Multiple Vulnerabilities in Google Chrome prior to 156.0.8078.73 (52 CVEs incl. CVE-2026-118306 FileSystem sandbox escape) - HKCERT Alert A26-10-59

Key facts for TL-2026-5464

Detection coverage for TL-2026-5464

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5464 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chrome Spawning Script Interpreter or LOLBin Child (CVE-2026-118306 Chrome 156 Sandbox Escape)

Detects chrome.exe launching a command interpreter or living-off-the-land binary (cmd, PowerShell, mshta, rundll32, regsvr32, certutil, etc.). Successful exploitation of CVE-2026-118306 (FileSystem use-after-free, sandbox escape, CVSS 9.6) or the other Critical Chrome 156 memory-corruption bugs (CVE-2026-118331, CVE-2026-118344, CVE-2026-118348) via a crafted HTML page ends in code execution that typically surfaces as a browser-spawned child process. No in-the-wild exploitation or public PoC is reported, so this is a behavioural tripwire, not a signature. Native-messaging hosts are excluded.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1189, T1068, T1204.001
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
ParentImage="*\\chrome.exe"
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe")
NOT CommandLine="*chrome-extension://*"
| eval tl_context="TL-2026-5464 CVE-2026-118306 Chrome 156 sandbox escape child process (T1203)"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmdline values(ParentCommandLine) as chrome_cmdline values(User) as user by host, Image, ParentImage, tl_context
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| where ProcessCommandLine !contains "chrome-extension://"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256
| order by Timestamp desc

Sigma

title: Chrome Spawning Script Interpreter or LOLBin Child (CVE-2026-118306)
id: 7c1f5e2a-4b3d-4e8a-9a61-2f0d8c5b1a01
status: experimental
description: Detects chrome.exe launching a command interpreter or LOLBin, the expected post-exploitation artefact of a browser memory-corruption exploit such as CVE-2026-118306 (Chrome prior to 156.0.8078.73). Native-messaging hosts are filtered.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2148
    - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118306
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.execution
    - attack.t1203
    - attack.initial-access
    - attack.t1189
    - attack.privilege-escalation
    - attack.t1068
    - cve.2026-118306
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\msiexec.exe'
    filter_native_messaging:
        CommandLine|contains: 'chrome-extension://'
    condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
    - Chrome native-messaging hosts or enterprise helper scripts launched through cmd or PowerShell
    - Administrator-defined Chrome policies or managed extensions that invoke scripts
level: high

Known false positives:

• Chrome native-messaging hosts or enterprise extensions that launch cmd.exe or PowerShell helper scripts
• IT-managed Chrome policies, kiosk wrappers or software-deployment tooling started from the browser

Tuning notes: Baseline for 7 days and add NOT clauses for known native-messaging host executables or extension IDs. Raise priority when the chrome.exe FileVersion is below 156.0.8078.73 (see TL-2026-5464-KQL-001). Sysmon EventCode 1 with ParentImage and ParentCommandLine must be enabled.

• 🔒 Vulnerable Google Chrome Build Running (prior to 156.0.8078.73, 52 CVEs incl. CVE-2026-118306) · unlock with TL Creds
• 🔒 Chrome-Spawned PowerShell, certutil or bitsadmin Download Cradle (Chrome 156 CVE Family) · unlock with TL Creds
• 🔒 Host and Network Discovery Spawned From Chrome Process Tree (Post-Exploitation, Chrome 156 CVEs) · unlock with TL Creds
• 🔒 Chrome Launched With Sandbox or Site Isolation Disabled (Chrome 156 CVE Family) · unlock with TL Creds
• 🔒 Chrome Loading Unsigned DLL From User-Writable Path (Post-Exploitation, Chrome 156 CVEs) · unlock with TL Creds
• 🔒 Lateral Movement Tooling Spawned From Chrome (wmic /node, schtasks /s, PsExec, winrs) · unlock with TL Creds
• 🔒 Chrome Dropping Executable or Script Payload Outside Download and Install Paths (Chrome 156 CVE Family) · unlock with TL Creds
• 🔒 Chrome-Spawned Shell or LOLBin Making Outbound Connection (Post-Exploitation C2, Chrome 156 CVEs) · unlock with TL Creds

Indicators of compromise for TL-2026-5464

As of 2026-11-07, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5464.

How Multiple Vulnerabilities in Google Chrome prior to works

GovCERT.HK Security Alert A26-10-59 (published 2026-10-28) covers multiple vulnerabilities in Google Chrome versions prior to 156.0.8078.73. The alert lists CVE-2026-118304 through CVE-2026-118322 and CVE-2026-118327 through CVE-2026-118359 and states that successful exploitation could result in remote code execution, information disclosure, security restriction bypass or tampering on an affected system. The fix is Chrome 156.0.8078.73 or later, delivered through auto-update or the 'About Google Chrome' page followed by a browser relaunch.

Per secondary reporting on Google's 27 Oct 2026 Stable Channel Update (builds 156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux), the release contains 52 security fixes: four Critical (memory corruption in FileSystem, improper input validation in FileAPI, improper input validation in Skia, use after free in Layout), 46 High and two Medium (memory corruption in Paint, use after free in Animation). About 32 of the 52 are memory-corruption classes (use-after-free, out-of-bounds write). Other affected components named in reporting include V8, ANGLE, PDFium and WebRTC. Report dates in the release note range from 2026-07-28 to 2026-10-21.

CVE-2026-118306 is the most severe item. NVD describes it as a use after free in FileSystem allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page (CWE-416, CVSS 3.1 9.6 CRITICAL, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, Chromium issue 571156746). Coverage of the release states it is the only one of the four Critical bugs described as escaping the sandbox; CVE-2026-118331, CVE-2026-118348 and CVE-2026-118344 are described as code execution inside the sandbox. Credits reported in coverage include Xinyang Ge (16 flaws, with some credits noting Claude assistance) and OpenAI's Codex Security team (four additional memory bugs). Secondary sources disagree on the Critical count (one outlet reports 14); the four-Critical figure is used here because it is repeated across several sources.

Exploitation status: Google's release notes and secondary reporting indicate no known exploitation and no public proof-of-concept, and no entry for these CVEs was found in the CISA KEV catalog portion that could be read (first 100KB only; the full catalog was not scanned). NVD records SSVC exploitation as 'none' for CVE-2026-118306 as of 2026-11-03. No threat actor, malware, C2 infrastructure or network/hash IOCs are associated with this advisory. A follow-on update on 2026-10-29 (156.0.8078.79/.80) fixed 21 additional issues under separate CVE IDs, so deployments should target the latest 156 build rather than only .73.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Remediation for Multiple Vulnerabilities in Google Chrome prior to

Patches

• Chrome 156.0.8078.73/.74 (Windows, Mac) and 156.0.8078.73 (Linux)
• Follow-on Chrome 156.0.8078.79/.80 (2026-10-29)

Immediate actions

• Update Google Chrome to 156.0.8078.73 or later (latest 156.x build preferred) via auto-update or Help > About Google Chrome, then relaunch the browser
• Verify fleet Chrome versions with endpoint inventory and flag any build below 156.0.8078.73

Workarounds

• No vendor workaround stated; limit browsing of untrusted sites on unpatched systems until updated

Longer-term hardening

• Enforce managed browser auto-update policy and short relaunch deadlines
• Update Chromium-based downstream browsers and distro packages once vendors ship the fixes

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: prior to 156.0.8078.73
  Fixed in: 156.0.8078.73/.74 (Windows, Mac); 156.0.8078.73 (Linux)

Timeline of Multiple Vulnerabilities in Google Chrome prior to

• 2026-07-28 Earliest vulnerability report date among fixes in the Chrome 156 27 Oct release note (reports ran through 2026-10-21)
• 2026-10-21 Latest report date among the 52 fixes in the 27 Oct release note
• 2026-10-27 Google releases Chrome 156.0.8078.73/.74 (Windows/Mac) and .73 (Linux) fixing 52 security issues: 4 Critical, 46 High, 2 Medium
• 2026-10-28 GovCERT.HK publishes Security Alert A26-10-59 covering CVE-2026-118304..118322 and 118327..118359
• 2026-10-29 Google ships locked-ioc-4 with 21 further fixes (separate CVE IDs)
• 2026-11-03 NVD last-modified date for CVE-2026-118306 (9.6 Critical); SSVC exploitation recorded as none

Sources cited for Multiple Vulnerabilities in Google Chrome prior to

• Security Alert (A26-10-59): Multiple Vulnerabilities in Google Chrome govcert.gov.hk · Advisory · 2026-10-28
• NVD - CVE-2026-118306 NVD (NIST) · Advisory · 2026-11-03
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-07
• Stable Channel Update for Desktop (Chrome Releases) chromereleases.googleblog.com · Vendor report · 2026-10-27
• Chrome 156 Update Fixes 52 Flaws Including Sandbox Escape (Daily Security Review) dailysecurityreview.com · News · 2026-10-28
• Chrome 156 Security Fixes: 52 on Oct 27, 21 on Oct 29 (BrainDetox) braindetox.kr · News · 2026-10-30
• Chrome Security Update 156.0.8078.73 (SecurityOnline) securityonline.info · News · 2026-10-28
• Latest Chrome 156 patch: 52 security issues (PiunikaWeb) piunikaweb.com · News · 2026-10-28

More in vulnerability

• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)

Previous and next in vulnerability

• Multiple Vulnerabilities in Google Chrome (prior to 156.0.8078.79) - CVE-2026-76024 to CVE-2026-76031, CVE-2026-119260 to CVE-2026-119272 Previous report
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released Next report