Chrome Patches Over 150 Vulnerabilities
Google Chrome has multiple vulnerabilities, including memory corruption flaws, that could allow arbitrary code execution; no in-the-wild exploitation reported.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CIS/MS-ISAC issued an advisory covering a large batch of vulnerabilities in Google Chrome affecting Windows, Mac, and Linux versions prior to 157.0.8103.38/.39. The flaws span numerous Chrome components including V8, ANGLE, GPU, WebGL, Dawn, PDFium, Skia, DevTools, and various extension and permission subsystems. Vulnerability classes include use-after-free, buffer overflow, type confusion, memory corruption, out-of-bounds read/write, incorrect authorization, and UI misrepresentation issues. The most severe of these could allow arbitrary code execution in the context of the logged-on user, potentially enabling an attacker to install programs, manipulate or delete data, or create new accounts with full user rights, depending on the privileges of the affected account.
No active exploitation has been reported at this time; this is a proactive patch advisory rather than a confirmed in-the-wild threat. Given the typical drive-by nature of browser exploitation (malicious or compromised web content triggering the vulnerable code paths), defenders should prioritize patch deployment, apply least-privilege principles, and enable anti-exploitation mitigations. Recommended actions include automated patch management, restricting administrative privileges, enabling exploit protection features (DEP, WDEG, SIP/Gatekeeper), and standard web-content restrictions (DNS filtering, URL filtering, blocking risky file types) to reduce the attack surface for browser-based compromise.
This advisory follows the routine cadence of Chrome security bulletins; while the number of CVEs is large, the risk profile is consistent with standard browser patch cycles. Organizations should apply the update after testing, in line with standard vulnerability management practices (CIS Safeguards 7.1, 7.4, 7.7, 9.1).
Mentioned in this report
Detection guidance
Browser Process Spawning Script Interpreter or LOLBin (Possible Browser Exploit Post-Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Chrome or Edge spawning a shell, script host, or download/execute LOLBin, a behaviour seen after successful drive-by browser exploitation (memory-corruption RCE in the renderer or GPU process). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Process Spawning Script Interpreter or LOLBin (Possible Browser Exploit
Post-Exploitation)
description: Detects Chrome or Edge directly spawning cmd, PowerShell, script hosts,
or common download/execute LOLBins. Browsers rarely start these, but a successful
drive-by exploit (use-after-free, type confusion, sandbox escape) leading to code
execution as the logged-on user often does. Generalises on the parent/child relation,
not any CVE or sample.
status: experimental
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \chrome.exe
- \msedge.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Native messaging hosts or browser extensions that deliberately launch batch files
or PowerShell scripts
- Enterprise tooling that uses the browser to launch helper scripts via custom URL
handlers
level: medium
id: 5cd46e1f-6663-5731-b482-d6224e17b5d5
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-125
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-125
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs