Chrome 148 Update Patches 151 Vulnerabilities

Chrome 148 update resolves 151 vulnerabilities, including 22 critical-severity flaws. The highest severity issues include CVE-2026-9872, an out-of-bounds write in GPU, and CVE-2026-9873, a use-after-free weakness in Network, each rewarded with $43,000. Additional critical defects include CVE-2026-9874 in Dawn, CVE-2026-9875 in WebGL, and CVE-2026-9876 in WebGL. Most critical vulnerabilities are use-after-free memory safety bugs that could allow remote code execution, escape the Chrome sandbox, and compromise systems. The update also fixes 123 high-severity and six medium-severity issues, with use-after-free, insufficient validation of untrusted input, and out-of-bounds problems predominating. Google reports paying over $130,000 for 10 externally reported flaws, and more amounts may be disclosed later. Many issues are marked as reported by Google, and the rise in resolved vulnerabilities is linked to increased discovery activity and AI use, alongside reduced bug bounties.

"Google this week released a fresh Chrome 148 update that resolves 151 vulnerabilities, including 22 critical-severity flaws. Based on the paid bug bounties, the most severe of the resolved bugs are CVE-2026-9872 (out-of-bounds write issue in GPU) and CVE-2026-9873 (use-after-free weakness in Network), each earning the reporting researchers a $43,000 reward."

"Three other critical security defects were also reported by external researchers: CVE-2026-9874 (use-after-free in Dawn), CVE-2026-9875 (out-of-bounds read in WebGL), and CVE-2026-9876 (use-after-free in WebGL). Most of the critical-severity vulnerabilities patched with the latest Chrome update are use-after-free bugs. This type of memory safety issues could allow attackers to achieve remote code execution and to escape Chrome's sandbox and potentially compromise the entire system."

"The Chrome refresh also addresses 123 high-severity weaknesses and six medium-severity defects. Use-after-free bugs dominate the list, followed by insufficient validation of untrusted input and out-of-bounds issues. The internet giant says it has paid over $130,000 in bug bounty rewards for 10 security flaws reported by external researchers. The final amount could be much higher, as Google has yet to disclose the amounts paid for several other vulnerabilities."

"Most of the security weaknesses resolved with the latest browser update were discovered by Google themselves, a common occurrence in recent Chrome refreshes. Starting in late March, the number of vulnerabilities resolved with each update has increased significantly, with over 350 issues addressed in Chrome 148 alone, this update included. With most of the flaws marked as “reported by Google,” the surge in vulnerability discoveries is likely driven by AI use, which also determined the company to lower Chrome bug bounties last month."

Read at SecurityWeek