# Chrome V8 heap corruption vulnerabilities enable code execution

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/2299518a-2cac-51dd-a7dd-86279eb56003/chrome-v8-heap-corruption-vulnerabilities-enable-code-execution

> Two V8 heap corruption flaws in Chrome versions before 132.0.6834.110/111 allow arbitrary code execution; no active exploitation reported.

Google has released Chrome 132.0.6834.110/111 to address multiple vulnerabilities, the most severe being two memory corruption flaws in the V8 JavaScript engine. CVE-2025-0611 involves object corruption resulting in heap corruption, while CVE-2025-0612 describes out-of-bounds memory corruption, also leading to heap corruption. Both can be triggered via drive-by compromise and allow arbitrary code execution in the context of the logged-on user. The advisory notes no current in-the-wild exploitation.

Successful exploitation permits an attacker to install programs, view or modify data, or create new accounts with full user rights depending on the privileges of the compromised account. Users with administrative privileges face higher risk than those running with least-privilege accounts. The vulnerability affects Chrome on Windows, macOS, and Linux versions prior to 132.0.6834.110 (or 111 on Windows/macOS). Defenders should prioritize patching immediately after testing and enforce the principle of least privilege across user accounts to limit the impact of successful exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2025-0611, CVE-2025-0612

## Detection guidance (public sample)

### Chrome Browser Spawning Shell or Script Interpreter

ATT&CK: T1189

Chrome spawning cmd, PowerShell, script hosts or LOLBins, a common post-exploitation sign after a V8 or renderer exploit in a drive-by compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Shell or Script Interpreter
description: Detects chrome.exe launching a command shell, script host or common LOLBin
  as a child process. After a successful browser exploit (for example a V8 heap corruption
  flaw reached via drive-by compromise), attacker code running as the user commonly
  spawns these. Chrome rarely launches them in normal use.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection and not filter_native_messaging
falsepositives:
- Native messaging hosts or browser extensions launched through a cmd.exe wrapper
- Enterprise tools or web apps that use custom protocol handlers to run scripts from
  the browser
level: medium
id: c7080f95-5423-50c8-819d-418c00d4a4f0
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-009
```

### Chrome Browser Spawning Local Account Creation

ATT&CK: T1189

Chrome as the parent of net.exe or net1.exe creating a local user, which matches post-exploitation account creation after a browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Local Account Creation
description: Detects chrome.exe as the parent of net.exe or net1.exe adding a user
  account. The advisory notes exploitation can lead to new accounts being created
  with the user's rights. A browser process should never create accounts.
tags:
- attack.initial-access
- attack.t1189
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - user
    - /add
  condition: selection
falsepositives:
- Very unlikely; possibly a security test simulating browser-based exploitation
level: high
id: bbebfe7e-d60c-56ad-b426-da13886113c5
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-009
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-009

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2299518a-2cac-51dd-a7dd-86279eb56003/chrome-v8-heap-corruption-vulnerabilities-enable-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup