Google released Chrome 148 on May 5, 2026, patching a medium-severity security flaw in the browser’s Canvas component that could let a malicious website bypass the same-origin policy and read pixel data from other sites. The update, Chrome 148.0.7778.96 for Windows and Mac (and 148.0.7778.96 for Linux), is part of a larger batch of 127 security fixes, but this particular bug—tracked as CVE-2026-7977—targets a fundamental web isolation mechanism.

Microsoft concurrently published an advisory for the same CVE, confirming that its Chromium-based Edge browser is no longer affected after the corresponding update. That means Windows users who rely on either Chrome or Edge need to ensure their browsers are current and, critically, restarted.

What Actually Changed in Chrome 148

The vulnerability resides in the Canvas API, which lets websites draw graphics, manipulate images, and read pixel data. Normally, the browser’s same-origin policy prevents a page from reading canvas content if it contains cross-origin material—a protection known as canvas tainting. CVE-2026-7977 was an “inappropriate implementation” that could allow a specially crafted HTML page to bypass that taint check, potentially exposing pixel information from another site.

Google’s advisory describes the attack as requiring user interaction: a victim must visit a malicious page. The CISA-ADP enrichment scores it at CVSS 3.1:6.3, with low impacts to confidentiality, integrity, and availability. The bug is not known to be exploited in the wild, and Google has not published deep technical details, as is standard while users update.

Chrome 148 rolled out with builds for each platform:

  • Windows: 148.0.7778.96 or 148.0.7778.97
  • macOS: 148.0.7778.96 or 148.0.7778.97
  • Linux: 148.0.7778.96 or later

The release included two other critical vulnerabilities and dozens of high-severity issues across V8, WebRTC, GPU components, and more, making this a significant security update beyond the Canvas fix alone.

What This Means for You

For everyday users

The practical step is simple: update Chrome and restart it. Open the browser’s menu, go to Help > About Google Chrome, and let the update download. Then relaunch. If you use Microsoft Edge, check its version (Settings > About Microsoft Edge) and apply any pending updates. Both browsers should prompt you, but the fix only takes effect once the browser process restarts.

Canvas-based attacks are often invisible, so there is no reliable sign that your browser was targeted. The safe assumption is that any Chrome build before 148.0.7778.96 is vulnerable.

For Windows administrators

A same-origin bypass matters because it breaks the isolation that keeps internal apps, admin panels, and SaaS services safe from each other inside the browser. Even though the severity is medium, defenders should treat this as a prompt to:

  • Deploy Chrome 148 via your update management tools (Group Policy, Chrome Browser Cloud Management, Intune).
  • Enforce relaunch deadlines—a pending update that hasn’t restarted the browser leaves the machine exposed.
  • Check Microsoft Edge fleet versions; the Chromium-based browser inherited the same bug and is now fixed.
  • Inventory other Chromium runtimes: Electron apps, WebView2 Runtime, development tools, and portable browsers often bundle their own version of the engine.

Many vulnerability scanners will flag only the Google Chrome CPE, so you may need a manual scan or a software inventory query to find embedded Chromium instances.

How We Got Here

The Canvas API has been a core web technology since HTML5, enabling everything from photo editors to data visualization. Its security model hinges on same-origin protections: when a page draws an image or video from another origin without proper CORS headers, the canvas becomes “tainted” and scripts cannot read it back. This rule preserves the confidentiality of cross-origin resources.

But the implementation is complex. Browsers must track tainting across asynchronous operations, redirects, cached media, and GPU rendering paths. Mistakes in this logic lead to the class of bug we see in CVE-2026-7977—an edge case where the protection train derails.

Chromium’s dominance has turned browser patches into infrastructure events. Microsoft Edge, countless Electron applications, and the WebView2 runtime embed the same code, so a single canvas flaw can echo across the enterprise. The MSRC advisory for this CVE explicitly notifies Windows users that “the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable,” underscoring that the flaw was shared.

Chrome 148 itself arrives during an era of continuous browser patching. Google releases a new stable version roughly every four weeks, sometimes merging over a hundred security fixes. This release cadence is a defense mechanism—but only when organizations keep up.

What to Do Now

Step 1: Check your browser version

In Chrome: navigate to chrome://settings/help. The version number should be at least 148.0.7778.96. In Edge: go to edge://settings/help. If either browser shows an older version, allow it to update and then restart.

Step 2: Enforce a restart

On personally managed machines, closing the browser completely and reopening it is enough. In managed environments, use Group Policy or Microsoft Intune to set a relaunch notification period. For Chrome, the policy is RelaunchNotification. For Edge, use RelaunchNotification as well. Set a brief deadline—ideally a few hours—to minimize the window of vulnerability.

Step 3: Find other Chromium instances

Run a software inventory query for:

  • Microsoft Edge (all channels)
  • Electron-based applications (Slack, Teams, VS Code, etc.)
  • WebView2 Runtime (check C:\Program Files\Microsoft\EdgeWebView\)
  • Portable Chrome or Chromium builds used by developers

Any of these that embed an older Chromium version remain vulnerable until their vendors ship a fix. Flag them for monitoring and prioritize updating those that access internal sites.

Step 4: Harden browser isolation

While patching, review your security stack:

  • Use site isolation (chrome://flags#enable-site-per-process) for defense in depth.
  • Limit extension permissions; a malicious or compromised extension could amplify a same-origin bypass.
  • Consider browser isolation technologies (such as Remote Browser Isolation) for high-risk users.

These measures don’t replace patching but add friction against attacks that chain multiple bugs.

Outlook

CVE-2026-7977 is unlikely to become a household name, but it embodies a recurring challenge: the browser is now the operating environment for most business applications, and its security boundaries are under constant refinement. As the Canvas API gains more capabilities—and as Chromium expands into desktop apps via WebView2—bugs in its isolation logic will continue to appear.

The right response is not alarm but discipline. Treat browser updates like OS patches: establish a reliable update rhythm, enforce restarts, and know where Chromium lives in your fleet. The 127 fixes in Chrome 148 are a reminder that the browser’s security surface is enormous. A medium-severity Canvas bypass may seem minor, but it nicks the same-origin policy—the one rule that prevents the web from descending into chaos.