Google Chrome type confusion in V8 under active exploitation
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical type confusion flaw in Chrome V8 allows arbitrary code execution; actively exploited in the wild.
A type confusion vulnerability in Google Chrome's V8 JavaScript engine (CVE-2025-6554) allows remote attackers to achieve arbitrary code execution in the context of the logged-on user. The flaw is exploited via drive-by compromise—a victim visiting a malicious website can trigger the vulnerability without further interaction. CISA has confirmed active exploitation in the wild and added the CVE to its Known Exploited Vulnerabilities catalog.
The impact depends on user privileges: administrators face full system compromise including program installation and account creation; standard users are limited to that user's scope. Affected versions are Chrome 138.0.7204.96/.97 (Windows), 138.0.7204.92/.93 (Mac), and 138.0.7204.92 (Linux) and earlier. Mitigation requires immediate patching after testing, enforcement of least-privilege access, anti-exploitation features (DEP, WDEG, SIP), and DNS/URL filtering to block malicious sites that serve the exploit.
Mentioned in this report
Detection guidance
Chrome Renderer Process Spawning Non-Chrome Child Process
A Chrome renderer (--type=renderer) should only spawn further Chrome processes. Any other child suggests browser exploitation, such as a V8 type confusion leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Renderer Process Spawning Non-Chrome Child Process
description: Detects a sandboxed Chrome renderer process (--type=renderer) creating
a child process that is not Chrome itself. Renderers have no legitimate reason to
launch other binaries, so this indicates post-exploitation after a browser RCE such
as a V8 type confusion drive-by.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
ParentCommandLine|contains: --type=renderer
filter_chrome:
Image|endswith: \chrome.exe
condition: selection and not filter_chrome
falsepositives:
- Crash reporting or WER helpers launched during a renderer crash
- Security or DLP products that inject and spawn helper processes from the renderer
level: high
id: 0acda8d9-cbc4-5293-b02b-be3abd6058ad
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061
Chrome Browser Spawning Command Shell or Script Interpreter
chrome.exe directly spawning cmd, PowerShell, wscript, mshta or similar is uncommon and consistent with post-exploitation following a drive-by browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Command Shell or Script Interpreter
description: Detects chrome.exe launching shells, script hosts or common download/proxy-execution
LOLBins. After a drive-by V8 exploit, attackers running in the context of the user
often start these tools for payload staging or data exfiltration.
tags:
- attack.initial-access
- attack.t1189
- attack.exfiltration
- attack.t1048
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
filter_native_messaging:
CommandLine|contains: chrome-extension://
condition: selection and not filter_native_messaging
falsepositives:
- Native messaging hosts implemented as batch or PowerShell scripts for browser extensions
- Enterprise web apps that launch helper scripts through custom URL handlers
level: high
id: 4c54a517-cef3-573c-824a-f86deca54a18
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs