InfoSecBulletin Cybersecurity for mankind
Google has officially released Chrome 148 for Windows, Mac, and Linux. The new version is 148.0.7778.96 for Linux and 148.0.7778.96/97 for Windows and Mac. This update focuses a lot on security, fixing 127 issues all at once.
Out of 127 vulnerabilities fixed, three are rated Critical, more than twenty are High, and many are Medium or Low.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Google gave over $100,000 in bug rewards to outside researchers for safely reporting problems. One researcher got $55,000 for finding a serious out-of-bounds read and write error in V8.
Critical Chrome Vulnerabilities Patched
The three Critical vulnerabilities are the most dangerous. CVE-2026-7896 is an integer overflow issue in the Blink rendering engine. An outside researcher reported it on March 18 and got a $43,000 reward.
CVE-2026-7897 and CVE-2026-7898 are use-after-free problems. One is in the Mobile part and the other is in Chromoting (Chrome Remote Desktop). Google reported them on April 18 and April 20.
The High-severity bracket covers a broad attack surface. CVE-2026-7899, an out-of-bounds read and write in Chrome’s V8 JavaScript engine, was reported by Project WhatForLunch (@pjwhatforlunch) and earned the update’s highest individual reward of $55,000.
CVE-2026-7900 and CVE-2026-7901 are bugs in ANGLE (the graphics layer). They are heap buffer overflow and use-after-free issues. Each got a reward of $16,000.
CVE-2026-7902 is a flaw in V8 that allows access to memory it shouldn’t. JunYoung Park from KAIST Hacking Lab reported it and got $8,000. These V8 and ANGLE issues are serious risks for being exploited by bad web pages.
Chrome 148 fixes some major problems and many use-after-free bugs in areas like SVG, DOM, Fullscreen, GPU, WebRTC, Skia, Passwords, ServiceWorker, PresentationAPI, WebAudio, and others.
Medium-severity issues also include a problem with object lifecycles in V8 (CVE-2026-7936), type confusion in WebRTC (CVE-2026-7988), and weak policy enforcement in DevTools, Extensions, and DirectSockets.
CVE-2026-8022 is a low-risk flaw in MHTML. A remote hacker might use this to steal data from other sites through a fake MHTML page if a user does certain actions.
Google recognized many independent researchers. This includes people from KAIST Hacking Lab, Tencent Security Xuanwu Lab, National Yang Ming Chiao Tung University’s Security and Systems Lab, and Theori.
