Google Chrome 157 Stable Update Fixes 83 Security Flaws Including 5 Critical Use-After-Free Bugs (CVE-2026-126885, CVE-2026-126895, CVE-2026-126879, CVE-2026-126846, CVE-2026-126911)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5853 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chrome Renderer/GPU/Utility Process Spawning Shell or Script Host (Chrome 157 UAF Exploitation, CVE-2026-126885 class)

TL-2026-5853: Chrome 157.0.8103.78 fixes five Critical use-after-free bugs (CVE-2026-126885 ServiceWorker, CVE-2026-126895 CSS, CVE-2026-126879 Layout, CVE-2026-126846 Skia, CVE-2026-126911 Accessibility) reachable from a crafted HTML page and described by NVD as enabling code execution outside the sandbox. A sandboxed chrome.exe renderer, gpu-process or utility process has no legitimate reason to launch cmd, PowerShell, script hosts or rundll32/regsvr32. This is a behaviour-first detection for post-exploitation of any browser memory-corruption flaw. No in-the-wild exploitation is reported for these CVEs; the rule is preventive hunting content.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1189, T1203, T1068, T1059.001, T1059.003
• Data sources: sysmon, Sysmon EventCode 1 (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*chrome.exe" (ParentCommandLine="*--type=renderer*" OR ParentCommandLine="*--type=gpu-process*" OR ParentCommandLine="*--type=utility*") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*mshta.exe" OR Image="*rundll32.exe" OR Image="*regsvr32.exe") | eval chrome_process_type=case(like(ParentCommandLine,"%--type=renderer%"),"renderer",like(ParentCommandLine,"%--type=gpu-process%"),"gpu-process",true(),"utility") | table _time host user ParentImage chrome_process_type Image CommandLine ParentCommandLine ProcessGuid

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine has_any ("--type=renderer", "--type=gpu-process", "--type=utility")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: Chrome Renderer, GPU or Utility Process Spawning Shell or Script Host
id: 6f1c2a54-3b7e-4d08-9a21-5c8e1f0b7a11
status: experimental
description: Detects a sandboxed Chrome renderer, gpu-process or utility process launching a shell, script host or LOLBin, a strong indicator of browser exploitation and sandbox escape (Chrome 157 use-after-free class, CVE-2026-126885).
references:
  - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126885
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.126885
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
    ParentCommandLine|contains:
      - '--type=renderer'
      - '--type=gpu-process'
      - '--type=utility'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions using native messaging hosts that are implemented as scripts (these run from the browser process, not renderer)
  - Developer tooling or test automation launching Chrome with scripted helpers
level: high

Known false positives:

• Native messaging host or helper scripts launched by the Chrome browser process or an extension
• Developer or QA automation harnesses that spawn shells from Chrome-related processes

Tuning notes: Renderer, gpu-process and utility parents should essentially never launch shells, so start with no exclusions. If a validated internal tool triggers it, exclude by exact child CommandLine or signed hash rather than by parent. Also run against Edge, Brave, Opera, Vivaldi and Electron app binaries by adding their image names to ParentImage while downstream Chromium patches roll out.

• 🔒 Vulnerable Chrome Build Running (< 157.0.8103.78) Exposed to Chrome 157 Critical UAFs · unlock with TL Creds
• 🔒 Chrome-Launched Encoded or Hidden PowerShell (Post-Exploitation Execution) · unlock with TL Creds
• 🔒 Non-Browser Process Spawned by Chrome Making Outbound Connections (C2 Callback after Exploitation) · unlock with TL Creds
• 🔒 Chrome Launched with Sandbox or Site Isolation Disabled (Exploitation Enabler) · unlock with TL Creds
• 🔒 Chrome Writing Executable or Script into Startup Folder (Persistence after Exploitation) · unlock with TL Creds
• 🔒 Chrome-Spawned Host and Network Discovery Commands (Post-Exploitation Reconnaissance) · unlock with TL Creds
• 🔒 Chrome Process Writing Run-Key Persistence (Post-Exploitation after Chrome 157 UAF) · unlock with TL Creds
• 🔒 Chrome-Spawned Download Utility for Ingress Tool Transfer (Post-Exploitation / C2 Staging) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5853.

Sample indicators (2 of 9)

• URL: hxxps://chromereleases[.]googleblog[.]com/2026/11/stable-channel-update-for-desktop_01744469280.html
• URL: hxxps://issues[.]chromium[.]org/issues/568699166

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

Technical analysis

On 2026-11-11 Google published a Stable Channel Update for Desktop moving Chrome to 157.0.8103.78 (Linux) and 157.0.8103.78/157.0.8103.79 (Windows and macOS). The release fixes 83 security vulnerabilities, 5 rated Critical and 78 rated High by the Chromium project. NVD published the record for CVE-2026-126885 on 2026-11-11 (status Awaiting Analysis, no CVSS metrics, CWE-416) with the description 'Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78', noting that a remote attacker who supplies a crafted HTML page could execute code outside the browser sandbox.

The five Critical bugs are all use-after-free (CWE-416) defects: CVE-2026-126885 (ServiceWorker, reported by Xinyang Ge on Oct 2), CVE-2026-126895 (CSS, Xinyang Ge, Oct 19), CVE-2026-126879 (Layout, Xinyang Ge, Oct 22), CVE-2026-126846 (Skia, reported by Google, Nov 2) and CVE-2026-126911 (Accessibility, Andrew Boni, Nov 2; reward pending). The 78 High-severity bugs span V8 (use-after-free, type confusion, off-by-one, integer overflow, out-of-bounds write, missing authorization, incomplete cleanup, memory corruption), Skia (buffer overflow, out-of-bounds read, uninitialized resources, information leaks, integer overflow), ANGLE, Dawn, GPU, Media, MediaStream, Extensions (incorrect authorization, race condition, use-after-free), FileSystem (link following, incorrect authorization), SiteIsolation, Network (out-of-bounds write), PDF, Passwords, Frames, DOM, HTML, Compositing, Turbolev and others. Several reports are credited to Anthropic researchers assisted by Claude and to OpenAI Codex Security, per the source article; the notice does not explain how those tools were used.

The source article does not state that any of the 83 flaws is exploited in the wild, and no public PoC is documented. It must not be confused with the separate, earlier actively exploited Chrome XML use-after-free (CVE-2026-125350), which CISA added to KEV on 2026-11-10. Google says the rollout will reach users over days and weeks and that it may restrict bug details until most users are patched or dependent third-party projects have fixed. Because Chromium is shared by Edge, Brave, Opera, Vivaldi and Electron apps, defenders should track downstream patch releases. Administrators should verify deployment across managed devices rather than assume auto-update has applied. Severity is the vendor's rating; no CVSS scores have been published.

MITRE ATT&CK techniques by tactic:

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Remediation

Patches

• Chrome 157.0.8103.78 (Linux)
• Chrome 157.0.8103.78 and 157.0.8103.79 (Windows, macOS)

Immediate actions

• Update Google Chrome to 157.0.8103.78 (Linux) or 157.0.8103.78/157.0.8103.79 (Windows/macOS) or later and relaunch the browser
• Verify deployed version on managed endpoints via chrome://version or endpoint inventory rather than assuming auto-update has applied
• Prioritize internet-facing and high-risk user populations (administrators, executives) for patch verification

Workarounds

• No vendor workaround documented; restrict browsing of untrusted sites on unpatched systems until updated

Longer-term hardening

• Enforce browser update policies with a maximum relaunch deadline (e.g., RelaunchNotification / RelaunchNotificationPeriod)
• Track Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and Electron applications for downstream fixes
• Keep site isolation and Chrome sandbox enabled; monitor for browser child-process anomalies with EDR

Affected and fixed versions

• Google — Chrome (Desktop)
  Vulnerable versions: Windows/macOS prior to 157.0.8103.78; Linux prior to 157.0.8103.78
  Fixed in: 157.0.8103.78 (Linux); 157.0.8103.78/157.0.8103.79 (Windows, macOS)
• Chromium-based browsers — Edge, Brave, Opera, Vivaldi and Electron applications
  Vulnerable versions: Builds based on Chromium prior to 157.0.8103.78 (downstream status not confirmed in sources)
  Fixed in: Downstream vendor releases incorporating the Chromium 157.0.8103.78 fixes

Timeline

• 2026-10-02 Xinyang Ge reports the ServiceWorker use-after-free later assigned CVE-2026-126885 (Critical).
• 2026-10-19 Xinyang Ge reports the CSS use-after-free later assigned CVE-2026-126895 (Critical).
• 2026-10-22 Xinyang Ge reports the Layout use-after-free later assigned CVE-2026-126879 (Critical).
• 2026-11-02 Google reports the Skia use-after-free (CVE-2026-126846) and Andrew Boni reports the Accessibility use-after-free (CVE-2026-126911); both Critical.
• 2026-11-03 Chrome 157 initially rolls out (builds 157.0.8103.38/.39) with 213 security fixes including seven Critical, per press coverage; separate from the 83 fixes in this update.
• 2026-11-10 CISA adds the separate Chrome XML use-after-free CVE-2026-125350 to KEV; not part of the 83 flaws covered here.
• 2026-11-11 NVD publishes CVE-2026-126885 (Awaiting Analysis, no CVSS, CWE-416).
• 2026-11-11 Google publishes Stable Channel Update for Desktop: Chrome 157.0.8103.78 (Linux) and 157.0.8103.78/.79 (Windows/macOS) fixing 83 flaws (5 Critical, 78 High).
• 2026-11-12 Cyber Security News reports the 83-flaw release; no in-the-wild exploitation is stated.

Sources cited

• NVD: CVE-2026-126885 NVD (NIST) · Advisory · 2026-11-11
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-125350 Chrome XML UAF added 2026-11-10, separate issue) CISA · Government advisory · 2026-11-10
• Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com · Vendor report · 2026-11-11
• Chromium issue 568699166 (CVE-2026-126885 ServiceWorker UAF) issues.chromium.org · Vendor report · 2026-11-11
• Google Chrome Fixes 83 Security Flaws, Including 5 Critical Ones that Could Enable RCE Attacks cybersecuritynews.com · News · 2026-11-12
• Chrome Zero-Day Exploited in the Wild (earlier, separate XML vulnerability) cybersecuritynews.com · News · 2026-11-10
• SecurityWeek: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical SecurityWeek · News · 2026-11-03
• Malwarebytes: Chrome 157 fixes 213 security issues, including 7 critical flaws malwarebytes.com · News · 2026-11-03

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Previous and next in vulnerability

• Critical Red Hat Quay Vulnerability (CVE-2026-123710) Allows Unauthenticated Registry Signing-Key Takeover and Exposure of Private Container Images Previous report
• N-central 4EverAble2Shell and Agent2Shell exploits (root RCE and Windows SYSTEM) work against build 2026.4.1.26; exploitation attempts chained with CVE-2026-90436 Next report