-driven scanning tools. This proactive approach helps catch issues before they can be exploited, though as noted, none are currently being actively used in attacks.

What are the critical vulnerabilities, and why are use-after-free flaws dangerous?

Fourteen of the 79 vulnerabilities are classified as critical (CVE-2026-8509 through CVE-2026-8522). An additional 37 are rated high risk, with the remaining as medium risk. A notable pattern is the dominance of use-after-free (UAF) vulnerabilities: 8 UAF flaws are critical, and 24 total UAF flaws exist in this update. UAF vulnerabilities occur when a program continues to access memory that has been freed up, often leading to crashes or, more dangerously, arbitrary code execution. These are common in C and C++ because manual memory management is error-prone. Are these vulnerabilities exploitable? While none are currently exploited, UAFs are attractive targets for attackers. Google is increasingly moving to memory-safe languages like Rust to reduce such flaws—a strategy Mozilla has also adopted, though they still contend with millions of lines of legacy C code.

Are any of these vulnerabilities being exploited in the wild?

According to Google, none of the 79 vulnerabilities patched in Chrome 148 are currently being exploited in the wild. This is a reassuring sign, as it means users have time to update before attackers can weaponize these flaws. However, the lack of active exploitation does not diminish the urgency of updating. Cybercriminals often reverse-engineer patches to create exploits, so applying the update promptly is critical. For users who want to double-check their status, Chrome updates automatically by default, but you can also trigger a manual check via the browser menu. Remember that staying up-to-date is your first line of defense against potential attacks using these newly disclosed vulnerabilities.

How does Chrome update itself, and how can users manually check?

Chrome typically updates automatically in the background whenever a new version is available, with no user intervention required. To manually force an update, open Chrome and navigate to Help → About Google Chrome. This will trigger a check for updates and install any pending version. After installation, you may need to restart the browser. The current stable version is 148.0.7778.167/168 (or the relevant version for your platform). Looking ahead, Chrome version 149 is expected in early June, likely with additional security improvements. For users concerned about privacy and security beyond browser updates, consider augmenting your defenses with additional tools—see our tips below.

What additional security measures should users consider?

While keeping Chrome up-to-date is essential, it's not the only step you should take. To maintain overall PC security and privacy, consider using reliable antivirus software. We have curated picks for the best antivirus solutions for Windows that offer real-time protection against malware and exploits. Additionally, a VPN service can encrypt your internet traffic, protecting you from snooping and man-in-the-middle attacks—especially on public Wi-Fi. Combining a secure browser, proactive updates, antivirus, and a VPN creates a robust defense against the ever-evolving threat landscape. Remember: no single tool is a silver bullet, but a layered approach significantly reduces your risk.