Chrome 148 fixes 79 flaws, two critical bugs earn $68k bounties.

Google this week released a Chrome 148 update that resolves 79 vulnerabilities, including 14 critical-severity bugs across multiple components. The first critical issue is a heap buffer overflow in WebML tracked as CVE-2026-8509, for which the internet giant paid a $43,000 bug bounty, while CVE-2026-8510 is an integer overflow weakness in Skia that earned the reporting researcher a $25,000 reward.

The remaining 12 critical-severity defects resolved with the latest Chrome refresh were discovered by Google and include eight use-after-free vulnerabilities in UI, FileSystem, Input, Aura, HID, Blink, Tab Groups, and Downloads, among others. The Chrome 148 update also resolves 37 high-severity weaknesses, with Google noting bug bounty rewards totalling $44,000 for four of these issues, though amounts for several other flaws have not been disclosed.

The latest iteration is rolling out as version 148.0.7778.167 for Linux and as versions 148.0.7778.167/168 for Windows and macOS, and Firefox also released a security update to address five high-severity flaws. 15 May 2026.