Chrome Patches 36 Flaws, No Active Exploits

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Google Chrome versions before 155.0.8059.79/.80 contain 36 vulnerabilities, several enabling arbitrary code execution, with no known in-the-wild exploitation.

CISA/MS-ISAC issued an advisory covering 36 vulnerabilities in Google Chrome affecting versions prior to 155.0.8059.79/.80 on Windows, Mac, and Linux. The most severe issues are use-after-free and buffer-overflow flaws across multiple Chrome components (V8, PDF, Media, Network, Core, SVG, DOM, Bindings, Canvas, ShapeDetection, WebRTC, FileSystem, PDFium, Animation, ANGLE), which could allow an attacker to achieve arbitrary code execution in the context of the logged-in user. Additional issues include privilege elevation in the Installer, incorrect authorization in the Updater and Mojo components, an information leak in Passwords, and a missing-authorization issue in Reading Mode.

Exploitation would typically occur via a drive-by compromise vector — a user visiting a malicious or compromised webpage — consistent with MITRE ATT&CK technique T1189. Successful exploitation could let an attacker install programs, manipulate or delete data, or create new accounts with full privileges, with impact scaled by the privilege level of the logged-in user. There are currently no reports of these vulnerabilities being exploited in the wild.

Defenders should prioritize patching to Chrome 155.0.8059.79/.80 or later across all platforms through automated patch management, enforce least-privilege browsing (non-admin accounts), and enable anti-exploitation features (DEP, WDEG, SIP/Gatekeeper). Standard web-content restrictions (URL/DNS filtering, blocking risky file types) and user awareness training reduce the likelihood of successful drive-by exploitation while patches are rolled out.

title: Chrome Browser Spawning Script Interpreter or LOLBin on Windows
description: Detects chrome.exe spawning command shells, script hosts or common proxy-execution/download
  binaries. Chrome rarely launches these directly, so this pattern is consistent with
  code execution after a drive-by browser exploit (use-after-free or buffer overflow
  in V8, PDFium, ANGLE and similar). Behavioural, not tied to a specific CVE.
status: experimental
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \chrome.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
- Native messaging hosts or enterprise browser extensions that launch cmd.exe or PowerShell
  helper scripts
- Developers using Chrome-launched debugging or automation tooling that shells out
level: medium
id: f8fb50bb-e1bc-516b-a815-d7e8b6a05e74
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-116

title: Chrome Browser Spawning Shell or Download Utility on macOS
description: Detects Google Chrome on macOS spawning shells, osascript or download
  utilities. Legitimate Chrome rarely launches these directly, so this may indicate
  code execution following a browser exploit delivered via a malicious webpage.
status: experimental
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: /Google Chrome
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /zsh
    - /osascript
    - /curl
    - /python3
  condition: selection_parent and selection_child
falsepositives:
- Chrome extensions with native messaging hosts implemented as shell or Python scripts
- Developer tooling that launches Chrome and wraps it with shell helpers
level: medium
id: 22aff0bc-5620-5da7-aed4-45acaaf9432f
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-116

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-116