Chrome patches 74 flaws including exploited V8 bug
Google patched 74 vulnerabilities in Chrome 149.0.7827.102/103, including CVE-2026-11645, an exploited out-of-bounds memory access flaw in V8.
Google has released Chrome version 149.0.7827.102/103 for Windows and macOS, and 149.0.7827.102 for Linux, addressing 74 vulnerabilities. The most severe issue is CVE-2026-11645, an out-of-bounds memory access vulnerability in the V8 JavaScript engine that Google confirms is being actively exploited in the wild. The vulnerability could allow arbitrary code execution in the context of the logged-on user through drive-by compromise attacks.
The update addresses a wide range of memory corruption issues, predominantly use-after-free vulnerabilities affecting multiple Chrome components including Ozone, Bluetooth, V8, Views, Printing, and ServiceWorker. Additional flaws include integer overflows in libyuv and Media components, insufficient input validation in Extensions and UI components, and out-of-bounds read/write issues in Dawn, WebRTC, and GPU subsystems. Exploitation could enable attackers to install programs, modify or delete data, or create new accounts, with impact severity dependent on user privilege levels.
Organizations should prioritize immediate patching given the confirmed in-the-wild exploitation of CVE-2026-11645. The advisory recommends implementing automated patch management, restricting administrative privileges, enabling anti-exploitation features, and deploying defense-in-depth controls including DNS filtering and user awareness training to mitigate drive-by compromise risks.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Chrome Browser (Possible V8 Exploitation)
Detects command interpreters or living-off-the-land binaries spawned directly from chrome.exe, consistent with post-exploitation of a browser memory-corruption vulnerability such as the actively exploited V8 OOB flaw (CVE-2026-11645). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Chrome Browser (Possible V8 Exploitation)
id: 2c454120-7bac-534d-bf61-5c6745492f37
status: experimental
description: Detects command interpreters or LOLBins spawned as children of chrome.exe,
which is abnormal for legitimate browser operation and consistent with exploitation
of a browser memory-corruption vulnerability (e.g. V8 OOB access) leading to arbitrary
code execution.
references:
- Chrome 149.0.7827.102/103 security advisory (CVE-2026-11645)
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\chrome.exe
Image|endswith:
- \\cmd.exe
- \\powershell.exe
- \\pwsh.exe
- \\wscript.exe
- \\cscript.exe
- \\mshta.exe
- \\rundll32.exe
- \\regsvr32.exe
- \\wmic.exe
filter:
CommandLine|contains:
- --type=crashpad-handler
- --type=utility
- GoogleUpdate
condition: selection and not filter
falsepositives:
- Chrome native messaging hosts or extensions that legitimately invoke helper scripts
- Enterprise-managed Chrome update or diagnostics tooling that shells out from the
browser process
level: high
tags:
- attack.t1203
- attack.execution
author: Vorant
Local Account Creation Command Spawned from Browser Process Tree
Detects account-creation commands (net user /add) executed from a process tree rooted in chrome.exe, indicating post-exploitation impact after successful exploitation of a browser vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation Command Spawned from Browser Process Tree
id: 47dab701-eb60-574b-80d6-534bc952e4af
status: experimental
description: Detects execution of net user account-creation commands where the parent
process is chrome.exe, matching the impact stage of browser exploitation (arbitrary
code execution used to create new local accounts) described for the actively exploited
V8 flaw.
references:
- Chrome 149.0.7827.102/103 security advisory (CVE-2026-11645)
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \\chrome.exe
Image|endswith:
- \\net.exe
- \\net1.exe
CommandLine|contains|all:
- user
- add
condition: selection
falsepositives:
- Legitimate administrative scripts that happen to be launched through a browser-based
remote support tool (rare)
level: high
tags:
- attack.t1203
- attack.persistence
author: Vorant
Executable Dropped by Chrome Process Outside Normal Download Path
Detects chrome.exe writing executable or script files to filesystem locations other than the user's Downloads folder, which can indicate drive-by compromise payload delivery following exploitation of a rendering/engine vulnerability rather than a normal user-initiated download. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable Dropped by Chrome Process Outside Normal Download Path
id: 73c6378d-e3ad-57f1-a745-a652a555a6e2
status: experimental
description: Detects chrome.exe creating executable or script files outside the standard
Downloads directory, consistent with a drive-by compromise payload drop following
exploitation of a browser vulnerability such as the actively exploited V8 OOB flaw.
references:
- Chrome 149.0.7827.102/103 security advisory (CVE-2026-11645)
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \\chrome.exe
TargetFilename|endswith:
- .exe
- .dll
- .scr
- .ps1
- .hta
- .vbs
filter:
TargetFilename|contains:
- \\Downloads\\
- \\Google\\Chrome\\Application\\
- \\Google\\Update\\
condition: selection and not filter
falsepositives:
- Users manually downloading and saving executables or scripts to a non-default location
- Enterprise software deployment via browser-based portals that save installers outside
Downloads
level: medium
tags:
- attack.t1189
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-054
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free