# Multiple Vulnerabilities in Google Chrome (prior to 156.0.8078.79) - CVE-2026-76024 to CVE-2026-76031, CVE-2026-119260 to CVE-2026-119272

> Google Chrome 156.0.8078.79/.80 fixes 21 vulnerabilities (press tallies differ: 1-2 critical, 16-19 high), mostly memory-corruption and use-after-free bugs, including a critical MediaStream flaw. A remote attacker could lure a user to a crafted web page for code execution inside the renderer sandbox, information disclosure or security restriction bypass; no in-the-wild exploitation has been reported.

- **Published:** 2026-11-06T23:44:14Z
- **Last reviewed:** 2026-11-06T23:44:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5456
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5456.png
- **ID:** TL-2026-5456
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (2 shown free below)
- **CVEs:** CVE-2026-76024, CVE-2026-76025, CVE-2026-76026, CVE-2026-76027, CVE-2026-76028, CVE-2026-76029, CVE-2026-76030, CVE-2026-76031, CVE-2026-119260, CVE-2026-119261, CVE-2026-119262, CVE-2026-119263, CVE-2026-119264, CVE-2026-119265, CVE-2026-119266, CVE-2026-119267, CVE-2026-119268, CVE-2026-119269, CVE-2026-119270, CVE-2026-119271, CVE-2026-119272

## Description

HKCERT/GovCERT.HK Security Alert A26-10-65 (30 October 2026) warns that Google Chrome versions prior to 156.0.8078.79 contain multiple vulnerabilities, tracked as CVE-2026-76024 through CVE-2026-76031 and CVE-2026-119260 through CVE-2026-119272 (21 CVEs). The alert states that a remote attacker could entice a user to visit a web page with specially crafted content, leading to remote code execution, information disclosure or security restriction bypass. The fix is Chrome 156.0.8078.79 or later (156.0.8078.79/.80 on Windows and Mac, 156.0.8078.79 on Linux; Stable and Extended Stable channels), applied through auto-update or the 'About Google Chrome' page followed by a browser restart.

Per NVD (published 30 October 2026, last modified 3 November 2026), the flagship issue CVE-2026-76024 is a use-after-free (CWE-416) in MediaStream that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page; Chromium rates it Critical and NVD scores it CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Secondary coverage (securityonline.info) describes it as memory corruption and credits Xinyang Ge as reporter, so the exact primitive differs between sources; treat it as a sandboxed memory-safety flaw. The same coverage lists CVE-2026-119261 as a critical heap buffer overflow (CWE-122, scored 9.6), CVE-2026-119263 as a critical use-after-free (CWE-416, scored 9.6) and CVE-2026-119262 as a high-severity V8 flaw, all three reported internally by Google. CVE-2026-76025 through CVE-2026-76031 are listed as high-severity (8.8) policy/validation weaknesses spanning FileSystem, Autofill, Network, Skia, Dawn, DOM and Blink (CWE-863 incorrect authorization, CWE-346 origin validation error, CWE-20 improper input validation), credited to Google (12 issues in the release) and Xinyang Ge (4 issues). Press reports note that 16 of the 21 fixes are memory-corruption or use-after-free bugs. The per-CVE component mapping in secondary coverage is a range summary, not a one-to-one table, and component and bug class for CVE-2026-119260 and CVE-2026-119264 to -119272 were not available in retrievable sources.

Sources disagree on the severity tally (securityonline: 2 critical, 16 high, 3 medium; Deskmodder: one critical, CVE-2026-76024; other coverage: 1 critical, 19 high, 1 medium) and on the release date (Chrome Releases post dated 29 October; press dated 30 October). No source reports exploitation in the wild, a public proof of concept, malware, infrastructure or attribution. The Chrome Releases post cited by the alert did not return per-CVE release-note content on fetch, so per-CVE details above come from NVD and secondary coverage and should be re-verified against the Chromium release notes. Severity HIGH is an analyst judgement based on the stated RCE impact, a network attack vector requiring only user interaction, and the presence of Chromium-critical bugs. Defenders should prioritise patching across managed fleets, including Chromium-based browsers that inherit upstream fixes once vendors ship them.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chrome Sandboxed Process Spawning Shell or LOLBin (CVE-2026-76024 / TL-2026-5456 Exploitation)** (`TL-2026-5456-SPL-001`)

