Chrome buffer overflow in Metal renderer exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple Chrome vulnerabilities including unpatched buffer overflow in graphics library allow arbitrary code execution; active exploitation confirmed.
Google has disclosed multiple vulnerabilities in Chrome affecting versions prior to 143.0.7499.109/.110 on Windows and macOS, and 143.0.7499.109 on Linux. The most severe is a buffer overflow in the ANGLE graphics library's Metal renderer, where buffer sizes are incorrectly calculated using pixelsDepthPitch derived from GL_UNPACK_IMAGE_HEIGHT. Because this value may be smaller than the actual image height, attackers can trigger buffer overflows leading to memory corruption, crashes, or arbitrary code execution in the context of the logged-on user. Google confirms this vulnerability is being actively exploited in the wild; no CVE has been assigned and it remains under coordination.
Two additional vulnerabilities were disclosed: a use-after-free in Password Manager (CVE-2025-14372) and an inappropriate implementation in Toolbar (CVE-2025-14373). Successful exploitation allows arbitrary code execution with the privileges of the logged-on user, potentially enabling installation of programs, data modification or deletion, and creation of new accounts with full user rights. Users with standard (non-administrative) privileges experience reduced impact.
Defenders should prioritize immediate patching of Chrome to version 143.0.7499.109 or later. CIS recommends enforcing automated patch management, applying principle of least privilege, enabling exploit protection features, and restricting browser extensions and downloaded content.
Mentioned in this report
Detection guidance
Chrome Browser Process Spawning Command Shell or Script Interpreter
Detects chrome.exe launching shells, script hosts or LOLBins, which is a typical post-exploitation pattern after a browser memory-corruption exploit delivered via drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Process Spawning Command Shell or Script Interpreter
description: Detects chrome.exe launching a command shell, script host or common LOLBin.
After a drive-by browser exploit (e.g. the ANGLE Metal buffer overflow or other
Chrome memory-corruption bugs) arbitrary code runs as the logged-on user and often
starts a shell or downloader. Chrome rarely spawns these directly.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Browser-launched helper scripts or enterprise extensions/native messaging hosts
that invoke cmd.exe or PowerShell
- Developers launching tooling through Chrome-integrated debugging workflows
level: high
id: 97f89ebf-3c74-5832-9152-a6f7a46e4f5a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-115
Chrome Renderer Process Spawning Unexpected Child Process
Detects a sandboxed Chrome renderer process creating a non-Chrome child process, indicating a possible renderer exploit or sandbox escape. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Renderer Process Spawning Unexpected Child Process
description: Detects a Chrome renderer process (--type=renderer) creating a child
process other than chrome.exe. Renderers run in a restrictive sandbox and normally
never spawn external programs, so this suggests exploitation of a renderer or graphics-stack
memory corruption bug followed by code execution.
tags:
- attack.stealth
- attack.t1055
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
ParentCommandLine|contains: --type=renderer
filter_chrome:
Image|endswith: \chrome.exe
filter_werfault:
Image|endswith: \WerFault.exe
condition: selection and not filter_chrome and not filter_werfault
falsepositives:
- Crash reporting helpers started from a renderer after a crash
- Security products that inject helper processes into browser processes
level: high
id: 8e78496d-43f4-5619-9027-b9e51d675142
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-115
Google Chrome Spawning Shell or Download Utility on macOS
Detects Google Chrome (or its helpers) spawning shells, osascript or curl on macOS, consistent with code execution after a browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Google Chrome Spawning Shell or Download Utility on macOS
description: Detects Google Chrome or Chrome Helper processes spawning a shell, osascript
or curl on macOS. Chrome does not normally launch these, so the pattern can indicate
arbitrary code execution after exploitation of a browser vulnerability such as the
ANGLE Metal renderer overflow.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains: Google Chrome
Image|endswith:
- /sh
- /bash
- /zsh
- /osascript
- /curl
condition: selection
falsepositives:
- Chrome updater or enterprise management scripts invoking a shell
- Developer tooling that launches shell commands from a Chrome-driven automation session
level: high
id: f39376fd-9009-5a29-bbe1-2e531e5e90c4
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-115
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-115
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs