Chrome V8 heap corruption vulnerabilities enable code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two V8 heap corruption flaws in Chrome versions before 132.0.6834.110/111 allow arbitrary code execution; no active exploitation reported.
Google has released Chrome 132.0.6834.110/111 to address multiple vulnerabilities, the most severe being two memory corruption flaws in the V8 JavaScript engine. CVE-2025-0611 involves object corruption resulting in heap corruption, while CVE-2025-0612 describes out-of-bounds memory corruption, also leading to heap corruption. Both can be triggered via drive-by compromise and allow arbitrary code execution in the context of the logged-on user. The advisory notes no current in-the-wild exploitation.
Successful exploitation permits an attacker to install programs, view or modify data, or create new accounts with full user rights depending on the privileges of the compromised account. Users with administrative privileges face higher risk than those running with least-privilege accounts. The vulnerability affects Chrome on Windows, macOS, and Linux versions prior to 132.0.6834.110 (or 111 on Windows/macOS). Defenders should prioritize patching immediately after testing and enforce the principle of least privilege across user accounts to limit the impact of successful exploitation.
Mentioned in this report
Detection guidance
Chrome Browser Spawning Shell or Script Interpreter
Chrome spawning cmd, PowerShell, script hosts or LOLBins, a common post-exploitation sign after a V8 or renderer exploit in a drive-by compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Shell or Script Interpreter
description: Detects chrome.exe launching a command shell, script host or common LOLBin
as a child process. After a successful browser exploit (for example a V8 heap corruption
flaw reached via drive-by compromise), attacker code running as the user commonly
spawns these. Chrome rarely launches them in normal use.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_native_messaging:
CommandLine|contains: chrome-extension://
condition: selection and not filter_native_messaging
falsepositives:
- Native messaging hosts or browser extensions launched through a cmd.exe wrapper
- Enterprise tools or web apps that use custom protocol handlers to run scripts from
the browser
level: medium
id: c7080f95-5423-50c8-819d-418c00d4a4f0
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-009
Chrome Browser Spawning Local Account Creation
Chrome as the parent of net.exe or net1.exe creating a local user, which matches post-exploitation account creation after a browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Local Account Creation
description: Detects chrome.exe as the parent of net.exe or net1.exe adding a user
account. The advisory notes exploitation can lead to new accounts being created
with the user's rights. A browser process should never create accounts.
tags:
- attack.initial-access
- attack.t1189
- attack.persistence
- attack.t1136.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains|all:
- user
- /add
condition: selection
falsepositives:
- Very unlikely; possibly a security test simulating browser-based exploitation
level: high
id: bbebfe7e-d60c-56ad-b426-da13886113c5
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-009
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-009
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs