Chrome 148 update patches 79 vulnerabilities, including 14 critical-severity bugs such as a heap buffer overflow in WebML (CVE-2026-8509) and an integer overflow in Skia (CVE-2026-8510). Other critical fixes include eight use-after-free vulnerabilities in components like UI, FileSystem, and Blink, an insufficient validation flaw in DataTransfer, an object lifecycle issue in WebShare, an integer overflow in ANGLE, and a race condition in Payments. Additionally, 37 high-severity bugs were fixed. Google paid significant bug bounties for these issues and has not reported any active exploitation. The update is rolling out for Linux, Windows, and macOS.

The vulnerabilities patched in Chrome 148 include critical use-after-free, heap buffer overflow, integer overflow, and other memory corruption bugs that could potentially allow remote code execution or other severe impacts if exploited. However, there are no reports of these vulnerabilities being exploited in the wild at this time. The update mitigates risks across multiple browser components, enhancing overall security.

Users and administrators should apply the Chrome 148 update (version 148.0.7778.167/168) promptly to benefit from the official fixes addressing these critical and high-severity vulnerabilities. Since this is a client-side application, updating the browser is the primary and effective mitigation. No additional vendor advisories indicate alternative or temporary mitigations.