Chrome patches 74 flaws including exploited V8 bug
Google patched 74 vulnerabilities in Chrome 149.0.7827.102/103, including CVE-2026-11645, an exploited out-of-bounds memory access flaw in V8.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-11645 as exploited in the wild.
Google has released Chrome version 149.0.7827.102/103 for Windows and macOS, and 149.0.7827.102 for Linux, addressing 74 vulnerabilities. The most severe issue is CVE-2026-11645, an out-of-bounds memory access vulnerability in the V8 JavaScript engine that Google confirms is being actively exploited in the wild. The vulnerability could allow arbitrary code execution in the context of the logged-on user through drive-by compromise attacks.
The update addresses a wide range of memory corruption issues, predominantly use-after-free vulnerabilities affecting multiple Chrome components including Ozone, Bluetooth, V8, Views, Printing, and ServiceWorker. Additional flaws include integer overflows in libyuv and Media components, insufficient input validation in Extensions and UI components, and out-of-bounds read/write issues in Dawn, WebRTC, and GPU subsystems. Exploitation could enable attackers to install programs, modify or delete data, or create new accounts, with impact severity dependent on user privilege levels.
Organizations should prioritize immediate patching given the confirmed in-the-wild exploitation of CVE-2026-11645. The advisory recommends implementing automated patch management, restricting administrative privileges, enabling anti-exploitation features, and deploying defense-in-depth controls including DNS filtering and user awareness training to mitigate drive-by compromise risks.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Chrome Browser (Possible V8 Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command interpreters or living-off-the-land binaries spawned directly from chrome.exe, consistent with post-exploitation of a browser memory-corruption vulnerability such as the actively exploited V8 OOB flaw (CVE-2026-11645). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Chrome Browser (Possible V8 Exploitation)
id: 2c454120-7bac-534d-bf61-5c6745492f37
status: experimental
description: Detects command interpreters or LOLBins spawned as children of chrome.exe,
which is abnormal for legitimate browser operation and consistent with exploitation
of a browser memory-corruption vulnerability (e.g. V8 OOB access) leading to arbitrary
code execution.
references:
- Chrome 149.0.7827.102/103 security advisory (CVE-2026-11645)
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\chrome.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\mshta.exe
- \\rundll32.exe
- \\regsvr32.exe
- \\wmic.exe
filter:
CommandLine|contains:
- --type=crashpad-handler
- --type=utility
- GoogleUpdate
condition: selection and not filter
falsepositives:
- Chrome native messaging hosts or extensions that legitimately invoke helper scripts
- Enterprise-managed Chrome update or diagnostics tooling that shells out from the
browser process
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Local Account Creation Command Spawned from Browser Process Tree
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects account-creation commands (net user /add) executed from a process tree rooted in chrome.exe, indicating post-exploitation impact after successful exploitation of a browser vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation Command Spawned from Browser Process Tree
id: 47dab701-eb60-574b-80d6-534bc952e4af
status: experimental
description: Detects execution of net user account-creation commands where the parent
process is chrome.exe, matching the impact stage of browser exploitation (arbitrary
code execution used to create new local accounts) described for the actively exploited
V8 flaw.
references:
- Chrome 149.0.7827.102/103 security advisory (CVE-2026-11645)
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\chrome.exe
Image|endswith:
- \\net.exe
- \\net1.exe
CommandLine|contains|all:
- user
- add
condition: selection
falsepositives:
- Legitimate administrative scripts that happen to be launched through a browser-based
remote support tool (rare)
level: high
tags:
- attack.t1203
- attack.persistence
author: Vorant
Executable Dropped by Chrome Process Outside Normal Download Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects chrome.exe writing executable or script files to filesystem locations other than the user's Downloads folder, which can indicate drive-by compromise payload delivery following exploitation of a rendering/engine vulnerability rather than a normal user-initiated download. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable Dropped by Chrome Process Outside Normal Download Path
id: 73c6378d-e3ad-57f1-a745-a652a555a6e2
status: experimental
description: Detects chrome.exe creating executable or script files outside the standard
Downloads directory, consistent with a drive-by compromise payload drop following
exploitation of a browser vulnerability such as the actively exploited V8 OOB flaw.
references:
- Chrome 149.0.7827.102/103 security advisory (CVE-2026-11645)
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \\chrome.exe
TargetFilename|endswith:
- .exe
- .dll
- .scr
- .ps1
- .hta
- .vbs
filter:
TargetFilename|contains:
- \\Downloads\\
- \\Google\\Chrome\\Application\\
- \\Google\\Update\\
condition: selection and not filter
falsepositives:
- Users manually downloading and saving executables or scripts to a non-default location
- Enterprise software deployment via browser-based portals that save installers outside
Downloads
level: medium
tags:
- attack.t1189
- attack.initial-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-054
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs