Chrome’s Memory-Safety Hot Zone Gets Another Big Patch
Chrome’s update count hides the real risk: the bugs that keep turning into browser takeover are still concentrated in the hardest-to-audit code. GPU, Network, WebGL, and Dawn are the places where untrusted web content can slip past memory safety and move from a page to the browser process.
Google’s Chrome 148 release fixes 151 vulnerabilities, including 22 critical issues and five named CVEs: CVE-2026-9872, CVE-2026-9873, CVE-2026-9874, CVE-2026-9875, and CVE-2026-9876. The most severe issues include an out-of-bounds write in GPU, a use-after-free in Network, a use-after-free in Dawn, and two WebGL flaws; Google says the update is rolling out to Windows, macOS, and Linux with versioned fixes.
If you embed Chromium in desktop software, you inherit the same memory-safety exposure. A successful exploit here is not just a tab crash; it can escape Chrome’s sandbox and reach the host.
CVSS 8.8 HIGH: use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. EPSS 0.3% (21st percentile). Microsoft patch: Release Notes.