Google Chrome RCE via Loader and Mojo flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Google Chrome versions before 136.0.7103.113/.114 allow arbitrary code execution via two unpatched vulnerabilities; no active exploitation reported yet.
Google has disclosed two vulnerabilities in Chrome that allow arbitrary code execution in the context of the logged-on user. CVE-2025-4664 is an insufficient policy enforcement flaw in Loader, and CVE-2025-4609 involves an incorrect handle in Mojo under unspecified circumstances. Both are reachable via drive-by compromise tactics during initial access. Exploitation success depends on the privileges of the compromised user; attackers with admin-level access can install programs, view or delete data, or create new accounts with full rights. The advisory notes no current in-the-wild exploitation.
Affected versions are Chrome prior to 136.0.7103.113/.114 for Windows and macOS, and prior to 136.0.7103.113 for Linux. CIS-ISAC recommends immediate patching after testing, enforcement of least-privilege principles to limit blast radius, and standard browser hygiene controls including DNS filtering, URL filtering, and restriction of malicious file types at the email gateway. Anti-exploitation features such as DEP, Exploit Guard, or SIP should be enabled where available.
Mentioned in this report
Detection guidance
Chrome Browser Spawning Script Interpreter or LOLBin on Windows
Chrome spawning cmd, PowerShell, script hosts or common LOLBins, a post-exploitation pattern after a browser RCE such as the Loader or Mojo flaws reached by drive-by. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Script Interpreter or LOLBin on Windows
description: Detects chrome.exe directly spawning shells, script hosts or common living-off-the-land
binaries. Chrome rarely does this, so it can indicate code execution after a browser
exploit (drive-by compromise, e.g. CVE-2025-4664 / CVE-2025-4609). Chrome's own
helper processes are chrome.exe and are not matched.
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
filter_native_messaging:
CommandLine|contains: chrome-extension://
condition: selection and not filter_native_messaging
falsepositives:
- Native messaging hosts or browser extensions that launch helper scripts through
cmd.exe
- Enterprise web apps that launch local handlers through Chrome custom protocol handlers
level: medium
id: 1649e4f5-4807-550b-9cbd-c1f3c7e081de
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-052
Chrome Browser Spawning Shell on Linux
Chrome on Linux spawning an interactive shell or downloader utility, which may indicate code execution after exploitation of a browser flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Shell on Linux
description: Detects the Chrome binary directly spawning a shell or network utility
on Linux, which may indicate post-exploitation after a drive-by browser exploit.
Excludes the xdg-open and xdg-* helper scripts that Chrome legitimately launches.
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /chrome
- /google-chrome
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /curl
- /wget
- /nc
- /python3
filter_xdg:
CommandLine|contains: xdg-
condition: selection and not filter_xdg
falsepositives:
- Chrome launching external protocol handlers or desktop integration scripts through
a shell
- Developer workflows that start helper scripts from Chrome
level: medium
id: 4978f420-dbe8-549d-95b6-b585f4bf2713
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-052
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-052
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs