# Multiple Vulnerabilities in Google Chrome prior to 156.0.8078.73 (52 CVEs incl. CVE-2026-118306 FileSystem sandbox escape) - HKCERT Alert A26-10-59

> Google's 27 Oct 2026 Chrome 156 stable update fixes 52 security issues (CVE-2026-118304..118322, 118327..118359): four rated Critical, 46 High and two Medium. GovCERT.HK warns exploitation could lead to remote code execution, information disclosure, security restriction bypass or tampering; no in-the-wild exploitation is reported by Google.

- **Published:** 2026-11-07T01:01:24Z
- **Last reviewed:** 2026-11-07T01:01:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5464
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5464.png
- **ID:** TL-2026-5464
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-118304, CVE-2026-118305, CVE-2026-118306, CVE-2026-118307, CVE-2026-118308, CVE-2026-118309, CVE-2026-118310, CVE-2026-118311, CVE-2026-118312, CVE-2026-118313, CVE-2026-118314, CVE-2026-118315, CVE-2026-118316, CVE-2026-118317, CVE-2026-118318, CVE-2026-118319, CVE-2026-118320, CVE-2026-118321, CVE-2026-118322, CVE-2026-118327, CVE-2026-118328, CVE-2026-118329, CVE-2026-118330, CVE-2026-118331, CVE-2026-118332, CVE-2026-118333, CVE-2026-118334, CVE-2026-118335, CVE-2026-118336, CVE-2026-118337, CVE-2026-118338, CVE-2026-118339, CVE-2026-118340, CVE-2026-118341, CVE-2026-118342, CVE-2026-118343, CVE-2026-118344, CVE-2026-118345, CVE-2026-118346, CVE-2026-118347, CVE-2026-118348, CVE-2026-118349, CVE-2026-118350, CVE-2026-118351, CVE-2026-118352, CVE-2026-118353, CVE-2026-118354, CVE-2026-118355, CVE-2026-118356, CVE-2026-118357, CVE-2026-118358, CVE-2026-118359

## Description

GovCERT.HK Security Alert A26-10-59 (published 2026-10-28) covers multiple vulnerabilities in Google Chrome versions prior to 156.0.8078.73. The alert lists CVE-2026-118304 through CVE-2026-118322 and CVE-2026-118327 through CVE-2026-118359 and states that successful exploitation could result in remote code execution, information disclosure, security restriction bypass or tampering on an affected system. The fix is Chrome 156.0.8078.73 or later, delivered through auto-update or the 'About Google Chrome' page followed by a browser relaunch.

Per secondary reporting on Google's 27 Oct 2026 Stable Channel Update (builds 156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux), the release contains 52 security fixes: four Critical (memory corruption in FileSystem, improper input validation in FileAPI, improper input validation in Skia, use after free in Layout), 46 High and two Medium (memory corruption in Paint, use after free in Animation). About 32 of the 52 are memory-corruption classes (use-after-free, out-of-bounds write). Other affected components named in reporting include V8, ANGLE, PDFium and WebRTC. Report dates in the release note range from 2026-07-28 to 2026-10-21.

CVE-2026-118306 is the most severe item. NVD describes it as a use after free in FileSystem allowing a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page (CWE-416, CVSS 3.1 9.6 CRITICAL, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, Chromium issue 571156746). Coverage of the release states it is the only one of the four Critical bugs described as escaping the sandbox; CVE-2026-118331, CVE-2026-118348 and CVE-2026-118344 are described as code execution inside the sandbox. Credits reported in coverage include Xinyang Ge (16 flaws, with some credits noting Claude assistance) and OpenAI's Codex Security team (four additional memory bugs). Secondary sources disagree on the Critical count (one outlet reports 14); the four-Critical figure is used here because it is repeated across several sources.

Exploitation status: Google's release notes and secondary reporting indicate no known exploitation and no public proof-of-concept, and no entry for these CVEs was found in the CISA KEV catalog portion that could be read (first 100KB only; the full catalog was not scanned). NVD records SSVC exploitation as 'none' for CVE-2026-118306 as of 2026-11-03. No threat actor, malware, C2 infrastructure or network/hash IOCs are associated with this advisory. A follow-on update on 2026-10-29 (156.0.8078.79/.80) fixed 21 additional issues under separate CVE IDs, so deployments should target the latest 156 build rather than only .73.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chrome Spawning Script Interpreter or LOLBin Child (CVE-2026-118306 Chrome 156 Sandbox Escape)** (`TL-2026-5464-SPL-001`)

Detects chrome.exe launching a command interpreter or living-off-the-land binary (cmd, PowerShell, mshta, rundll32, regsvr32, certutil, etc.). Successful exploitation of CVE-2026-118306 (FileSystem use-after-free, sandbox escape, CVSS 9.6) or the other Critical Chrome 156 memory-corruption bugs (CVE-2026-118331, CVE-2026-118344, CVE-2026-118348) via a crafted HTML page ends in code execution that typically surfaces as a browser-spawned child process. No in-the-wild exploitation or public PoC is reported, so this is a behavioural tripwire, not a signature. Native-messaging hosts are excluded.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1189, T1068, T1204.001
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
ParentImage="*\\chrome.exe"
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe")
NOT CommandLine="*chrome-extension://*"
| eval tl_context="TL-2026-5464 CVE-2026-118306 Chrome 156 sandbox escape child process (T1203)"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmdline values(ParentCommandLine) as chrome_cmdline values(User) as user by host, Image, ParentImage, tl_context
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe")
| where ProcessCommandLine !contains "chrome-extension://"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessVersionInfoProductVersion, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Chrome Spawning Script Interpreter or LOLBin Child (CVE-2026-118306)
id: 7c1f5e2a-4b3d-4e8a-9a61-2f0d8c5b1a01
status: experimental
description: Detects chrome.exe launching a command interpreter or LOLBin, the expected post-exploitation artefact of a browser memory-corruption exploit such as CVE-2026-118306 (Chrome prior to 156.0.8078.73). Native-messaging hosts are filtered.
references:
    - https://www.govcert.gov.hk/en/alerts_detail.php?id=2148
    - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html
    - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118306
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
    - attack.execution
    - attack.t1203
    - attack.initial-access
    - attack.t1189
    - attack.privilege-escalation
    - attack.t1068
    - cve.2026-118306
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\msiexec.exe'
    filter_native_messaging:
        CommandLine|contains: 'chrome-extension://'
    condition: selection_parent and selection_child and not filter_native_messaging
falsepositives:
    - Chrome native-messaging hosts or enterprise helper scripts launched through cmd or PowerShell
    - Administrator-defined Chrome policies or managed extensions that invoke scripts
level: high
```

**Known false positives:**

- Chrome native-messaging hosts or enterprise extensions that launch cmd.exe or PowerShell helper scripts
- IT-managed Chrome policies, kiosk wrappers or software-deployment tooling started from the browser

**Tuning notes:** Baseline for 7 days and add NOT clauses for known native-messaging host executables or extension IDs. Raise priority when the chrome.exe FileVersion is below 156.0.8078.73 (see TL-2026-5464-KQL-001). Sysmon EventCode 1 with ParentImage and ParentCommandLine must be enabled.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable Google Chrome Build Running (prior to 156.0.8078.73, 52 CVEs incl. CVE-2026-118306) (locked: unlock with TL Creds)
- Chrome-Spawned PowerShell, certutil or bitsadmin Download Cradle (Chrome 156 CVE Family) (locked: unlock with TL Creds)
- Host and Network Discovery Spawned From Chrome Process Tree (Post-Exploitation, Chrome 156 CVEs) (locked: unlock with TL Creds)
- Chrome Launched With Sandbox or Site Isolation Disabled (Chrome 156 CVE Family) (locked: unlock with TL Creds)
- Chrome Loading Unsigned DLL From User-Writable Path (Post-Exploitation, Chrome 156 CVEs) (locked: unlock with TL Creds)
- Lateral Movement Tooling Spawned From Chrome (wmic /node, schtasks /s, PsExec, winrs) (locked: unlock with TL Creds)
- Chrome Dropping Executable or Script Payload Outside Download and Install Paths (Chrome 156 CVE Family) (locked: unlock with TL Creds)
- Chrome-Spawned Shell or LOLBin Making Outbound Connection (Post-Exploitation C2, Chrome 156 CVEs) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Security Alert (A26-10-59): Multiple Vulnerabilities in Google Chrome](https://www.govcert.gov.hk/en/alerts_detail.php?id=2148)
- [Stable Channel Update for Desktop (Chrome Releases)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html)
- [NVD - CVE-2026-118306](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118306)
- [Chrome 156 Update Fixes 52 Flaws Including Sandbox Escape (Daily Security Review)](https://dailysecurityreview.com/?p=45075)
- [Chrome 156 Security Fixes: 52 on Oct 27, 21 on Oct 29 (BrainDetox)](https://braindetox.kr/en/posts/chrome_stable_security_update_2026_10.html)
- [Chrome Security Update 156.0.8078.73 (SecurityOnline)](https://securityonline.info/chrome-security-update-156-0-8078-73/)
- [Latest Chrome 156 patch: 52 security issues (PiunikaWeb)](https://piunikaweb.com/2026/10/28/latest-chrome-156-patch-52-security-issues/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5464