Google just pushed out Chrome versions 146.7680.164/165 for Windows and macOS, with 146.7680.164 for Linux. The update fixes eight high-risk vulnerabilities. And here’s the thing that caught my attention: none of them are currently being exploited in the wild.
That last part might sound like good news, and it is. But it also tells you something important about how security actually works in the real world, and why you should care about updates even when there’s no active threat.
The Gap Between Discovery and Exploitation
I’ve been writing code long enough to know that finding a vulnerability and weaponizing it are two very different things. When Google’s security team discovers a flaw—and they have the resources to find them before attackers do—there’s often a window of time before someone figures out how to actually exploit it.
That window is closing, though. It’s getting shorter every year. The exploit development community is talented and well-organized. A high-risk vulnerability that nobody’s using today could absolutely be in active use tomorrow. The fact that Google patched eight of them at once suggests these weren’t subtle issues. These were probably things that, in the wrong hands, could cause serious damage.
I’ve dealt with the aftermath of delayed patching at work. I’ve seen what happens when you wait too long to roll out a security update. You end up scrambling when an exploit drops, trying to push patches across your infrastructure while attacks are already happening. It’s stressful and preventable.
What “High-Risk” Actually Means
When security researchers label something as high-risk, they’re not being dramatic. In Chrome’s case, these eight vulnerabilities were serious enough that Google bumped the version numbers and shipped fixes across three different operating systems simultaneously.
High-risk typically means one or more of these scenarios:
- Remote code execution—an attacker can run arbitrary code on your machine just by visiting a webpage
- Privilege escalation—breaking out of the browser’s sandbox to access system resources
- Information disclosure—stealing sensitive data without your knowledge
- Memory corruption issues that could crash the browser or be chained together for more serious attacks
Any of these could be weaponized against millions of people. Chrome’s market share is massive. If even one of these vulnerabilities had a public exploit available, attackers would be actively targeting Chrome users right now.
The Proactive vs. Reactive Problem
Here’s what frustrates me about security in general: we’re almost always playing defense. We patch holes after they’re found. We secure systems after incidents happen. It’s reactive work, and it’s exhausting.
But Google finding these bugs before attackers did—that’s actually the system working the way it should. They have security teams, fuzzing programs, code review processes, and bug bounty programs all designed to find these things first. Then they fix them and push the patch out proactively.
That’s the best-case scenario. You patch before exploit code exists. Everyone updates. The vulnerability never becomes a real problem. That’s the dream, anyway.
The catch? It only works if people actually install the updates. I can’t count how many machines I’ve seen running Chrome versions that are months or years out of date. Sometimes it’s negligence. Sometimes it’s systems that can’t be updated easily. Sometimes it’s people who just don’t realize their browser is outdated.
What You Should Actually Do
If you’re on Chrome, update today. Not tomorrow. Not when you feel like it. Today. Your browser should handle this mostly automatically these days, but you can manually check by going to Chrome menu > About Chrome. It’ll show you the version and update if needed.
If you’re managing Chrome across an organization, deploy these updates as soon as your testing clears them. Eight high-risk fixes deserve priority.
And if you’re using a Chromium-based browser—Edge, Brave, Opera, or others—check that you’re updated too. They typically pull these security fixes from upstream pretty quickly, but not always immediately.
The real lesson here is that security updates aren’t optional. They’re not something you get to when you have free time. They’re maintenance, like changing the oil in your car. The fact that there’s no active threat right now is the best time to patch, because it means you’re staying ahead of the problem instead of scrambling to fix it after you’re already compromised.
Source: Chrome update fixes 8 high-risk browser vulnerabilities
Sarah Mitchell
Rachel Adams
Tom Harrington