Google Chrome critical RCE flaws before 133.0.6943.98
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple use-after-free and memory access vulnerabilities in Chrome allow arbitrary code execution; patch to version 133.0.6943.98 immediately.
Google has released Chrome 133.0.6943.98 (and .99 for Windows/Mac) to address multiple vulnerabilities, the most critical being use-after-free flaws in the V8 JavaScript engine and Navigation components, plus an out-of-bounds memory access in V8. These allow arbitrary code execution in the context of the logged-on user, with impact depending on account privileges. An additional lower-severity UI implementation flaw was also patched. The advisory indicates no current in-the-wild exploitation, but the severity and ease of triggering via drive-by compromise make immediate patching essential across all affected platforms (Windows, Mac, Linux).
Mentioned in this report
Detection guidance
Chrome Browser Spawning Scripting or LOLBin Child Process
Chrome spawning cmd, PowerShell, script hosts or common LOLBins, a post-exploitation pattern after a browser RCE or sandbox escape via drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Scripting or LOLBin Child Process
id: 32e75ca7-52fc-5b86-9182-f89b76a55d94
status: experimental
description: Detects chrome.exe spawning a command interpreter, script host or common
living-off-the-land binary. After a renderer exploit (V8 or Navigation use-after-free
or out-of-bounds access) and sandbox escape, code running as the user commonly launches
such processes. Generalises on the parent/child relation, not on any specific exploit.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-018
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
filter_native_messaging:
CommandLine|contains: chrome-extension://
condition: selection and not filter_native_messaging
falsepositives:
- Enterprise extensions or native messaging hosts that launch cmd.exe or PowerShell
helper scripts
- Browser-based remote support or SSO tooling that invokes helper scripts via Chrome
level: medium
author: Vorant
Chrome Spawning Shell With Download or Network Utility on Linux
Chrome spawning a shell that runs download or network tools, suggesting code execution after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Spawning Shell With Download or Network Utility on Linux
id: 941f2c63-c69c-5f21-b8f3-e9651bcf9b94
status: experimental
description: Detects Chrome or Chromium spawning sh/bash with a command line that
fetches or executes remote content or opens a reverse shell. This is unusual for
normal browsing and consistent with post-exploitation after a drive-by browser RCE.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-018
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /chrome
- /chromium
- /google-chrome
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- nc
- /dev/tcp/
- python -c
- python3 -c
- base64 -d
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Developer tooling or browser wrapper scripts that call curl or wget through a shell
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-018
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs