# Multiple Vulnerabilities in Google Chrome prior to 157.0.8103.38 (CVE-2026-121029 through CVE-2026-121257) - HK GovCERT Alert A26-11-05

> HK GovCERT reports multiple vulnerabilities in Google Chrome versions prior to 157.0.8103.38 that a remote attacker could exploit by tricking a user into opening crafted web content. Impact includes remote code execution, sandbox escape, site isolation bypass, information disclosure and spoofing; a fixed version, 157.0.8103.38, is available.

- **Published:** 2026-11-06T21:40:06Z
- **Last reviewed:** 2026-11-06T21:40:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5449
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5449.png
- **ID:** TL-2026-5449
- **Severity:** HIGH (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-121029 to CVE-2026-121055, CVE-2026-121057, CVE-2026-121059 to CVE-2026-121138, CVE-2026-121140 to CVE-2026-121143, CVE-2026-121148, CVE-2026-121156 to CVE-2026-121190, CVE-2026-121193 to CVE-2026-121257, CVE-2026-121030, CVE-2026-121060, CVE-2026-121100, CVE-2026-121200

## Description

On 4 November 2026 HK GovCERT published Security Alert A26-11-05 covering a large batch of vulnerabilities fixed in Google Chrome 157.0.8103.38. The alert lists CVE-2026-121029 through CVE-2026-121055, CVE-2026-121057, CVE-2026-121059 through CVE-2026-121138, CVE-2026-121140 through CVE-2026-121143, CVE-2026-121148, CVE-2026-121156 through CVE-2026-121190 and CVE-2026-121193 through CVE-2026-121257. The alert states that a remote attacker could trick users into opening specially crafted web content on a vulnerable browser, with potential outcomes of remote code execution, denial of service, elevation of privilege, information disclosure, security restriction bypass, spoofing or tampering.

NVD records for a sample of the CVEs show the range of flaw classes. CVE-2026-121029 is incorrect authorization in ORB (Opaque Response Blocking) allowing a site isolation bypass via a crafted HTML page (CWE-863, Chromium severity Low). CVE-2026-121030 is incorrect authorization in DevTools, CVE-2026-121060 is incorrect authorization in FileSystem, and CVE-2026-121200 is incorrect reference resolution in DevTools (CWE-706). Each of these four allows a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page, and each carries a CVSS 3.1 base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). CVE-2026-121100 is a use after free in DOM allowing arbitrary code execution inside the sandbox (CWE-416, CVSS 8.8, Chromium severity High). CVE-2026-121257 is a use after free in TabStrip that potentially allows code execution outside the sandbox via a crafted Chrome extension (CWE-416, CVSS 9.6, Chromium severity Medium). Only these 6 of roughly 230 listed CVEs were individually reviewed; the others are covered by the alert's description only.

The sources reviewed do not state that any of these vulnerabilities is exploited in the wild, and no CISA KEV entry for them was found in the portion of the catalog that could be read. No malware, threat actor, C2 infrastructure or network indicators are associated with this alert. The Chrome Releases post dated 3 November 2026 returned only template content, so the full per-CVE list and reporter details could not be verified from it. The severity rating of HIGH is analyst-assigned from the stated RCE impact. The CVSS score shown is the highest of the sampled NVD scores, not a score for the whole batch. Defenders should update to 157.0.8103.38 or later through auto-update or the About Google Chrome page and relaunch the browser.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1176.001 Browser Extensions

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chrome Spawning Shell or LOLBin — CVE-2026-121029 Family Exploitation (T1203)** (`TL-2026-5449-SPL-001`)

Chrome (chrome.exe) main browser process spawning cmd, PowerShell, script hosts or LOLBins. Behaviour-first detection of client-side code execution after a crafted HTML page or extension abuses the Chrome vulnerabilities fixed in 157.0.8103.38 (e.g. CVE-2026-121030, CVE-2026-121060, CVE-2026-121200, CVE-2026-121257). Chrome rarely launches these binaries on its own. No in-the-wild exploitation is confirmed in the research; this is a behavioural net, not an IOC match.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1189, T1204.001, T1059.001, T1059.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\chrome.exe" NOT ParentCommandLine="*--type=*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe")
```Chrome main browser process (no --type= flag) spawning a script host or LOLBin after crafted web content or extension abuse (CVE-2026-121029 family)```
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmd values(ParentCommandLine) as chrome_cmd values(Hashes) as hashes by host, User, ParentImage, Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentImage Image child_cmd chrome_cmd hashes count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine !contains "--type="
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Chrome Browser Process Spawning Script Host or LOLBin - CVE-2026-121029 Family
id: 5b1f3c2e-8a47-4d19-9c6e-2f0a7d4b9e11
status: experimental
description: Detects the Chrome main browser process (no --type= helper flag) spawning a shell, script host or common LOLBin, a behaviour consistent with client-side exploitation or a sandbox escape from the Chrome 157.0.8103.38 vulnerability batch.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2160
    - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html
    - https://attack.mitre.org/techniques/T1203/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.001
    - attack.initial-access
    - attack.t1189
    - attack.t1059.001
    - attack.t1059.003
    - cve.2026.121029
    - cve.2026.121030
    - cve.2026.121060
    - cve.2026.121100
    - cve.2026.121200
    - cve.2026.121257
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\msiexec.exe'
    filter_helper:
        ParentCommandLine|contains: '--type='
    condition: selection_parent and selection_child and not filter_helper
falsepositives:
    - Enterprise helper tools or protocol handlers launched from Chrome
    - IT admin scripts invoked via Chrome native messaging hosts
level: high

```

**Known false positives:**

- Enterprise helper applications or protocol handlers that legitimately launch msiexec, rundll32 or scripts from Chrome
- IT admin scripts invoked through Chrome native messaging hosts

**Tuning notes:** Exclude known native-messaging hosts and approved handler command lines by CommandLine. Pair with an endpoint inventory of Chrome versions below 157.0.8103.38 (file version of chrome.exe) to prioritise hosts. Requires Sysmon EventCode 1 with ParentCommandLine logging.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Chrome Spawning Shell or LOLBin — CVE-2026-121029 Family Exploitation (KQL) (locked: unlock with TL Creds)
- Chrome Malicious Extension Side-Loading and Forced-Install Policy (KQL) (locked: unlock with TL Creds)
- Chrome Sandboxed Helper Spawning Child Process — Sandbox Escape (KQL) (locked: unlock with TL Creds)
- Chrome Spawning Shell or LOLBin — CVE-2026-121029 Family Exploitation (Sigma) (locked: unlock with TL Creds)
- Chrome Malicious Extension Side-Loading Flags (Sigma) (locked: unlock with TL Creds)
- Chrome Sandboxed Helper Spawning Child Process — Sandbox Escape (Sigma) (locked: unlock with TL Creds)
- Chrome Malicious Extension Side-Loading and Forced-Install Policy — T1176.001 (locked: unlock with TL Creds)
- Chrome Sandboxed Helper Spawning Child Process — Sandbox Escape (T1068, T1211) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Security Alert (A26-11-05): Multiple Vulnerabilities in Google Chrome](https://www.govcert.gov.hk/en/alerts_detail.php?id=2160)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- [NVD: CVE-2026-121029 (ORB site isolation bypass)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121029)
- [NVD: CVE-2026-121030 (DevTools incorrect authorization)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121030)
- [NVD: CVE-2026-121060 (FileSystem incorrect authorization)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121060)
- [NVD: CVE-2026-121100 (DOM use after free)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121100)
- [NVD: CVE-2026-121200 (DevTools incorrect reference resolution)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121200)
- [NVD: CVE-2026-121257 (TabStrip use after free)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-121257)
- [Chromium issue 563877891 (CVE-2026-121029)](https://issues.chromium.org/issues/563877891)
- [Chromium issue 570796613 (CVE-2026-121100)](https://issues.chromium.org/issues/570796613)
- [Chromium issue 567672825 (CVE-2026-121257)](https://issues.chromium.org/issues/567672825)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5449