Multiple Vulnerabilities in Google Chrome Patched in Stable Channel Update 154.0.8037.57 (GovCERT.HK A26-09-37)

Key facts

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2662 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Living-off-the-Land Binary Spawned with Chrome/GPU-Process Parent (Sandbox Escape Indicator)

Detects cmd.exe, powershell.exe, rundll32.exe, mshta.exe, wscript.exe, or cscript.exe spawned with a parent image of chrome.exe or a Chrome GPU/utility-process helper, excluding the legitimate Google Update parent chain. A renderer or GPU process that is memory-safety-sandboxed should never directly launch a shell or script interpreter; this pattern indicates the sandbox has been escaped after successful exploitation of one of the Chrome 154 Critical bugs (e.g. the GPU-process out-of-bounds writes CVE-2026-95357/CVE-2026-95322, or the ServiceWorker/Fullscreen/WindowDialog/AdFilter use-after-frees) and the attacker has achieved code execution outside the browser sandbox.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1203
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ParentImage="*\\chrome.exe" OR ParentImage="*\\chrome*helper*"
  Image IN ("*\\cmd.exe","*\\powershell.exe","*\\rundll32.exe","*\\mshta.exe","*\\wscript.exe","*\\cscript.exe")
  NOT ParentImage="*\\GoogleUpdate.exe"
  NOT (ParentCommandLine="*--type=crashpad-handler*")
| table _time, host, User, ParentImage, ParentCommandLine, Image, CommandLine
| eval risk_note="Chrome/GPU-process parent spawned a shell or script interpreter -- likely sandbox escape following exploitation of a Critical Chrome 154 memory-corruption bug (CVE-2026-95357, CVE-2026-95322, CVE-2026-95339, CVE-2026-95313, CVE-2026-95356, CVE-2026-95310)"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(1h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where InitiatingProcessCommandLine !has "--type=crashpad-handler"
| where InitiatingProcessParentFileName !~ "GoogleUpdate.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: LOLBin Spawned with Chrome Process Parent (Sandbox Escape Indicator)
id: 7c4a2b9e-1d3f-4e6a-8b5c-2d1e9f8a7c6b
status: experimental
description: Detects a shell or script interpreter (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe) launched with chrome.exe as its parent process, excluding the legitimate Crashpad/GoogleUpdate chain. This is not expected from a sandboxed renderer/GPU process and indicates a possible sandbox escape after exploitation of a Chrome memory-corruption vulnerability.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2079
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.execution
    - attack.t1203
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter_crashpad:
        ParentCommandLine|contains: '--type=crashpad-handler'
    filter_update:
        ParentImage|endswith: '\GoogleUpdate.exe'
    condition: selection_parent and selection_child and not filter_crashpad and not filter_update
falsepositives:
    - Chrome Native Messaging host launching a legitimate helper script for an installed browser extension
    - Enterprise browser-management agents that legitimately shell out from a Chrome-launched updater
level: high

Known false positives:

• Chrome Native Messaging host launching a legitimate helper script for an installed browser extension
• Enterprise browser-management agents that legitimately shell out from a Chrome-launched updater

Tuning notes: Maintain an allowlist of known-legitimate Native Messaging host executables per organization; exclude the Crashpad handler and GoogleUpdate parent chains explicitly rather than broadly excluding all chrome.exe children, so real sandbox-escape activity is not masked.

• 🔒 Vulnerable Chrome Build Browsing a Newly-Registered Domain (Pre-Patch Drive-By Exposure) · unlock with TL Creds
• 🔒 Chrome GPU-Process or Renderer Spawning a Script Interpreter Post-Crash · unlock with TL Creds
• 🔒 Post-Exploitation Callback from Non-Browser Process to Recently-Staged Infrastructure · unlock with TL Creds
• 🔒 Windows Error Reporting Heap-Corruption Exception in Chromium GPU/Renderer Process · unlock with TL Creds
• 🔒 Suspicious Child Process of Chrome Utility/GPU-Process Indicative of Renderer Sandbox Escape · unlock with TL Creds
• 🔒 DNS Query for Newly-Registered Domain from a Non-Browser Process on a Chrome-Exploited Host · unlock with TL Creds
• 🔒 Chromium Browser Crash Spike Indicative of ANGLE/WebGL/GPU Exploitation Attempt · unlock with TL Creds
• 🔒 Beaconing Network Connection from a Process Tree Rooted in Chrome Post-Exploitation · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2662.

Technical analysis

On 2026-09-22, Google shipped a Chrome Stable Channel Update for Desktop bringing Chrome to version 154.0.8037.57 on Linux and 154.0.8037.57/.58 on Windows and macOS. The release addresses 108 security vulnerabilities: 11 rated Critical, 25 rated High, 47 rated Medium, and 25 rated Low. Google's own security team found 76 of the 108 issues internally; the remaining 32 were reported by external researchers, who collectively received $18,000 in bug-bounty payouts. Chrome for Android (154.0.8037.57) and Chrome for iOS (154.0.8037.55) received the same fixes within the same release window.

The 11 Critical-rated bugs are concentrated in Chrome's graphics and process-isolation stack: three buffer overflows in ANGLE (Chrome's cross-platform graphics abstraction layer, including CVE-2026-95350, credited to a STAR Labs SG Pte. Ltd. team of Billy Jheng Bing Jhong, Muhammad Alifa Ramdhan, and Pan Zhenpeng for a $5,000 bounty), a buffer overflow and an out-of-bounds write in WebGL, two out-of-bounds writes in the GPU process (one, CVE-2026-95357, paid a $2,500 bounty), and four use-after-free bugs spanning ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Among the 25 High-severity fixes are an out-of-bounds write (CVE-2026-95304) and a type-confusion bug (CVE-2026-95306) in the V8 JavaScript engine; CVE-2026-95306 was credited to 'OpenAI Codex Security,' a notable early example of an AI-assisted vulnerability-research effort receiving public credit in a Chrome security bulletin.

GovCERT.HK (Hong Kong's Government Computer Emergency Response Team) published Security Alert A26-09-37 on 2026-09-23, summarizing the update and warning that 'a remote attacker could entice a user to open a web page with specially crafted content on a vulnerable browser to exploit the vulnerabilities,' with potential impact of remote code execution, denial of service, or tampering. The advisory lists the affected CVEs as three ranges (CVE-2026-95274 to CVE-2026-95376, CVE-2026-95380 to CVE-2026-95382, CVE-2026-95384 to CVE-2026-95385) rather than a fully enumerated list, and does not assign a CVSS score or classify the alert as a 'High Threat' bulletin. Google's practice of withholding technical bug details until a majority of the installed base has updated means most individual CVEs in this batch are not yet indexed in NVD. As of this research, none of the CVE-2026-953xx range appears in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exploit code has surfaced; this distinguishes the batch from the unrelated, earlier V8 type-confusion zero-day (CVE-2026-85046, fixed in Chrome 152.0.7977.82/.83 and added to CISA KEV on 2026-09-04), which is a separate, already-patched issue from a prior release and is not part of this advisory.

Because Chromium is the shared upstream for Chrome, Chromium-based third-party browsers (Microsoft Edge, Brave, Opera, Vivaldi) and forks (Ungoogled Chromium, which shipped a matching 154.0.8037.57-1 build) inherit the same vulnerable ANGLE/WebGL/GPU/V8/ServiceWorker code paths and require their own vendor updates to receive equivalent fixes.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Stealth

T1211 Exploitation for Stealth

Impact

T1499.004 Application or System Exploitation

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities; T1608.004 Drive-by Target

Remediation

Patches

• Google Chrome 154.0.8037.57 (Desktop, Linux)
• Google Chrome 154.0.8037.57/.58 (Desktop, Windows and macOS)
• Google Chrome for Android 154.0.8037.57
• Google Chrome for iOS 154.0.8037.55

Immediate actions

• Update Google Chrome to 154.0.8037.57 or later on Linux, and 154.0.8037.57/.58 or later on Windows and macOS, via chrome://settings/help, then relaunch the browser
• Update Chrome for Android to 154.0.8037.57 or later
• Update Chrome for iOS to 154.0.8037.55 or later
• Update any Chromium-based browser (Microsoft Edge, Brave, Opera, Vivaldi) or fork (Ungoogled Chromium) to its own vendor build that incorporates the equivalent ANGLE/WebGL/GPU/V8/ServiceWorker fixes

Workarounds

• No effective workaround short of updating; disabling JavaScript, WebGL, or hardware/GPU acceleration may reduce exposure to specific bug classes but does not substitute for patching and is not recommended as a standing control

Longer-term hardening

• Enforce timely browser patching via enterprise policy (e.g. Chrome Browser Cloud Management) rather than relying solely on end-user auto-update
• Keep Chrome's sandboxing and Site Isolation settings at their default/enforced levels to limit the impact of renderer- and GPU-process memory-corruption bugs
• Track GovCERT.HK and Chrome release-blog advisories for this recurring monthly-to-biweekly Chrome vulnerability-batch pattern

Affected and fixed versions

• Google — Chrome (Desktop - Linux)
  Vulnerable versions: prior to 154.0.8037.57
  Fixed in: 154.0.8037.57
• Google — Chrome (Desktop - Windows)
  Vulnerable versions: prior to 154.0.8037.57
  Fixed in: 154.0.8037.57; 154.0.8037.58
• Google — Chrome (Desktop - macOS)
  Vulnerable versions: prior to 154.0.8037.57
  Fixed in: 154.0.8037.57; 154.0.8037.58
• Google — Chrome for Android
  Vulnerable versions: prior to 154.0.8037.57
  Fixed in: 154.0.8037.57
• Google — Chrome for iOS
  Vulnerable versions: prior to 154.0.8037.55
  Fixed in: 154.0.8037.55

Timeline

• 2026-09-22 Coverage noted the update would roll out gradually over the following days and weeks rather than reaching all users simultaneously, consistent with Chrome's standard staged-rollout practice.
• 2026-09-22 Google shipped Chrome for Android 154.0.8037.57 in the same window, addressing the same vulnerability set as the desktop release.
• 2026-09-22 Google published a Chrome Stable Channel Update for Desktop, shipping Chrome 154.0.8037.57 (Linux) and 154.0.8037.57/.58 (Windows and macOS), fixing 108 security vulnerabilities including 11 Critical and 25 High-severity issues.
• 2026-09-23 Security press reported that Google found 76 of the 108 fixed bugs internally, while 32 were reported by external researchers who received a combined $18,000 in bug bounties, including a $5,000 award for the ANGLE buffer overflow CVE-2026-95350 (STAR Labs SG Pte. Ltd.) and public credit to 'OpenAI Codex Security' for the V8 type-confusion flaw CVE-2026-95306.
• 2026-09-23 GovCERT.HK published Security Alert A26-09-37, 'Multiple Vulnerabilities in Google Chrome,' summarizing the update as a routine (non-High-Threat) advisory and directing users to patch to 154.0.8037.57 or later.
• 2026-09-23 Google shipped Chrome for iOS 154.0.8037.55, extending the fix set to Apple's iOS/iPadOS build of Chrome.
• 2026-09-26 As of this research, none of the CVE-2026-95274 to CVE-2026-95385 range appears in CISA's Known Exploited Vulnerabilities catalog, and NVD has not yet published individual CVE records for the batch, consistent with Google's practice of withholding technical bug details until most users have updated.

Sources cited

• Security Alert (A26-09-37): Multiple Vulnerabilities in Google Chrome govcert.gov.hk · Advisory · 2026-09-23
• Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-09-26
• Stable Channel Update for Desktop chromereleases.googleblog.com · Vendor report · 2026-09-22
• Update Chrome: 108 security fixes for desktop, new release for Android malwarebytes.com · News · 2026-09-23
• Chrome 154 fixes 108 security flaws, including 11 critical bugs pcworld.com · News · 2026-09-23
• Chrome Patches 108 Vulnerabilities Including Critical Flaws that Enable Code Execution Attacks cybersecuritynews.com · News · 2026-09-23
• Chrome 154 Patches 108 Vulnerabilities SecurityWeek · News · 2026-09-23
• Chrome 154 Release Patches 108 Security Vulnerabilities securityonline.info · News · 2026-09-23
• Chrome 154: 108 Patches, 11 Critical GPU and V8 Flaws byteiota.com · News · 2026-09-23

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Previous and next in vulnerability

• Microsoft Office / Microsoft 365 Apps for Enterprise Remote Code Execution Vulnerability (CVE-2026-70125) Previous report
• CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth Bypass (CVE-2026-67279) Next report