# Chrome Patches 36 Flaws, No Active Exploits

Published: 2026-10-14 · Severity: routine
Canonical: https://vorant.io/reports/9131e67b-c65c-553d-9e16-019c0065cfab/chrome-patches-36-flaws-no-active-exploits

> Google Chrome versions before 155.0.8059.79/.80 contain 36 vulnerabilities, several enabling arbitrary code execution, with no known in-the-wild exploitation.

CISA/MS-ISAC issued an advisory covering 36 vulnerabilities in Google Chrome affecting versions prior to 155.0.8059.79/.80 on Windows, Mac, and Linux. The most severe issues are use-after-free and buffer-overflow flaws across multiple Chrome components (V8, PDF, Media, Network, Core, SVG, DOM, Bindings, Canvas, ShapeDetection, WebRTC, FileSystem, PDFium, Animation, ANGLE), which could allow an attacker to achieve arbitrary code execution in the context of the logged-in user. Additional issues include privilege elevation in the Installer, incorrect authorization in the Updater and Mojo components, an information leak in Passwords, and a missing-authorization issue in Reading Mode.

Exploitation would typically occur via a drive-by compromise vector — a user visiting a malicious or compromised webpage — consistent with MITRE ATT&CK technique T1189. Successful exploitation could let an attacker install programs, manipulate or delete data, or create new accounts with full privileges, with impact scaled by the privilege level of the logged-in user. There are currently no reports of these vulnerabilities being exploited in the wild.

Defenders should prioritize patching to Chrome 155.0.8059.79/.80 or later across all platforms through automated patch management, enforce least-privilege browsing (non-admin accounts), and enable anti-exploitation features (DEP, WDEG, SIP/Gatekeeper). Standard web-content restrictions (URL/DNS filtering, blocking risky file types) and user awareness training reduce the likelihood of successful drive-by exploitation while patches are rolled out.

## Mentioned in this report

- Vulnerabilities: CVE-2026-110136, CVE-2026-110137, CVE-2026-110138, CVE-2026-110139, CVE-2026-110140, CVE-2026-110141, CVE-2026-110142, CVE-2026-110143, CVE-2026-110144, CVE-2026-110145, CVE-2026-110146, CVE-2026-110147, CVE-2026-110148, CVE-2026-110149, CVE-2026-110150, CVE-2026-110151, CVE-2026-110152, CVE-2026-110153, CVE-2026-110154, CVE-2026-110155, CVE-2026-110156, CVE-2026-110157, CVE-2026-110158, CVE-2026-110159, CVE-2026-110160, CVE-2026-110161, CVE-2026-110162, CVE-2026-110163, CVE-2026-110164, CVE-2026-110165, CVE-2026-110166, CVE-2026-110167, CVE-2026-110168, CVE-2026-110169, CVE-2026-110170, CVE-2026-110171, CVE-2026-110172

## Detection guidance (public sample)

### Chrome Browser Spawning Script Interpreter or LOLBin on Windows

ATT&CK: T1189

chrome.exe launching a shell, script host or download/proxy-execution LOLBin, a post-exploitation pattern after a drive-by browser exploit achieves code execution as the user. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Script Interpreter or LOLBin on Windows
description: Detects chrome.exe spawning command shells, script hosts or common proxy-execution/download
  binaries. Chrome rarely launches these directly, so this pattern is consistent with
  code execution after a drive-by browser exploit (use-after-free or buffer overflow
  in V8, PDFium, ANGLE and similar). Behavioural, not tied to a specific CVE.
status: experimental
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \chrome.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
- Native messaging hosts or enterprise browser extensions that launch cmd.exe or PowerShell
  helper scripts
- Developers using Chrome-launched debugging or automation tooling that shells out
level: medium
id: f8fb50bb-e1bc-516b-a815-d7e8b6a05e74
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-116
```

### Chrome Browser Spawning Shell or Download Utility on macOS

ATT&CK: T1189

Google Chrome on macOS launching a shell, osascript or a download utility, which may indicate post-exploitation after a drive-by browser compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Shell or Download Utility on macOS
description: Detects Google Chrome on macOS spawning shells, osascript or download
  utilities. Legitimate Chrome rarely launches these directly, so this may indicate
  code execution following a browser exploit delivered via a malicious webpage.
status: experimental
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: /Google Chrome
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /zsh
    - /osascript
    - /curl
    - /python3
  condition: selection_parent and selection_child
falsepositives:
- Chrome extensions with native messaging hosts implemented as shell or Python scripts
- Developer tooling that launches Chrome and wraps it with shell helpers
level: medium
id: 22aff0bc-5620-5da7-aed4-45acaaf9432f
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-116
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-116

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9131e67b-c65c-553d-9e16-019c0065cfab/chrome-patches-36-flaws-no-active-exploits.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup