Google Patches 290+ Chrome Flaws

Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Google fixed over 290 Chrome vulnerabilities, including many use-after-free and type confusion bugs, with no known in-the-wild exploitation yet.

MS-ISAC advisory 2026-109 details an unusually large batch of vulnerabilities patched in Google Chrome versions prior to 155.0.8059.39/.40 (Windows/Mac) and 155.0.8059.39 (Linux). The flaws span nearly every Chrome subsystem including V8, ANGLE, Media, WebRTC, PDF, Fonts, Autofill, DevTools, and the sandbox itself, with the predominant bug classes being use-after-free, type confusion, race conditions, integer/buffer overflows, and various incorrect/missing authorization checks. The most severe issues could allow arbitrary code execution in the context of the logged-on user, potentially enabling an attacker to install programs, modify or delete data, or create new accounts with full privileges if the victim is running with administrative rights.

MS-ISAC states there are no current reports of in-the-wild exploitation for any of these vulnerabilities, and classifies the primary attack vector as drive-by compromise (requiring a user to visit a malicious or compromised page, or interact with malicious content). Given the sheer number of memory-corruption-class bugs (use-after-free, type confusion, heap overflow) in core rendering and JavaScript engine components, and a privilege-elevation flaw in the sandbox itself, the risk of a chained RCE exploit is non-trivial once technical details circulate, even though nothing is confirmed exploited today.

Defenders should prioritize rolling out the Chrome update broadly and promptly via automated patch management, since browsers are a primary initial-access surface. Standard hardening measures apply: enforce least-privilege (non-admin) browsing accounts, enable OS/browser anti-exploitation features (DEP, Exploit Guard, SIP/Gatekeeper), apply DNS/URL filtering, and reinforce user awareness against malicious links and attachments, as several of these bugs are reachable via normal web browsing.

title: Chrome Browser Spawning Script Interpreter or LOLBin
description: Detects chrome.exe directly spawning shells, script hosts or common LOLBins.
  After a successful renderer/V8 exploit and sandbox escape, payload staging often
  starts as a child of the browser process. Generalises on the parent/child relation,
  not any specific exploit or URL.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection and not filter_native_messaging
falsepositives:
- Browser extensions or native messaging hosts that launch helper scripts via cmd.exe
- Enterprise web apps using custom URL handlers that launch a shell through Chrome
level: medium
id: 54fce124-a4a1-52fc-95ff-58b9babc7a05
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-109

title: Chrome Child Process Running With SYSTEM Privileges
description: Detects processes whose parent is chrome.exe but which run at System
  integrity or as NT AUTHORITY\SYSTEM. Chrome and its renderers run as the logged-on
  user, so a SYSTEM child is a strong sign of a sandbox escape or privilege-escalation
  exploit. Requires Sysmon-style IntegrityLevel/User telemetry.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \chrome.exe
  selection_priv_il:
    IntegrityLevel: System
  selection_priv_user:
    User|contains:
    - AUTHORITY\SYSTEM
    - "NT-AUTORIT\xC4T\\SYSTEM"
  condition: selection_parent and 1 of selection_priv_*
falsepositives:
- Chrome installer or updater components launched under SYSTEM by software deployment
  tooling that appear with chrome.exe as parent
level: high
id: a5b1eaea-cb22-564c-b2e7-56111b3eca4a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-109

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-109