# Chrome Patches Over 150 Vulnerabilities

Published: 2026-11-06 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/4df81997-2dbc-5ef0-8c91-0136299d4632/chrome-patches-over-150-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Google Chrome has multiple vulnerabilities, including memory corruption flaws, that could allow arbitrary code execution; no in-the-wild exploitation reported.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-125

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CIS/MS-ISAC issued an advisory covering a large batch of vulnerabilities in Google Chrome affecting Windows, Mac, and Linux versions prior to 157.0.8103.38/.39. The flaws span numerous Chrome components including V8, ANGLE, GPU, WebGL, Dawn, PDFium, Skia, DevTools, and various extension and permission subsystems. Vulnerability classes include use-after-free, buffer overflow, type confusion, memory corruption, out-of-bounds read/write, incorrect authorization, and UI misrepresentation issues. The most severe of these could allow arbitrary code execution in the context of the logged-on user, potentially enabling an attacker to install programs, manipulate or delete data, or create new accounts with full user rights, depending on the privileges of the affected account.

No active exploitation has been reported at this time; this is a proactive patch advisory rather than a confirmed in-the-wild threat. Given the typical drive-by nature of browser exploitation (malicious or compromised web content triggering the vulnerable code paths), defenders should prioritize patch deployment, apply least-privilege principles, and enable anti-exploitation mitigations. Recommended actions include automated patch management, restricting administrative privileges, enabling exploit protection features (DEP, WDEG, SIP/Gatekeeper), and standard web-content restrictions (DNS filtering, URL filtering, blocking risky file types) to reduce the attack surface for browser-based compromise.

This advisory follows the routine cadence of Chrome security bulletins; while the number of CVEs is large, the risk profile is consistent with standard browser patch cycles. Organizations should apply the update after testing, in line with standard vulnerability management practices (CIS Safeguards 7.1, 7.4, 7.7, 9.1).

## Mentioned in this report

- Vulnerabilities: CVE-2026-121035, CVE-2026-121037, CVE-2026-121044, CVE-2026-121047, CVE-2026-121052, CVE-2026-121057, CVE-2026-121074, CVE-2026-121080, CVE-2026-121082, CVE-2026-121083, CVE-2026-121086, CVE-2026-121089, CVE-2026-121094, CVE-2026-121098, CVE-2026-121113, CVE-2026-121117, CVE-2026-121118, CVE-2026-121123, CVE-2026-121126, CVE-2026-121127, CVE-2026-121129, CVE-2026-121137, CVE-2026-121156, CVE-2026-121166, CVE-2026-121179, CVE-2026-121180, CVE-2026-121181, CVE-2026-121185, CVE-2026-121203, CVE-2026-121207, CVE-2026-121210, CVE-2026-121214, CVE-2026-121228, CVE-2026-121229, CVE-2026-121233, CVE-2026-121241, CVE-2026-121246, CVE-2026-121247, CVE-2026-121249, CVE-2026-121250

## Detection guidance (public sample)

### Browser Process Spawning Script Interpreter or LOLBin (Possible Browser Exploit Post-Exploitation)

ATT&CK: T1189

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Chrome or Edge spawning a shell, script host, or download/execute LOLBin, a behaviour seen after successful drive-by browser exploitation (memory-corruption RCE in the renderer or GPU process). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Browser Process Spawning Script Interpreter or LOLBin (Possible Browser Exploit
  Post-Exploitation)
description: Detects Chrome or Edge directly spawning cmd, PowerShell, script hosts,
  or common download/execute LOLBins. Browsers rarely start these, but a successful
  drive-by exploit (use-after-free, type confusion, sandbox escape) leading to code
  execution as the logged-on user often does. Generalises on the parent/child relation,
  not any CVE or sample.
status: experimental
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \chrome.exe
    - \msedge.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Native messaging hosts or browser extensions that deliberately launch batch files
  or PowerShell scripts
- Enterprise tooling that uses the browser to launch helper scripts via custom URL
  handlers
level: medium
id: 5cd46e1f-6663-5731-b482-d6224e17b5d5
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-125
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-125

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4df81997-2dbc-5ef0-8c91-0136299d4632/chrome-patches-over-150-vulnerabilities.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup