Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)

Key facts for Chrome 157 security update

Detection coverage for Chrome 157 security update

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5230 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chrome 157 Critical CVEs — Browser Process Spawning Shell, Script Host or LOLBin (SPL)

Detects chrome.exe spawning a command shell, script host or living-off-the-land binary. Post-exploitation behaviour that follows successful memory-corruption exploitation of the Chrome 157 critical bugs (Dawn CVE-2026-121156 / CVE-2026-121247, ANGLE CVE-2026-121229, WebGL CVE-2026-121246, Prerender CVE-2026-121035, Geometry CVE-2026-121203, Core CVE-2026-121126) reached via a crafted HTML page (T1189, T1203). Google has not reported exploitation of these CVEs; this is behaviour-first coverage that fires regardless of which bug is used. Chrome below 157.0.8103.38 is affected. Child-process list covers PowerShell (T1059.001), cmd (T1059.003), mshta (T1218.005), regsvr32 (T1218.010) and rundll32 (T1218.011) execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1189, T1059.001, T1059.003, T1218.005, T1218.010, T1218.011
• Data sources: sysmon, windows_process_creation, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\chrome.exe" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\msiexec.exe") | table _time ComputerName User ParentImage ParentCommandLine Image CommandLine

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: Chrome Browser Process Spawning Script Interpreter or LOLBin (Chrome 157 Critical CVEs)
id: 3f7a1c52-8b4e-4d19-9a63-5c2e0b7d1a01
status: experimental
description: Detects chrome.exe spawning a shell, script host or LOLBin, a post-exploitation indicator for memory-corruption exploitation of Chrome before 157.0.8103.38 (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126).
references:
  - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
  - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121156
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial-access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1218.005
  - attack.t1218.010
  - attack.t1218.011
  - cve.2026.121156
  - cve.2026.121247
  - cve.2026.121229
  - cve.2026.121246
  - cve.2026.121035
  - cve.2026.121203
  - cve.2026.121126
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msiexec.exe'
  condition: selection
falsepositives:
  - Chrome native messaging hosts or enterprise extensions that launch helper scripts
  - Administrators launching a shell via a Chrome-hosted web terminal protocol handler
level: high

Known false positives:

• Chrome native messaging hosts or enterprise extensions that legitimately launch cmd.exe or PowerShell helpers
• Custom URL protocol handlers or kiosk/web-terminal tooling that start scripts from the browser

Tuning notes: Baseline for one week and exclude known extension/native-host command lines via ParentCommandLine or CommandLine. Confirm Sysmon EventCode 1 is collected into index=sysmon (rename index/sourcetype to match your environment). Prioritise hits on hosts running Chrome below 157.0.8103.38. macOS/Linux endpoints need an EDR or Sysmon-for-Linux analogue.

• 🔒 Chrome 157 Critical CVEs — Chrome-Spawned Download Cradle / Ingress Tool Transfer (KQL) · unlock with TL Creds
• 🔒 Chrome 157 Lure — Fake Chrome Installer Executed Without Google Signature (KQL) · unlock with TL Creds
• 🔒 Chrome 157 Release Window — Community-Reported Google/Chrome Lure Domain Contact (KQL) · unlock with TL Creds
• 🔒 Chrome 157 Critical CVEs — Non-Chrome Process Targeting Chrome Credential/Cookie Stores (Sigma) · unlock with TL Creds
• 🔒 Chrome 157 Critical CVEs — Chrome Dropping Executables or Scripts to Temp/ProgramData/Startup (Sigma) · unlock with TL Creds
• 🔒 Chrome 157 Critical CVEs — Chrome Launched With Sandbox Disabled, Debug Port or Side-Loaded Extension (Sigma) · unlock with TL Creds
• 🔒 Chrome 157 Critical CVEs — Sandboxed Chrome Child Spawning Foreign Process, Sandbox Escape (SPL) · unlock with TL Creds
• 🔒 Chrome 157 Critical CVEs — Repeated Chrome Memory-Corruption Crashes (SPL) · unlock with TL Creds

Indicators of compromise for Chrome 157 security update

As of 2026-11-04, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5230.

Sample indicators (2 of 6)

• URL: hxxps://issues[.]chromium[.]org/issues/567735302
• URL: hxxps://chromereleases[.]googleblog[.]com/2026/11/stable-channel-update-for-desktop.html

Defanged, TLP:CLEAR. Full set of 6 indicators: unlock with TL Creds.

How Chrome 157 security update works

Chrome 157 stable (157.0.8103.38 for Linux; 157.0.8103.38/.39 for Windows and macOS) was announced on the Chrome Releases blog on 2026-11-03 and rolls out to users over the coming days and weeks. The release fixes 213 security bugs, seven of which carry the Chromium Critical rating.

The critical issues are: CVE-2026-121156 (buffer overflow in Dawn, the WebGPU implementation; reported 2026-09-30 by Zhenpeng 'Leo' Lin of depthfirst; $10,000 bounty), CVE-2026-121247 (buffer overflow in Dawn; reported by Google 2026-10-03), CVE-2026-121229 (memory corruption in ANGLE; reported 2026-09-17 by @mfx; $1,000 bounty; the NVD description scopes it to Chrome on Android), CVE-2026-121246 (use-after-free in WebGL; reported by Google), CVE-2026-121035 (use-after-free in Prerender; reported by Xinyang Ge of Anthropic), CVE-2026-121203 (use-after-free in Geometry; reported by Xinyang Ge of Anthropic) and CVE-2026-121126 (use-after-free in Core; reported by Wenbin Liu). Other fixes in the release include BackgroundFetch (incorrect authorization), ANGLE (out-of-bounds access), V8 (type confusion), PDFium and Media.

NVD records for CVE-2026-121156, CVE-2026-121229 and CVE-2026-121035 (all published 2026-11-03) score the issues 9.6 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. They describe a remote attacker potentially executing arbitrary code outside the sandbox via a crafted HTML page. The CWEs are CWE-122 (Dawn), CWE-119 (ANGLE) and CWE-416 (Prerender). The NVD records for the other four CVEs were not retrieved, so the score is applied to the release as a whole on the basis of the three that were. Google withholds bug details until most users are updated. No active exploitation, public PoC, IOCs or attribution is stated in the sources.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Remediation for Chrome 157 security update

Patches

• Chrome 157.0.8103.38 (Linux)
• Chrome 157.0.8103.38/.39 (Windows and macOS)

Immediate actions

• Update Google Chrome to 157.0.8103.38 (Linux) or 157.0.8103.38/.39 (Windows/macOS) or later and relaunch the browser
• Verify deployed Chrome versions across the fleet via endpoint inventory and flag installs older than 157.0.8103.38

Workarounds

• No vendor workaround stated; limit browsing of untrusted sites on unpatched browsers until updated

Longer-term hardening

• Enforce automatic browser updates and a maximum browser-version-age policy
• Track Chrome Releases blog and CISA KEV for later exploitation reports on these CVEs

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: prior to 157.0.8103.38
  Fixed in: 157.0.8103.38 (Linux); 157.0.8103.38/.39 (Windows/macOS)

Timeline of Chrome 157 security update

• 2026-09-17 CVE-2026-121229 (locked-ioc-5 memory corruption) reported to Google by @mfx
• 2026-09-30 CVE-2026-121156 (Dawn buffer overflow) reported by Zhenpeng 'Leo' Lin of depthfirst
• 2026-10-03 CVE-2026-121247 (Dawn buffer overflow) reported by Google
• 2026-11-03 NVD published records for the critical CVEs (e.g. CVE-2026-121156, CVE-2026-121229, CVE-2026-121035) with CVSS 9.6
• 2026-11-03 Chrome 157 stable (157.0.8103.38 Linux; .38/.39 Windows/macOS) announced, fixing 213 bugs including 7 critical
• 2026-11-04 Cyber Security News reports the release; Google has not stated active exploitation

Sources cited for Chrome 157 security update

• NVD: CVE-2026-121156 NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121229 NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121035 NVD (NIST) · Advisory · 2026-11-03
• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com · Vendor report · 2026-11-03
• Chromium Issue 567735302 (CVE-2026-121156) issues.chromium.org · Vendor report · 2026-11-03
• Chromium Security chromium.org · Vendor report · 2026-11-03
• Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities cybersecuritynews.com · News · 2026-11-04

More in vulnerability

• Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
• rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
• CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)
• CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal
• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)