Google Chrome update fixes 79 security vulnerabilities

Google has released one of the largest security updates in recent months for Chrome , fixing a total of 79 vulnerabilities that could allow cybercriminals to gain access to users' systems through malicious websites .

Of the flaws fixed, 14 are classified as critical, which has sparked intense mobilization in the cybersecurity community. Experts warn that using an older version of the browser could leave millions of devices exposed to remote code execution attacks, data breaches and complete system takeovers.

The new stable version of the browser brings Chrome to versions 148.0.7778.167 and 148.0.7778.168 for Windows and macOS , while Linux users receive version 148.0.7778.167 .

See also: Pwn2Own Berlin 2026 – Day 1: Researchers hacked Windows 11 and Edge

Although Google is gradually rolling out the update over the next few days, system administrators and more cautious users are urged to proceed with a manual upgrade immediately.

The most dangerous Chrome vulnerabilities

The majority of the flaws fixed concern memory management, one of the most common and dangerous types of vulnerabilities in modern browsers.

Of particular concern are the so-called “Use-after-free” and “Heap buffer overflow” flaws, which allow an attacker to exploit errors in the way a program handles memory. Through specially crafted HTML pages or malicious JavaScript code, hackers could theoretically execute arbitrary code on a victim’s system.

In some cases, such attacks even lead to sandbox escape exploits, allowing attackers to overcome browser isolation mechanisms and gain access to the operating system.

The most serious vulnerability in the new update was found in Chrome's WebML component and involved a critical heap buffer overflow flaw . Google rewarded the independent researcher who discovered it with $43,000, one of the highest bug bounty rewards of this release.

Why browsers are a top target for attacks

Browsers remain one of the most important attack surfaces on the modern internet. The reason is simple: almost every user and business activity now passes through a browser, from banking and cloud applications to corporate dashboards and AI tools.

See also: CVE-2026-42897: Active Exchange Server vulnerability exploit

This means that a successful browser compromise can give attackers access to login cookies, saved passwords, corporate credentials, or even active cloud sessions.

In recent years, cybercriminals have increasingly invested in browser exploits, as they offer high performance and massive scale of attacks. In particular, zero-click and drive-by download attacks allow victims to become infected simply by visiting a malicious page.

Security experts emphasize that browser flaws are often the first stage of larger chains of ransomware or cyberespionage attacks.

Google's strategy and the "window of protection"

As is customary with critical updates, Google did not publish full technical details of the exploits or proof-of-concept code. This practice is intentionally implemented to give users time to update their devices before hackers build working exploit kits.

This period is considered extremely critical in cybersecurity. Often, after a patch is released, groups of attackers analyze the changes in the browser code to identify exactly which flaws were fixed and create exploits for unpatched systems.

For this reason, many large enterprises now implement policies of mandatory browser updates within a few hours of the release of critical patches.

What users should do immediately

Security experts are calling the update installation an urgent process. Delaying it could leave entire corporate networks exposed to attacks via phishing links or malicious ads.

See also: New vulnerability in PraisonAI: Targeted a few hours after disclosure

To install the new version, users need to open the three-dot menu in the top right of Chrome, go to the “Help” and “About Google Chrome” options, and allow the browser to update automatically.

After the installation is complete, a browser restart for the security fixes to fully activate.

The new massive update is a reminder once again that browsers are no longer just browsing tools, but critical platforms for accessing personal data, cloud services, and enterprise infrastructure. In an era where cyberattacks are becoming increasingly sophisticated, even a small delay in a browser update can be enough to cause a serious security breach.