# Google Chrome critical RCE flaws before 133.0.6943.98

Published: 2026-06-09 · Severity: elevated
Canonical: https://vorant.io/reports/566e8261-0567-57f4-9973-32baf6912c85/google-chrome-critical-rce-flaws-before-133-0-6943-98

> Multiple use-after-free and memory access vulnerabilities in Chrome allow arbitrary code execution; patch to version 133.0.6943.98 immediately.

Google has released Chrome 133.0.6943.98 (and .99 for Windows/Mac) to address multiple vulnerabilities, the most critical being use-after-free flaws in the V8 JavaScript engine and Navigation components, plus an out-of-bounds memory access in V8. These allow arbitrary code execution in the context of the logged-on user, with impact depending on account privileges. An additional lower-severity UI implementation flaw was also patched. The advisory indicates no current in-the-wild exploitation, but the severity and ease of triggering via drive-by compromise make immediate patching essential across all affected platforms (Windows, Mac, Linux).

## Mentioned in this report

- Vulnerabilities: CVE-2025-0995, CVE-2025-0996, CVE-2025-0997, CVE-2025-0998

## Detection guidance (public sample)

### Chrome Browser Spawning Scripting or LOLBin Child Process

ATT&CK: T1189

Chrome spawning cmd, PowerShell, script hosts or common LOLBins, a post-exploitation pattern after a browser RCE or sandbox escape via drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Scripting or LOLBin Child Process
id: 32e75ca7-52fc-5b86-9182-f89b76a55d94
status: experimental
description: Detects chrome.exe spawning a command interpreter, script host or common
  living-off-the-land binary. After a renderer exploit (V8 or Navigation use-after-free
  or out-of-bounds access) and sandbox escape, code running as the user commonly launches
  such processes. Generalises on the parent/child relation, not on any specific exploit.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-018
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection and not filter_native_messaging
falsepositives:
- Enterprise extensions or native messaging hosts that launch cmd.exe or PowerShell
  helper scripts
- Browser-based remote support or SSO tooling that invokes helper scripts via Chrome
level: medium
author: Vorant
```

### Chrome Spawning Shell With Download or Network Utility on Linux

ATT&CK: T1189

Chrome spawning a shell that runs download or network tools, suggesting code execution after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Spawning Shell With Download or Network Utility on Linux
id: 941f2c63-c69c-5f21-b8f3-e9651bcf9b94
status: experimental
description: Detects Chrome or Chromium spawning sh/bash with a command line that
  fetches or executes remote content or opens a reverse shell. This is unusual for
  normal browsing and consistent with post-exploitation after a drive-by browser RCE.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-018
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /chrome
    - /chromium
    - /google-chrome
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - nc
    - /dev/tcp/
    - python -c
    - python3 -c
    - base64 -d
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Developer tooling or browser wrapper scripts that call curl or wget through a shell
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-018

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/566e8261-0567-57f4-9973-32baf6912c85/google-chrome-critical-rce-flaws-before-133-0-6943-98.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup