# Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)

> Google released Chrome 157 (157.0.8103.38 on Linux; 157.0.8103.38/.39 on Windows/macOS) on 2026-11-03, fixing 213 bugs, 7 rated critical: buffer overflows in Dawn, memory corruption in ANGLE, and use-after-free bugs in WebGL, Prerender, Geometry and Core. Google has not stated that any of these are exploited in attacks, and no public proof-of-concept is cited.

- **Published:** 2026-11-04T11:42:33Z
- **Last reviewed:** 2026-11-04T11:42:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5230
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5230.png
- **ID:** TL-2026-5230
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 6 (2 shown free below)
- **CVEs:** CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126

## Description

Chrome 157 stable (157.0.8103.38 for Linux; 157.0.8103.38/.39 for Windows and macOS) was announced on the Chrome Releases blog on 2026-11-03 and rolls out to users over the coming days and weeks. The release fixes 213 security bugs, seven of which carry the Chromium Critical rating.

The critical issues are: CVE-2026-121156 (buffer overflow in Dawn, the WebGPU implementation; reported 2026-09-30 by Zhenpeng 'Leo' Lin of depthfirst; $10,000 bounty), CVE-2026-121247 (buffer overflow in Dawn; reported by Google 2026-10-03), CVE-2026-121229 (memory corruption in ANGLE; reported 2026-09-17 by @mfx; $1,000 bounty; the NVD description scopes it to Chrome on Android), CVE-2026-121246 (use-after-free in WebGL; reported by Google), CVE-2026-121035 (use-after-free in Prerender; reported by Xinyang Ge of Anthropic), CVE-2026-121203 (use-after-free in Geometry; reported by Xinyang Ge of Anthropic) and CVE-2026-121126 (use-after-free in Core; reported by Wenbin Liu). Other fixes in the release include BackgroundFetch (incorrect authorization), ANGLE (out-of-bounds access), V8 (type confusion), PDFium and Media.

NVD records for CVE-2026-121156, CVE-2026-121229 and CVE-2026-121035 (all published 2026-11-03) score the issues 9.6 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. They describe a remote attacker potentially executing arbitrary code outside the sandbox via a crafted HTML page. The CWEs are CWE-122 (Dawn), CWE-119 (ANGLE) and CWE-416 (Prerender). The NVD records for the other four CVEs were not retrieved, so the score is applied to the release as a whole on the basis of the three that were. Google withholds bug details until most users are updated. No active exploitation, public PoC, IOCs or attribution is stated in the sources.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chrome 157 Critical CVEs — Browser Process Spawning Shell, Script Host or LOLBin (SPL)** (`TL-2026-5230-SPL-001`)

Detects chrome.exe spawning a command shell, script host or living-off-the-land binary. Post-exploitation behaviour that follows successful memory-corruption exploitation of the Chrome 157 critical bugs (Dawn CVE-2026-121156 / CVE-2026-121247, ANGLE CVE-2026-121229, WebGL CVE-2026-121246, Prerender CVE-2026-121035, Geometry CVE-2026-121203, Core CVE-2026-121126) reached via a crafted HTML page (T1189, T1203). Google has not reported exploitation of these CVEs; this is behaviour-first coverage that fires regardless of which bug is used. Chrome below 157.0.8103.38 is affected. Child-process list covers PowerShell (T1059.001), cmd (T1059.003), mshta (T1218.005), regsvr32 (T1218.010) and rundll32 (T1218.011) execution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1189, T1059.001, T1059.003, T1218.005, T1218.010, T1218.011
- **Data sources:** sysmon, windows_process_creation, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\chrome.exe" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\msiexec.exe") | table _time ComputerName User ParentImage ParentCommandLine Image CommandLine
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Chrome Browser Process Spawning Script Interpreter or LOLBin (Chrome 157 Critical CVEs)
id: 3f7a1c52-8b4e-4d19-9a63-5c2e0b7d1a01
status: experimental
description: Detects chrome.exe spawning a shell, script host or LOLBin, a post-exploitation indicator for memory-corruption exploitation of Chrome before 157.0.8103.38 (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126).
references:
  - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
  - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121156
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial-access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1218.005
  - attack.t1218.010
  - attack.t1218.011
  - cve.2026.121156
  - cve.2026.121247
  - cve.2026.121229
  - cve.2026.121246
  - cve.2026.121035
  - cve.2026.121203
  - cve.2026.121126
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msiexec.exe'
  condition: selection
falsepositives:
  - Chrome native messaging hosts or enterprise extensions that launch helper scripts
  - Administrators launching a shell via a Chrome-hosted web terminal protocol handler
level: high
```

**Known false positives:**

- Chrome native messaging hosts or enterprise extensions that legitimately launch cmd.exe or PowerShell helpers
- Custom URL protocol handlers or kiosk/web-terminal tooling that start scripts from the browser

**Tuning notes:** Baseline for one week and exclude known extension/native-host command lines via ParentCommandLine or CommandLine. Confirm Sysmon EventCode 1 is collected into index=sysmon (rename index/sourcetype to match your environment). Prioritise hits on hosts running Chrome below 157.0.8103.38. macOS/Linux endpoints need an EDR or Sysmon-for-Linux analogue.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Chrome 157 Critical CVEs — Chrome-Spawned Download Cradle / Ingress Tool Transfer (KQL) (locked: unlock with TL Creds)
- Chrome 157 Lure — Fake Chrome Installer Executed Without Google Signature (KQL) (locked: unlock with TL Creds)
- Chrome 157 Release Window — Community-Reported Google/Chrome Lure Domain Contact (KQL) (locked: unlock with TL Creds)
- Chrome 157 Critical CVEs — Non-Chrome Process Targeting Chrome Credential/Cookie Stores (Sigma) (locked: unlock with TL Creds)
- Chrome 157 Critical CVEs — Chrome Dropping Executables or Scripts to Temp/ProgramData/Startup (Sigma) (locked: unlock with TL Creds)
- Chrome 157 Critical CVEs — Chrome Launched With Sandbox Disabled, Debug Port or Side-Loaded Extension (Sigma) (locked: unlock with TL Creds)
- Chrome 157 Critical CVEs — Sandboxed Chrome Child Spawning Foreign Process, Sandbox Escape (SPL) (locked: unlock with TL Creds)
- Chrome 157 Critical CVEs — Repeated Chrome Memory-Corruption Crashes (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 6)

Defanged, TLP:CLEAR.

- URL: `hxxps://issues[.]chromium[.]org/issues/567735302`
- URL: `hxxps://chromereleases[.]googleblog[.]com/2026/11/stable-channel-update-for-desktop.html`

Full set of 6 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities](https://cybersecuritynews.com/google-releases-major-chrome-security-update/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- [NVD: CVE-2026-121156](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121156)
- [NVD: CVE-2026-121229](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121229)
- [NVD: CVE-2026-121035](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121035)
- [Chromium Issue 567735302 (CVE-2026-121156)](https://issues.chromium.org/issues/567735302)
- [Chromium Security](https://www.chromium.org/Home/chromium-security)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5230