# Chrome Patches Dozens of Memory-Safety Flaws

Published: 2026-10-28 · Severity: routine
Canonical: https://vorant.io/reports/e47e52ea-8b9e-58ae-a175-f5dce6038101/chrome-patches-dozens-of-memory-safety-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Google Chrome update fixes ~52 vulnerabilities, several allowing arbitrary code execution, with no known in-the-wild exploitation yet.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-122

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

MS-ISAC issued an advisory covering multiple vulnerabilities in Google Chrome versions prior to 156.0.8078.73/.74 (Windows/Mac) and 156.0.8078.73 (Linux). The flaws span memory corruption, use-after-free, and improper input validation issues across numerous Chrome components including V8, Skia, ANGLE, FileSystem, PDFium, WebRTC, and Media. The most severe vulnerabilities could allow an attacker to achieve arbitrary code execution in the context of the logged-on user via a drive-by compromise (visiting a malicious or compromised webpage), potentially enabling installation of programs, data manipulation, or creation of new accounts with full rights.

There are currently no reports of these vulnerabilities being exploited in the wild. Impact severity depends on user privilege level — accounts with fewer rights are less impacted than those with administrative privileges. The advisory lists over 50 distinct CVEs affecting a wide range of Chrome subsystems, consistent with a routine Chrome stable-channel security update bundling many individually reported bugs.

Defenders should apply Google's update immediately after testing, enforce least-privilege principles so browsers run under non-administrative accounts, enable OS-level anti-exploitation features (DEP, Exploit Guard, SIP/Gatekeeper), and use web/DNS filtering plus user training to reduce drive-by exposure. Automated patch management and vulnerability remediation processes (per CIS Safeguards 7.1/7.4/7.7) should ensure Chrome and other browsers remain fully updated across the enterprise.

## Mentioned in this report

- Vulnerabilities: CVE-2026-118304, CVE-2026-118305, CVE-2026-118306, CVE-2026-118307, CVE-2026-118311, CVE-2026-118313, CVE-2026-118315, CVE-2026-118317, CVE-2026-118318, CVE-2026-118319, CVE-2026-118320, CVE-2026-118321, CVE-2026-118322, CVE-2026-118327, CVE-2026-118328, CVE-2026-118329, CVE-2026-118331, CVE-2026-118332, CVE-2026-118333, CVE-2026-118334, CVE-2026-118336, CVE-2026-118337, CVE-2026-118338, CVE-2026-118339, CVE-2026-118340, CVE-2026-118343, CVE-2026-118344, CVE-2026-118345, CVE-2026-118347, CVE-2026-118348, CVE-2026-118349, CVE-2026-118350, CVE-2026-118351, CVE-2026-118352, CVE-2026-118353, CVE-2026-118354, CVE-2026-118355, CVE-2026-118357, CVE-2026-118358, CVE-2026-118359

## Detection guidance (public sample)

### Chrome Spawning Script Interpreter or Download LOLBin (Possible Browser Exploit)

ATT&CK: T1189

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Chrome starting a shell, script host or download/proxy-execution binary, a post-exploitation pattern after a drive-by browser exploit such as V8 or PDFium memory corruption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Spawning Script Interpreter or Download LOLBin (Possible Browser Exploit)
description: Detects chrome.exe directly spawning a command shell, PowerShell, script
  host or common download/proxy-execution binary. After a successful drive-by exploit
  (V8, Skia, ANGLE, PDFium, etc.) the payload commonly pivots to such processes. Legitimate
  Chrome rarely starts these directly.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection and not filter_native_messaging
falsepositives:
- Browser extensions with native messaging hosts implemented as batch or PowerShell
  scripts
- Enterprise tooling or developer workflows that launch helper scripts from Chrome
level: high
id: 8e87f44d-8dce-55fb-89d2-08a43b86e00a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-122
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-122

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e47e52ea-8b9e-58ae-a175-f5dce6038101/chrome-patches-dozens-of-memory-safety-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup