Google has released Chrome 138, the latest edition of the browser that fixes several vulnerabilities, now in versions 138.0.7204.49/50 for Windows and macOS and 138.0.7204.49 for Linux. According to Google, none of the vulnerabilities have been exploited in the wild yet.
What’s new in Chrome 138?
On the “What’s New” page in Chrome, Google advertises the ability to use tab groups on the go. With Chrome, you can now synchronize not only passwords but also tab groups between your desktop and mobile devices. Google is also raising awareness of Chrome’s ability to search, select, and copy text in scanned PDF documents, but Google doesn’t mention that this first requires text recognition (OCR) and whether this takes place locally or in the cloud.
Meanwhile, Google is continuing to expand AI integration, but a Gemini subscription is required to use it. Several interfaces (APIs) enable access to AI functions: the Summarizer API summarizes longer texts, the Language Detector API determines which language the text is written in, and the Translator API translates the text into the target language. Chrome extensions can access AI models via the Prompt API.
Security issues fixed in Chrome 138
In the Chrome Releases blog post, Srinivas Sista names three security vulnerabilities (of the 11 that have been fixed) that were discovered by external security researchers and reported to Google. Google classifies one of these vulnerabilities (CVE-2025-6555) as medium risk, which is a use-after-free vulnerability in the animation component. The other two vulnerabilities are only considered low risk. Google doesn’t comment in detail on the internally discovered vulnerabilities.
As a rule, Chrome updates itself automatically when a new version is available. You can manually initiate the update check using the menu item Help > About Google Chrome (alternatively, Settings > About Google Chrome). Google has also released Chrome for Android 138.0.7204.45 and Chrome for iOS 138.0.7204.53. The same vulnerabilities have been fixed in the Android version as in the desktop versions.
Google plans to release Chrome 139 at the end of July. Chrome 139 for Android will require at least Android 10. Chrome 138 is the last browser version that still runs on Android 8 (Oreo) and 9 (Pie).
Other Chromium-based browsers
The manufacturers of other Chromium-based browsers are now required to follow suit with their own updates. Microsoft Edge, Brave, and Vivaldi are currently at the security level prior to this Chrome update. All three will switch to Chromium 138 in the next step, including Vivaldi. However, Vivaldi is likely to take a little longer than Brave and Microsoft.
Opera’s browser version 119 is still stuck with the outdated Chromium version 134, for which Google has not provided any updates since the end of April. In order to catch up with the others, Opera would have to take a big step as soon as possible and skip at least two, preferably three, Chromium generations. However, the current beta version Opera 120, which could soon be promoted to the stable channel, only contains Chromium 135 instead of 138.