Detects a Chrome renderer, GPU or utility process (chrome.exe --type=...) creating a shell, script host or LOLBin child. Sandboxed Chrome child processes never legitimately spawn these binaries, so a hit indicates successful exploitation of a memory-corruption bug such as the MediaStream use-after-free CVE-2026-76024, CVE-2026-119261/119263 or V8 CVE-2026-119262 followed by a sandbox escape (T1203) after a drive-by lure (T1189, T1204.001).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204.001, T1189, T1059
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1), microsoft_defender_for_endpoint (DeviceProcessEvents), windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage="*\\chrome.exe" ParentCommandLine="*--type=*"
    Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\curl.exe","*\\msiexec.exe")
```Sandboxed Chrome child spawning interpreter - TL-2026-5456 CVE-2026-76024 exploitation / sandbox escape```
| eval chrome_process_type=case(like(ParentCommandLine,"%--type=renderer%"),"renderer",like(ParentCommandLine,"%--type=gpu-process%"),"gpu-process",like(ParentCommandLine,"%--type=utility%"),"utility",true(),"other")
| where chrome_process_type!="other"
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_image values(CommandLine) as child_cmd values(User) as user by host ParentImage chrome_process_type
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// TL-2026-5456 - sandboxed Chrome child process spawning shell / LOLBin (CVE-2026-76024 exploitation)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine has_any ("--type=renderer", "--type=gpu-process", "--type=utility")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, ChromeProcessCmd = InitiatingProcessCommandLine, ChromeVersion = InitiatingProcessVersionInfoProductVersion, ChildProcess = FileName, ChildCmd = ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Chrome Sandboxed Process Spawning Shell or LOLBin - CVE-2026-76024
id: 6b1f0a52-3c1e-4d7a-9a41-5e8c2f7d1a01
status: experimental
description: Detects a Chrome renderer, GPU or utility process creating a shell, script host or LOLBin child process, indicating exploitation of a Chrome memory-corruption vulnerability (TL-2026-5456, CVE-2026-76024 and related) with sandbox escape.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2154
    - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76024
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.001
    - attack.initial-access
    - attack.t1189
    - cve.2026-76024
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
        ParentCommandLine|contains:
            - '--type=renderer'
            - '--type=gpu-process'
            - '--type=utility'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\msiexec.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Chrome extensions or enterprise tooling that inject helper processes into sandboxed types (extremely rare)
    - Debugging or fuzzing harnesses on developer workstations
level: high
```

**Known false positives:**

- Developer or QA harnesses (Selenium, Puppeteer, fuzzers) that wrap chrome.exe and spawn helper shells
- Security-product test tooling that intentionally simulates browser exploitation

**Tuning notes:** Scope to managed endpoints and exclude known automation hosts by host or User. The --type= filter keeps this to renderer/gpu/utility parents, which should never launch interpreters; do not widen the child list without a baseline. Pivot on the child CommandLine and ChromeVersion, and compare against the fixed build 156.0.8078.79.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable Chrome Build (< 156.0.8078.79) Executing - TL-2026-5456 Exploitation Exposure (locked: unlock with TL Creds)
- Chrome Process Writing Persistence Artifacts to Startup or Task Folders (TL-2026-5456 Post-Exploitation) (locked: unlock with TL Creds)
- Outbound Public Connection from Non-Chrome Child of [indicator] (TL-2026-5456 C2) (locked: unlock with TL Creds)
- Chrome Launched with Sandbox or Site Isolation Disabled (TL-2026-5456 Exploit Impact Amplifier) (locked: unlock with TL Creds)
- Chrome Remote Debugging Port or Pipe Enabled for Session and Data Theft (TL-2026-5456 Post-Exploitation) (locked: unlock with TL Creds)
- LOLBin Outbound Connection to Public IP Following Browser Compromise (TL-2026-5456 C2) (locked: unlock with TL Creds)
- Non-Chrome Process Accessing Chrome Profile Credential and Cookie Stores (TL-2026-5456 Post-Exploitation) (locked: unlock with TL Creds)
- Chrome-Parented Download Cradle or LOLBin Payload Retrieval (TL-2026-5456 C2 / Ingress Tool Transfer) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 9)

Defanged, TLP:CLEAR.

- URL: `hxxps://issues[.]chromium[.]org/issues/576215540`
- URL: `hxxps://chromereleases[.]googleblog[.]com/2026/10/stable-channel-update-for-desktop_02107719452.html`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GovCERT.HK Security Alert A26-10-65: Multiple Vulnerabilities in Google Chrome](https://www.govcert.gov.hk/en/alerts_detail.php?id=2154)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html)
- [NVD: CVE-2026-76024](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76024)
- [Chromium Issue 576215540 (CVE-2026-76024)](https://issues.chromium.org/issues/576215540)
- [SecurityOnline: Chrome 156 security update 156.0.8078.79](https://securityonline.info/chrome-156-security-update-156-0-8078-79/)
- [Deskmodder: Chrome 156.0.8078.79/156.0.8078.80 closes 21 vulnerabilities](https://www.deskmodder.de/blog/?p=218869)
- [MITRE CVE record: CVE-2026-76024](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76024)
- [MITRE CVE record: CVE-2026-119260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-119260)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5456