In summary:
- PCWorld reports that Google Chrome’s latest update patches 60 security vulnerabilities, including two critical buffer and integer overflow flaws in the WebML component.
- The update addresses 14 high-risk vulnerabilities involving memory errors and type confusion, with Google awarding $118,000 in bounties to security researchers.
- Users should update immediately for protection, while the update also introduces cross-device tab group syncing functionality.
In the new Chrome versions 147.0.7727.55/56 for Windows and macOS and 147.0.7727.55 for Linux, the developers have patched 60 security vulnerabilities. According to Google, none of these vulnerabilities have been exploited in the wild yet. Chrome version 148 is expected to release in early May.
What’s new in Chrome 147?
The browser’s “What’s new?” page lists the ability to take tab groups with you to other devices as the only new feature.
The recently announced vertical tabs and new reading mode aren’t in this update. Both new features are slated for this week, but they’re apparently rolling out gradually, not all at once.
As a rule, Chrome updates automatically when a new version is available. You can manually check for updates via the menu option Help > About Google Chrome (alternatively, Settings > About Google Chrome).
Google also released Chrome for Android 147.0.7727.49 this week, having already released Chrome for iOS 147.0.7727.47 last week. The Android version addresses the same vulnerabilities as the desktop versions. The Extended Stable Channel for Windows and macOS now includes Chromium version 146.0.7680.188.
Vulnerability after vulnerability
In the Chrome Releases blog post, Srinivas Sista lists the 60 fixed security vulnerabilities in this update, almost all of which were reported by external security researchers. Two of these vulnerabilities are classified as critical: CVE-2026-5858 is a buffer overflow in the WebML component while CVE-2026-5859 an integer overflow in the same component.
A further 14 security vulnerabilities are classified as high risk. These include a mix of buffer overflows, use-after-free vulnerabilities, and other memory errors. The oft-surfacing type confusion error in the V8 JavaScript engine is also present—two times, in fact.
Of the remaining vulnerabilities, 20 are classified as medium risk and 24 as low risk. Google has so far awarded $118,000 in bounties to the discoverers of the vulnerabilities.
Tip: Whether you keep your browser up to date, you need proper antivirus protections if you want your PC to remain secure and private. Check out our picks for the best antivirus software for Windows as well as best VPN services to stay ahead of security problems.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
Author: Frank Ziemann, Contributor, PCWorld
Frank Ziemann has been working as a freelance author for sister site PC-WELT since 2005, writing news and test reports. His main topics are IT security (malware, antivirus, security gaps) and Internet technology.