Chrome zero-day CVE-2026-5281 exploited in wild
Google Chrome has multiple vulnerabilities, including an actively exploited zero-day, that could let attackers execute arbitrary code on victim systems.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 21 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-5281 as exploited in the wild.
CIS/MS-ISAC issued an advisory covering a batch of Chrome vulnerabilities patched in version 146.0.7680.177/178, the most severe allowing arbitrary code execution in the context of the logged-on user. Google has confirmed that an exploit for CVE-2026-5281, a use-after-free vulnerability in the Dawn component, exists in the wild, making it the priority patch item among the disclosed flaws.
The remaining vulnerabilities span use-after-free, heap buffer overflow, integer overflow, and out-of-bounds read issues across Chrome components including CSS, GPU, Codecs, ANGLE, WebUSB, Web MIDI, V8, WebCodecs, WebGL, PDF, WebView, Navigation, and Compositing. Successful exploitation could allow an attacker to install programs, manipulate or delete data, or create new accounts with full privileges, with impact scaled to the privileges of the logged-on user. Exploitation is associated with drive-by compromise as an initial access vector.
Organizations are urged to apply Google's updates immediately, enforce least privilege, restrict web-based content, and enable anti-exploitation features given confirmed in-the-wild exploitation of at least one of the flaws.
Mentioned in this report
Detection guidance
Chrome Process Spawning High-Privilege Child Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Chrome.exe or related process spawning system utilities (rundll32, powershell, cmd, regsvcs) after handling untrusted content—post-exploitation code execution from CVE-2026-5281 or similar browser RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Process Spawning High-Privilege Child Process
description: Detects chrome.exe or GoogleUpdate spawning suspicious child processes
(rundll32, powershell, cmd, regsvcs, msiexec) - typical post-exploitation code execution
from browser RCE vulnerabilities like CVE-2026-5281. Excludes benign updater activity.
tags:
- attack.execution
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \chrome.exe
- \GoogleUpdate.exe
Image|endswith:
- \rundll32.exe
- \powershell.exe
- \cmd.exe
- \regsvcs.exe
- \msiexec.exe
filter_update:
CommandLine|contains:
- /c del
- /update
- /install
- GoogleUpdate
condition: selection and not filter_update
falsepositives:
- Chrome extensions legitimately spawning rundll32 for media codecs or plugin initialization
- GoogleUpdate spawning msiexec during background patching
level: high
id: 1318b4c0-7a05-5269-b902-7f5e0a83fe68
status: experimental
author: Vorant
Chrome Process Writing Executable to Disk in User Writable Location
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Chrome.exe writing .exe, .dll, or .scr files to %TEMP%, %APPDATA%, or Downloads—post-exploitation payload staging from CVE-2026-5281 or related RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Process Writing Executable to Disk in User Writable Location
description: Detects chrome.exe writing executable files (.exe, .dll, .scr, .bat,
.cmd, .ps1) to user-writable locations (%TEMP%, %APPDATA%, Downloads) - post-exploitation
payload staging from browser RCE vulnerabilities.
tags:
- attack.execution
- attack.t1189
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \chrome.exe
TargetFilename|contains:
- \AppData\Local\Temp\
- \AppData\Roaming\
- \Downloads\
TargetFilename|endswith:
- .exe
- .dll
- .scr
- .bat
- .cmd
- .ps1
filter_chrome_cache:
TargetFilename|contains:
- \AppData\Local\Google\Chrome\User Data\Cache
- \AppData\Local\Google\Chrome\User Data\Code Cache
condition: selection and not filter_chrome_cache
falsepositives:
- Chrome installer staging temporary files during auto-update
- Browser extensions legitimately downloading and caching binaries in user temp
level: high
id: 1b96146c-42e4-5c93-97b8-cd3ec8d33267
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-028
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs