# Google Chrome RCE via type confusion and use-after-free

Published: 2026-06-09 · Severity: routine
Canonical: https://vorant.io/reports/645b001a-5bb6-59eb-b3d5-82ff6a54985a/google-chrome-rce-via-type-confusion-and-use-after-free

> Multiple Chrome vulnerabilities including type confusion in V8 allow arbitrary code execution; patch to 131.0.6778.139/.140 immediately.

Google Chrome versions prior to 131.0.6778.139 (Windows/Mac) and 131.0.6778.139 (Linux) contain multiple vulnerabilities that could allow arbitrary code execution in the context of the logged-on user. The most severe issues are a type confusion vulnerability in V8 (CVE-2024-12381) and a use-after-free in Translate (CVE-2024-12382). Both can be triggered via drive-by compromise when a user visits a malicious website. Successful exploitation allows an attacker to install programs, view/modify/delete data, or create new user accounts; the impact scales with the privileges of the compromised user account.

As of the advisory date, there are no confirmed reports of these vulnerabilities being exploited in the wild. However, the attack surface is broad—any user browsing the web with an unpatched Chrome installation is at risk. Organizations should prioritize patching immediately, with particular emphasis on systems where users run with administrative privileges. Mitigations include running Chrome in a sandboxed environment, enforcing least-privilege user accounts, enabling exploit protection features (DEP, Exploit Guard, SIP), and user training on social engineering and untrusted links.

## Mentioned in this report

- Vulnerabilities: CVE-2024-12381, CVE-2024-12382

## Detection guidance (public sample)

### Chrome Browser Spawning Shell or Script/LOLBin Child Process

ATT&CK: T1189

Detects chrome.exe spawning command shells, script hosts or common LOLBins, a typical post-exploitation sign after a browser RCE (V8 type confusion or Translate use-after-free) triggered by a drive-by page visit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Shell or Script/LOLBin Child Process
description: Detects chrome.exe spawning command shells, script hosts or common LOLBins.
  Chrome rarely launches these, so it is a strong post-exploitation sign after a browser
  RCE (V8 type confusion or Translate use-after-free) triggered by a drive-by page
  visit.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection and not filter_native_messaging
falsepositives:
- Browser extensions with native messaging hosts implemented as batch or PowerShell
  scripts
- Developers launching helper scripts from Chrome-based tooling
level: high
id: aef2c951-219c-551c-85a4-866b546aace0
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2024-136
```

### Chrome Browser Spawning Local Account Creation

ATT&CK: T1189

Detects chrome.exe spawning net.exe/net1.exe to add a user account, matching the stated impact of creating new user accounts after browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Local Account Creation
description: Detects chrome.exe as the parent of net.exe or net1.exe adding a user
  account, matching the impact described for Chrome RCE exploitation (creating new
  user accounts in the context of the logged-on user).
tags:
- attack.initial-access
- attack.t1189
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - user
    - /add
  condition: selection
falsepositives:
- Very unlikely; a managed browser extension host that provisions local accounts
level: critical
id: 2df568f4-83f4-56cd-93ed-c9bb1feb6ae4
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2024-136
```

### Chrome Browser Spawning Shell or Download Utility on Linux

ATT&CK: T1189

Detects the Linux Chrome binary spawning an interactive shell or network/scripting utilities, which may indicate post-exploitation after a drive-by browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Shell or Download Utility on Linux
description: Detects the Linux Chrome binary spawning a shell with a command string
  or network/scripting utilities, which may indicate post-exploitation after a drive-by
  browser exploit.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /chrome
    - /google-chrome
  selection_child:
    Image|endswith:
    - /bash
    - /sh
    - /dash
    - /curl
    - /wget
    - /nc
    - /ncat
    - /python
    - /python3
    - /perl
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
- Chrome launching shell wrapper scripts for xdg-open or desktop integration
- Native messaging hosts implemented as shell or Python scripts
level: medium
id: 92509b87-357e-5d04-96e0-fe55ebca3d42
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2024-136
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2024-136

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/645b001a-5bb6-59eb-b3d5-82ff6a54985a/google-chrome-rce-via-type-confusion-and-use-after-free.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup