Multiple Vulnerabilities in Google Chrome (prior to 156.0.8078.79) - CVE-2026-76024 to CVE-2026-76031, CVE-2026-119260 to CVE-2026-119272

Key facts for TL-2026-5456

Detection coverage for TL-2026-5456

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5456 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chrome Sandboxed Process Spawning Shell or LOLBin (CVE-2026-76024 / TL-2026-5456 Exploitation)

Detects a Chrome renderer, GPU or utility process (chrome.exe --type=...) creating a shell, script host or LOLBin child. Sandboxed Chrome child processes never legitimately spawn these binaries, so a hit indicates successful exploitation of a memory-corruption bug such as the MediaStream use-after-free CVE-2026-76024, CVE-2026-119261/119263 or V8 CVE-2026-119262 followed by a sandbox escape (T1203) after a drive-by lure (T1189, T1204.001).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1204.001, T1189, T1059
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), microsoft_defender_for_endpoint (DeviceProcessEvents), windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage="*\\chrome.exe" ParentCommandLine="*--type=*"
    Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\curl.exe","*\\msiexec.exe")
```Sandboxed Chrome child spawning interpreter - TL-2026-5456 CVE-2026-76024 exploitation / sandbox escape```
| eval chrome_process_type=case(like(ParentCommandLine,"%--type=renderer%"),"renderer",like(ParentCommandLine,"%--type=gpu-process%"),"gpu-process",like(ParentCommandLine,"%--type=utility%"),"utility",true(),"other")
| where chrome_process_type!="other"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_image values(CommandLine) as child_cmd values(User) as user by host ParentImage chrome_process_type
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// TL-2026-5456 - sandboxed Chrome child process spawning shell / LOLBin (CVE-2026-76024 exploitation)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine has_any ("--type=renderer", "--type=gpu-process", "--type=utility")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, ChromeProcessCmd = InitiatingProcessCommandLine, ChromeVersion = InitiatingProcessVersionInfoProductVersion, ChildProcess = FileName, ChildCmd = ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Chrome Sandboxed Process Spawning Shell or LOLBin - CVE-2026-76024
id: 6b1f0a52-3c1e-4d7a-9a41-5e8c2f7d1a01
status: experimental
description: Detects a Chrome renderer, GPU or utility process creating a shell, script host or LOLBin child process, indicating exploitation of a Chrome memory-corruption vulnerability (TL-2026-5456, CVE-2026-76024 and related) with sandbox escape.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2154
    - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76024
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.001
    - attack.initial-access
    - attack.t1189
    - cve.2026-76024
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
        ParentCommandLine|contains:
            - '--type=renderer'
            - '--type=gpu-process'
            - '--type=utility'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\msiexec.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Chrome extensions or enterprise tooling that inject helper processes into sandboxed types (extremely rare)
    - Debugging or fuzzing harnesses on developer workstations
level: high

Known false positives:

• Developer or QA harnesses (Selenium, Puppeteer, fuzzers) that wrap chrome.exe and spawn helper shells
• Security-product test tooling that intentionally simulates browser exploitation

Tuning notes: Scope to managed endpoints and exclude known automation hosts by host or User. The --type= filter keeps this to renderer/gpu/utility parents, which should never launch interpreters; do not widen the child list without a baseline. Pivot on the child CommandLine and ChromeVersion, and compare against the fixed build 156.0.8078.79.

• 🔒 Vulnerable Chrome Build (< 156.0.8078.79) Executing - TL-2026-5456 Exploitation Exposure · unlock with TL Creds
• 🔒 Chrome Process Writing Persistence Artifacts to Startup or Task Folders (TL-2026-5456 Post-Exploitation) · unlock with TL Creds
• 🔒 Outbound Public Connection from Non-Chrome Child of [indicator] (TL-2026-5456 C2) · unlock with TL Creds
• 🔒 Chrome Launched with Sandbox or Site Isolation Disabled (TL-2026-5456 Exploit Impact Amplifier) · unlock with TL Creds
• 🔒 Chrome Remote Debugging Port or Pipe Enabled for Session and Data Theft (TL-2026-5456 Post-Exploitation) · unlock with TL Creds
• 🔒 LOLBin Outbound Connection to Public IP Following Browser Compromise (TL-2026-5456 C2) · unlock with TL Creds
• 🔒 Non-Chrome Process Accessing Chrome Profile Credential and Cookie Stores (TL-2026-5456 Post-Exploitation) · unlock with TL Creds
• 🔒 Chrome-Parented Download Cradle or LOLBin Payload Retrieval (TL-2026-5456 C2 / Ingress Tool Transfer) · unlock with TL Creds

Indicators of compromise for TL-2026-5456

As of 2026-11-06, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5456.

Sample indicators (2 of 9)

• URL: hxxps://issues[.]chromium[.]org/issues/576215540
• URL: hxxps://chromereleases[.]googleblog[.]com/2026/10/stable-channel-update-for-desktop_02107719452.html

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

How Multiple Vulnerabilities in Google Chrome (prior to works

HKCERT/GovCERT.HK Security Alert A26-10-65 (30 October 2026) warns that Google Chrome versions prior to 156.0.8078.79 contain multiple vulnerabilities, tracked as CVE-2026-76024 through CVE-2026-76031 and CVE-2026-119260 through CVE-2026-119272 (21 CVEs). The alert states that a remote attacker could entice a user to visit a web page with specially crafted content, leading to remote code execution, information disclosure or security restriction bypass. The fix is Chrome 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux; Stable and Extended Stable channels), applied through auto-update or the 'About Google Chrome' page followed by a browser restart.

Per NVD (published 30 October 2026, last modified 3 November 2026), the flagship issue CVE-2026-76024 is a use-after-free (CWE-416) in MediaStream that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page; Chromium rates it Critical and NVD scores it CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Secondary coverage (securityonline.info) describes it as memory corruption and credits Xinyang Ge as reporter, so the exact primitive differs between sources; treat it as a sandboxed memory-safety flaw. The same coverage lists CVE-2026-119261 as a critical heap buffer overflow (CWE-122, scored 9.6), CVE-2026-119263 as a critical use-after-free (CWE-416, scored 9.6) and CVE-2026-119262 as a high-severity V8 flaw, all three reported internally by Google. CVE-2026-76025 through CVE-2026-76031 are listed as high-severity (8.8) policy/validation weaknesses spanning FileSystem, Autofill, Network, Skia, Dawn, DOM and Blink (CWE-863 incorrect authorization, CWE-346 origin validation error, CWE-20 improper input validation), credited to Google (12 issues in the release) and Xinyang Ge (4 issues). Press reports note that 16 of the 21 fixes are memory-corruption or use-after-free bugs. The per-CVE component mapping in secondary coverage is a range summary, not a one-to-one table, and component and bug class for CVE-2026-119260 and CVE-2026-119264 to -119272 were not available in retrievable sources.

Sources disagree on the severity tally (securityonline: 2 critical, 16 high, 3 medium; Deskmodder: one critical, CVE-2026-76024; other coverage: 1 critical, 19 high, 1 medium) and on the release date (Chrome Releases post dated 29 October; press dated 30 October). No source reports exploitation in the wild, a public proof of concept, malware, infrastructure or attribution. The Chrome Releases post cited by the alert did not return per-CVE release-note content on fetch, so per-CVE details above come from NVD and secondary coverage and should be re-verified against the Chromium release notes. Severity HIGH is an analyst judgement based on the stated RCE impact, a network attack vector requiring only user interaction, and the presence of Chromium-critical bugs. Defenders should prioritise patching across managed fleets, including Chromium-based browsers that inherit upstream fixes once vendors ship them.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Remediation for Multiple Vulnerabilities in Google Chrome (prior to

Patches

• Google Chrome 156.0.8078.79 (Linux) and 156.0.8078.79/156.0.8078.80 (Windows, Mac), Stable and Extended Stable

Immediate actions

• Update Google Chrome to 156.0.8078.79 or later (156.0.8078.80 on Windows/Mac) and restart the browser
• Verify version via chrome://settings/help or endpoint inventory and force relaunch on managed endpoints

Workarounds

• No vendor workaround stated; reduce exposure by restricting browsing of untrusted sites until patched

Longer-term hardening

• Enforce browser auto-update and a maximum relaunch deferral through enterprise policy
• Track and apply upstream fixes in other Chromium-based browsers and embedded Chromium runtimes
• Keep Chrome site isolation and renderer sandbox enabled; avoid --no-sandbox

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: prior to 156.0.8078.79
  Fixed in: 156.0.8078.79 (Linux); 156.0.8078.79/156.0.8078.80 (Windows, Mac)

Timeline of Multiple Vulnerabilities in Google Chrome (prior to

• 2026-10-29 locked-ioc-9 publishes the Chrome Stable Channel Update for Desktop (release post dated 29 October 2026) shipping 156.0.8078.79/.80 with 21 security fixes.
• 2026-10-30 Chromium issue 576215540 for CVE-2026-76024 (reporter credited: locked-ioc-8) is referenced from the NVD record as the tracker entry.
• 2026-10-30 SecurityOnline and Deskmodder report the release; SecurityOnline lists 2 critical, 16 high, 3 medium flaws with 16 of 21 being memory-safety bugs; no exploitation or public PoC confirmed.
• 2026-10-30 GovCERT.HK publishes Security Alert A26-10-65 covering 21 Chrome CVEs and urging upgrade to 156.0.8078.79 or later.
• 2026-10-30 CVE-2026-76024 (MediaStream use-after-free, Chromium Critical) is published in NVD with CVSS 3.1 6.5; CVE records for CVE-2026-119260 onward are published.
• 2026-11-03 NVD last modifies the CVE-2026-76024 record, which carries CWE-416 and CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
• 2026-11-06 TL analysis: no in-the-wild exploitation, PoC, malware or attribution found in retrievable sources; patching remains the primary control.

Sources cited for Multiple Vulnerabilities in Google Chrome (prior to

• GovCERT.HK Security Alert A26-10-65: Multiple Vulnerabilities in Google Chrome govcert.gov.hk · Advisory · 2026-10-30
• NVD: CVE-2026-76024 NVD (NIST) · Advisory · 2026-10-30
• MITRE CVE record: CVE-2026-76024 MITRE · Advisory · 2026-10-30
• MITRE CVE record: CVE-2026-119260 MITRE · Advisory · 2026-10-30
• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com · Vendor report · 2026-10-29
• Chromium Issue 576215540 (CVE-2026-76024) issues.chromium.org · Vendor report · 2026-10-30
• SecurityOnline: Chrome 156 security update 156.0.8078.79 securityonline.info · News · 2026-10-30
• Deskmodder: Chrome 156.0.8078.79/156.0.8078.80 closes 21 vulnerabilities deskmodder.de · News · 2026-10-30

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Other reports on CVE-2026-76024

• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10

Previous and next in vulnerability

• Apple macOS Tahoe and Xcode Local Information Disclosure Vulnerabilities - CVE-2026-112602, CVE-2026-112605 Previous report
• Multiple Vulnerabilities in Google Chrome prior to 156.0.8078.73 (52 CVEs incl. CVE-2026-118306 FileSystem sandbox escape) - HKCERT Alert A26-10-59 Next report