Multiple Vulnerabilities in Google Chrome prior to 157.0.8103.38 (CVE-2026-121029 through CVE-2026-121257) - HK GovCERT Alert A26-11-05

Key facts for TL-2026-5449

Detection coverage for TL-2026-5449

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5449 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chrome Spawning Shell or LOLBin — CVE-2026-121029 Family Exploitation (T1203)

Chrome (chrome.exe) main browser process spawning cmd, PowerShell, script hosts or LOLBins. Behaviour-first detection of client-side code execution after a crafted HTML page or extension abuses the Chrome vulnerabilities fixed in 157.0.8103.38 (e.g. CVE-2026-121030, CVE-2026-121060, CVE-2026-121200, CVE-2026-121257). Chrome rarely launches these binaries on its own. No in-the-wild exploitation is confirmed in the research; this is a behavioural net, not an IOC match.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1189, T1204.001, T1059.001, T1059.003
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\chrome.exe" NOT ParentCommandLine="*--type=*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe")
```Chrome main browser process (no --type= flag) spawning a script host or LOLBin after crafted web content or extension abuse (CVE-2026-121029 family)```
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmd values(ParentCommandLine) as chrome_cmd values(Hashes) as hashes by host, User, ParentImage, Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentImage Image child_cmd chrome_cmd hashes count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine !contains "--type="
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Chrome Browser Process Spawning Script Host or LOLBin - CVE-2026-121029 Family
id: 5b1f3c2e-8a47-4d19-9c6e-2f0a7d4b9e11
status: experimental
description: Detects the Chrome main browser process (no --type= helper flag) spawning a shell, script host or common LOLBin, a behaviour consistent with client-side exploitation or a sandbox escape from the Chrome 157.0.8103.38 vulnerability batch.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2160
    - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
    - https://attack.mitre.org/techniques/T1203/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.001
    - attack.initial-access
    - attack.t1189
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.121029
    - cve.2026.121030
    - cve.2026.121060
    - cve.2026.121100
    - cve.2026.121200
    - cve.2026.121257
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\msiexec.exe'
    filter_helper:
        ParentCommandLine|contains: '--type='
    condition: selection_parent and selection_child and not filter_helper
falsepositives:
    - Enterprise helper tools or protocol handlers launched from Chrome
    - IT admin scripts invoked via Chrome native messaging hosts
level: high

Known false positives:

• Enterprise helper applications or protocol handlers that legitimately launch msiexec, rundll32 or scripts from Chrome
• IT admin scripts invoked through Chrome native messaging hosts

Tuning notes: Exclude known native-messaging hosts and approved handler command lines by CommandLine. Pair with an endpoint inventory of Chrome versions below 157.0.8103.38 (file version of chrome.exe) to prioritise hosts. Requires Sysmon EventCode 1 with ParentCommandLine logging.

• 🔒 Chrome Spawning Shell or LOLBin — CVE-2026-121029 Family Exploitation (KQL) · unlock with TL Creds
• 🔒 Chrome Malicious Extension Side-Loading and Forced-Install Policy (KQL) · unlock with TL Creds
• 🔒 Chrome Sandboxed Helper Spawning Child Process — Sandbox Escape (KQL) · unlock with TL Creds
• 🔒 Chrome Spawning Shell or LOLBin — CVE-2026-121029 Family Exploitation (Sigma) · unlock with TL Creds
• 🔒 Chrome Malicious Extension Side-Loading Flags (Sigma) · unlock with TL Creds
• 🔒 Chrome Sandboxed Helper Spawning Child Process — Sandbox Escape (Sigma) · unlock with TL Creds
• 🔒 Chrome Malicious Extension Side-Loading and Forced-Install Policy — T1176.001 · unlock with TL Creds
• 🔒 Chrome Sandboxed Helper Spawning Child Process — Sandbox Escape (T1068, T1211) · unlock with TL Creds

Indicators of compromise for TL-2026-5449

As of 2026-11-06, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5449.

How Multiple Vulnerabilities in Google Chrome prior to works

On 4 November 2026 HK GovCERT published Security Alert A26-11-05 covering a large batch of vulnerabilities fixed in Google Chrome 157.0.8103.38. The alert lists CVE-2026-121029 through CVE-2026-121055, CVE-2026-121057, CVE-2026-121059 through CVE-2026-121138, CVE-2026-121140 through CVE-2026-121143, CVE-2026-121148, CVE-2026-121156 through CVE-2026-121190 and CVE-2026-121193 through CVE-2026-121257. The alert states that a remote attacker could trick users into opening specially crafted web content on a vulnerable browser, with potential outcomes of remote code execution, denial of service, elevation of privilege, information disclosure, security restriction bypass, spoofing or tampering.

NVD records for a sample of the CVEs show the range of flaw classes. CVE-2026-121029 is incorrect authorization in ORB (Opaque Response Blocking) allowing a site isolation bypass via a crafted HTML page (CWE-863, Chromium severity Low). CVE-2026-121030 is incorrect authorization in DevTools, CVE-2026-121060 is incorrect authorization in FileSystem, and CVE-2026-121200 is incorrect reference resolution in DevTools (CWE-706). Each of these four allows a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page, and each carries a CVSS 3.1 base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). CVE-2026-121100 is a use after free in DOM allowing arbitrary code execution inside the sandbox (CWE-416, CVSS 8.8, Chromium severity High). CVE-2026-121257 is a use after free in TabStrip that potentially allows code execution outside the sandbox via a crafted Chrome extension (CWE-416, CVSS 9.6, Chromium severity Medium). Only these 6 of roughly 230 listed CVEs were individually reviewed; the others are covered by the alert's description only.

The sources reviewed do not state that any of these vulnerabilities is exploited in the wild, and no CISA KEV entry for them was found in the portion of the catalog that could be read. No malware, threat actor, C2 infrastructure or network indicators are associated with this alert. The Chrome Releases post dated 3 November 2026 returned only template content, so the full per-CVE list and reporter details could not be verified from it. The severity rating of HIGH is analyst-assigned from the stated RCE impact. The CVSS score shown is the highest of the sampled NVD scores, not a score for the whole batch. Defenders should update to 157.0.8103.38 or later through auto-update or the About Google Chrome page and relaunch the browser.

MITRE ATT&CK techniques by tactic:

Persistence

T1176.001 Browser Extensions

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Remediation for Multiple Vulnerabilities in Google Chrome prior to

Patches

• Google Chrome 157.0.8103.38

Immediate actions

• Update Google Chrome to 157.0.8103.38 or later via auto-update or the About Google Chrome page, then relaunch the browser
• Inventory endpoints running Chrome versions prior to 157.0.8103.38

Longer-term hardening

• Enforce automatic browser updates through enterprise policy
• Review installed browser extensions and restrict installation to an approved allowlist
• Train users not to open untrusted links or web content

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: prior to 157.0.8103.38
  Fixed in: 157.0.8103.38

Timeline of Multiple Vulnerabilities in Google Chrome prior to

• 2026-11-03 NVD publishes CVE-2026-121257, a TabStrip use after free allowing potential code execution outside the sandbox via a crafted Chrome extension (CVSS 9.6, CWE-416); tracked in Chromium issue 567672825.
• 2026-11-03 NVD publishes CVE-2026-121100, a use after free in DOM allowing arbitrary code execution inside the sandbox via a crafted HTML page (CVSS 8.8, CWE-416); tracked in Chromium issue 570796613.
• 2026-11-03 NVD publishes records such as CVE-2026-121029 (ORB site isolation bypass), citing Chrome prior to 157.0.8103.38.
• 2026-11-03 locked-ioc-5 publishes the Chrome Stable Channel Update for Desktop; Chrome 157.0.8103.38 fixes the vulnerabilities.
• 2026-11-04 NVD last-modified date for CVE-2026-121100, reflecting post-publication enrichment.
• 2026-11-04 locked-ioc-4 publishes Security Alert A26-11-05 listing CVE-2026-121029 through CVE-2026-121257 and urging an update to 157.0.8103.38 or later.
• 2026-11-05 NVD last-modified date for CVE-2026-121257, reflecting post-publication enrichment.
• 2026-11-06 CISA KEV catalog read in part (first 100000 characters): no Chrome or Chromium entries for these CVEs. Exploitation in the wild is not confirmed by any reviewed source.
• 2026-11-06 NVD records for CVE-2026-121030, CVE-2026-121060, CVE-2026-121200 and CVE-2026-121257 show CVSS 3.1 base score 9.6; CVE-2026-121100 shows 8.8.

Sources cited for Multiple Vulnerabilities in Google Chrome prior to

• Security Alert (A26-11-05): Multiple Vulnerabilities in Google Chrome govcert.gov.hk · Advisory · 2026-11-04
• NVD: CVE-2026-121029 (ORB site isolation bypass) NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121030 (DevTools incorrect authorization) NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121060 (FileSystem incorrect authorization) NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121100 (DOM use after free) NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121200 (DevTools incorrect reference resolution) NVD (NIST) · Advisory · 2026-11-03
• NVD: CVE-2026-121257 (TabStrip use after free) NVD (NIST) · Advisory · 2026-11-03
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-06
• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com · Vendor report · 2026-11-03
• Chromium issue 563877891 (CVE-2026-121029) issues.chromium.org · Vendor report · 2026-11-03
• Chromium issue 570796613 (CVE-2026-121100) issues.chromium.org · Vendor report · 2026-11-03
• Chromium issue 567672825 (CVE-2026-121257) issues.chromium.org · Vendor report · 2026-11-03

More in vulnerability

• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)
• SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher

Previous and next in vulnerability

• CISA KEV Addition: SonicWall SonicOS SSLVPN Single-Factor Authentication / SAML Bypass Vulnerability (CVE-2026-19868) Previous report
• Multiple Vulnerabilities in Microsoft Edge (Chromium) and Visual Studio 2017-2026 - HK GovCERT Alert A26-11-02 (CVE-2026-91732, CVE-2026-118147, CVE-2026-118322) Next report