Chrome Patches Dozens of Memory-Safety Flaws
Google Chrome update fixes ~52 vulnerabilities, several allowing arbitrary code execution, with no known in-the-wild exploitation yet.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
MS-ISAC issued an advisory covering multiple vulnerabilities in Google Chrome versions prior to 156.0.8078.73/.74 (Windows/Mac) and 156.0.8078.73 (Linux). The flaws span memory corruption, use-after-free, and improper input validation issues across numerous Chrome components including V8, Skia, ANGLE, FileSystem, PDFium, WebRTC, and Media. The most severe vulnerabilities could allow an attacker to achieve arbitrary code execution in the context of the logged-on user via a drive-by compromise (visiting a malicious or compromised webpage), potentially enabling installation of programs, data manipulation, or creation of new accounts with full rights.
There are currently no reports of these vulnerabilities being exploited in the wild. Impact severity depends on user privilege level — accounts with fewer rights are less impacted than those with administrative privileges. The advisory lists over 50 distinct CVEs affecting a wide range of Chrome subsystems, consistent with a routine Chrome stable-channel security update bundling many individually reported bugs.
Defenders should apply Google's update immediately after testing, enforce least-privilege principles so browsers run under non-administrative accounts, enable OS-level anti-exploitation features (DEP, Exploit Guard, SIP/Gatekeeper), and use web/DNS filtering plus user training to reduce drive-by exposure. Automated patch management and vulnerability remediation processes (per CIS Safeguards 7.1/7.4/7.7) should ensure Chrome and other browsers remain fully updated across the enterprise.
Mentioned in this report
Detection guidance
Chrome Spawning Script Interpreter or Download LOLBin (Possible Browser Exploit)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Chrome starting a shell, script host or download/proxy-execution binary, a post-exploitation pattern after a drive-by browser exploit such as V8 or PDFium memory corruption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Spawning Script Interpreter or Download LOLBin (Possible Browser Exploit)
description: Detects chrome.exe directly spawning a command shell, PowerShell, script
host or common download/proxy-execution binary. After a successful drive-by exploit
(V8, Skia, ANGLE, PDFium, etc.) the payload commonly pivots to such processes. Legitimate
Chrome rarely starts these directly.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_native_messaging:
CommandLine|contains: chrome-extension://
condition: selection and not filter_native_messaging
falsepositives:
- Browser extensions with native messaging hosts implemented as batch or PowerShell
scripts
- Enterprise tooling or developer workflows that launch helper scripts from Chrome
level: high
id: 8e87f44d-8dce-55fb-89d2-08a43b86e00a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-122
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-122
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,323 reports from 144 sources, 587 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs