Chrome 148 Security Update: 127 Vulnerabilities Fixed and CVE List

Chrome 148 Security Vulnerability Summary Vulnerability Overview The stable update for Chrome 148.0.7778.96 includes 127 security fixes covering high-severity vulnerabilities such as integer overflows, out-of-bounds reads/writes, use-after-free, type confusion, use-of-uninitialized-value, and permission bypasses. Scope of Impact Platforms: Windows, Mac, Linux Severity Levels: Critical, High, Medium, Low Primary Components: Blink, V8, ANGLE, Skia, GPU, ServiceWorker, DevTools, WebRTC, Media, DOM, Fullscreen, Aura, Ink, Passwords, Dawn, PresentationAPI, Cookie, CSS, Downloads, WebCodecs, Popup Blocker, Speech, Network, COOP, Omnibox, Shared Storage, Navigation, Media, ServiceWorker, Navigation, Speech, Permissions, DirectSockets, WebUI, FileSystem, DevTools, Site Isolation, Navigation, CORS, TopChrome, Orb, GPU, Dawn, Blink, Views, Canvas, Companion, Media, WebAudio, Codecs, Dawn, Reading Mode, GPU, Autofill, WebRTC, DataTransfer, Updater, UI, Payments, Chromium, Ad Filter, SSL, UI, Dialog, Pinning, Audio, Tab Groups, DevTools, DevTools, Cast, Site Isolation, Search, MHTML, Favicon, Preload, Media, WebRTC, Media, DevTools, Web App, GPU, UI, MHTML Remediation All vulnerabilities have been fixed in the Chrome 148.0.7778.96 version. Users are advised to update to the latest version immediately. Some vulnerabilities were reported by external researchers (e.g., KAIST Hacking Lab, Tencent Security Xuanwu Lab, National Yang Ming Chiao Tung University, etc.). Key Vulnerability Examples CVE-2026-7896: Blink integer overflow (Critical) CVE-2026-7897: V8 use-after-free (Critical) CVE-2026-7898: Chromium use-after-free (Critical) CVE-2026-7899: V8 out-of-bounds read/write (High) CVE-2026-7900: ANGLE heap overflow (High) CVE-2026-7901: ANGLE use-after-free (High) CVE-2026-7902: V8 out-of-bounds memory access (High) CVE-2026-7903: ANGLE integer overflow (High) CVE-2026-7904: Fonts out-of-bounds read (High) CVE-2026-7905: Media unvalidated input (High) CVE-2026-7906: SVG use-after-free (High) CVE-2026-7907: DOM use-after-free (High) CVE-2026-7908: Fullscreen use-after-free (High) CVE-2026-7909: ServiceWorker improper implementation (High) CVE-2026-7910: Views use-after-free (High) CVE-2026-7911: Aura use-after-free (High) CVE-2026-7912: GPU integer overflow (High) CVE-2026-7913: DevTools insufficient policy enforcement (High) CVE-2026-7914: Accessibility type confusion (High) CVE-2026-7915: DevTools insufficient data validation (High) CVE-2026-7916: Interest Groups insufficient data validation (High) CVE-2026-7917: Fullscreen use-after-free (High) CVE-2026-7918: GPU use-after-free (High) CVE-2026-7919: Aura use-after-free (High) CVE-2026-7920: Skia use-after-free (High) CVE-2026-7921: Passwords use-after-free (High) CVE-2026-7922: ServiceWorker use-after-free (High) CVE-2026-7923: Skia out-of-bounds write (High) CVE-2026-7924: Dawn use-of-uninitialized-value (High) CVE-2026-7925: Chromium use-after-free (High) CVE-2026-7926: PresentationAPI use-after-free (High) CVE-2026-7927: Runtime type confusion (High) CVE-2026-7928: WebRTC use-after-free (High) CVE-2026-7929: Media Recording use-after-free (High) CVE-2026-7930: Cookies unvalidated input (Medium) CVE-2026-7931: CSS unvalidated input (Medium) CVE-2026-7932: Downloads insufficient policy enforcement (Medium) CVE-2026-7933: WebCodecs out-of-bounds read/write (Medium) CVE-2026-7934: Popup Blocker unvalidated input (Medium) CVE-2026-7935: Speech improper implementation (Medium) CVE-2026-7936: V8 object lifetime issues (Medium) CVE-2026-7937: DevTools insufficient policy enforcement (Medium) CVE-2026-7938: CSS use-after-free (Medium) CVE-2026-7939: SanitizerAPI improper implementation (Medium) CVE-2026-7940: V8 use-after-free (Medium) CVE-2026-7941: Mobile unvalidated input (Medium) CVE-2026-7942: ANGLE integer overflow (Medium) CVE-2026-7943: ANGLE unvalidated input (Medium) CVE-2026-7944: Persistent Cache unvalidated input (Medium) CVE-2026-7945: COOP unvalidated input (Medium) CVE-2026-7946: WebUI insufficient policy enforcement (Medium) CVE-2026-7947: Network unvalidated input (Medium) CVE-2026-7948: Chromium race condition (Medium) CVE-2026-7949: Skia out-of-bounds read (Medium) CVE-2026-7950: GFX out-of-bounds read/write (Medium) CVE-2026-7951: WebRTC out-of-bounds write (Medium) CVE-2026-7952: Extensions insufficient policy enforcement (Medium) CVE-2026-7953: Omnibox unvalidated input (Medium) CVE-2026-7954: Shared Storage race condition (Medium) CVE-2026-7955: GPU use-of-uninitialized-value (Medium) CVE-2026-7956: Navigation use-after-free (Medium) CVE-2026-7957: Media out-of-bounds read (Medium) CVE-2026-7958: ServiceWorker improper implementation (Medium) CVE-2026-7959: Navigation improper implementation (Medium) CVE-2026-7960: Speech race condition (Medium) CVE-2026-7961: Permissions unvalidated input (Medium) CVE-2026-7962: DirectSockets insufficient policy enforcement (Medium) CVE-2026-7963: ServiceWorker improper implementation (Medium) CVE-2026-7964: FileSystem

Goal Reached Thanks to every supporter — we hit 100%!

Chrome 148 Security Update: 127 Vulnerabilities Fixed and CVE List