Google and Microsoft published advisories on May 6 and 7, 2026, confirming that a use-after-free bug in Chromium’s Blink rendering engine could let attackers run arbitrary code inside the browser’s sandbox. The fix arrives in Chrome 148.0.7778.96 for Windows, macOS, and Linux, and in a corresponding Microsoft Edge build from the 148.0.7778.xxx series. No active exploitation has been reported, but the patch window is narrow—attackers often reverse-engineer these flaws days after public disclosure.

What Actually Changed

The vulnerability, tracked as CVE-2026-7974, lives in Blink—the part of Chromium that interprets HTML, CSS, and JavaScript and turns them into the pixel‑perfect pages users see. A use‑after‑free (UAF) error means the code frees a chunk of memory but later tries to use it again. If an attacker can seed that freed memory with malicious data, the browser may execute code it shouldn’t.

The official Chromium severity label says “Medium,” yet the U.S. Cybersecurity and Infrastructure Security Agency (CISA) assigned an ADP CVSS score of 8.8 (High). The difference stems from what each rating measures: Chromium factors in the browser’s sandbox, which contains the renderer process; CVSS treats the whole browser as a single target. A sandbox‑confined code‑execution bug might not give an attacker instant system access, but it is still a valuable stepping stone when paired with a sandbox‑escape—and exploit chains do exactly that.

The affected versions are straightforward: Chrome desktop builds older than 148.0.7778.96, and Microsoft Edge (Chromium‑based) builds before the matching 148.0.7778.xxx security release. The fix is part of a large Chrome 148 stable‑channel update that patched more than 100 security issues, several rated Critical. That volume alone signals why browser patching can’t wait for a monthly cycle.

What It Means for You

For everyday Windows users

If you run Chrome or Edge at home, the to‑do list is short but non‑negotiable:
- Open the browser, click the menu, choose Help > About (Chrome) or Settings > About Microsoft Edge.
- Let the update install. If the version number already shows 148.0.7778.96 or higher (Chrome) or 148.0.7778.xx (Edge), you’re protected.
- Shut down the browser completely—not just close tabs—and relaunch it. An installed update that never restarts the browser leaves the old, vulnerable code in memory.

For IT administrators

Browser patch compliance is harder than checking an inventory report. A fleet may show Chrome or Edge “installed” at the correct version while dozens of long‑running browser processes still sit at the vulnerable build. Key things to test and enforce:
- Verify running version, not just installed version. Use endpoint management tools (Configuration Manager, Intune, Group Policy) to query the actual process version, or push a forced restart via policy.
- Check multiple channels. If your organization runs Edge’s Extended Stable, Beta, or Dev, those channels have their own update cadences; confirm the 148 fix has landed in each.
- Don’t let severity labels slow you down. A “Medium” Chrome bug can be the first link in an exploit chain—renderer code execution combined with any other flaw can escalate quickly.
- Watch for scanner lag. NIST’s National Vulnerability Database may not yet reflect CISA’s 8.8 CVSS; some dashboards may show “N/A” for a day or two. Rely on the fixed version number, not a scanner’s severity badge.

How We Got Here

Blink is a sprawling codebase. It handles layout, DOM wrangling, style recalculation, input events, WebGPU, WebAssembly, and dozens of other APIs that modern web apps treat as native capabilities. A use‑after‑free in such a complex engine is exactly the kind of bug that modern mitigations (sandboxing, site isolation, Control‑Flow Guard) are designed to surround, not eliminate. Chromium’s memory‑safety challenges are well documented, and the project’s breakneck release cadence—major version every four weeks—means vulnerabilities surface regularly.

Chrome 148 is a “security train” rather than a one‑off patch. Google limits the technical detail it publishes until most users have updated, a practice that protects defenders but also means the best intelligence attackers have is the diff between the old and new code. The moment version 148.0.7778.96 shipped, researchers and threat actors began looking at what changed.

Microsoft Edge, being built on Chromium, inherits the same Blink code and, consequently, the same vulnerability. Because Edge is deeply embedded in Windows enterprise workflows—Microsoft 365, Azure AD conditional access, IE mode—a Chromium bug in Edge is a first‑order Windows security concern, not an afterthought.

What to Do Now

  1. Update Chrome to 148.0.7778.96 or later. On Windows and macOS, build 148.0.7778.97 may be the one that ends up pushed via the auto‑updater; both are fixed.
  2. Update Microsoft Edge to the corresponding 148.0.7778.xxx build. The easiest path: open edge://settings/help and let the updater run. For managed fleets, verify the update is approved and deployed via your normal management channel (Microsoft Edge Update policies, Configuration Manager, or Intune).
  3. Force a browser relaunch. For workstations, this might mean a gentle prompt: a scheduled task that restarts the browser after hours. For kiosks, VDI pools, and shared devices, a policy that closes the browser cleanly at logoff is safer than assuming users will restart on their own.
  4. Audit browser versions across the estate. Not just the primary executable. Check profiles, side‑by‑side channels, and any Chromium‑based wrappers (Electron apps, developer tools that embed Chromium). While only the browsers themselves are listed as affected, any Chromium‑derived component that processes rich web content should be inventoried.
  5. Confirm that your vulnerability scanner has picked up the CVE. If it hasn’t, manually tag assets with the fixed version requirement. Do not wait for a third‑party severity score to turn red.
  6. Revisit update‑deferral policies. Some enterprises pin Chrome or Edge to a specific version for app compatibility. If you’re still running a version below 148.0.7778.96, this CVE is your immediate reason to test and advance. Browser patches can’t sit in a “next maintenance window” queue when the attack vector is the open internet.

Outlook

CVE-2026-7974 will fade into the long list of Chromium memory‑safety fixes, but the pattern will repeat. Blink, V8, and Skia will keep generating CVE entries. The organizations that treat browser patching as routine endpoint hygiene—with fast update lanes, version‑based compliance checks, and restart‑enforcement muscle—will spend far less time scrambling when the next medium‑severity flaw that matters shows up. The browser is no longer just an application; it’s the platform most employees live in.