# Google Chrome 157 Stable Update Fixes 83 Security Flaws Including 5 Critical Use-After-Free Bugs (CVE-2026-126885, CVE-2026-126895, CVE-2026-126879, CVE-2026-126846, CVE-2026-126911)

> Google released Chrome Stable 157.0.8103.78/.79 (Windows/Mac) and 157.0.8103.78 (Linux), fixing 83 security flaws: 5 Critical and 78 High. All five Critical flaws are use-after-free bugs in ServiceWorker, CSS, Layout, Skia and Accessibility. No source states in-the-wild exploitation or a public PoC.

- **Published:** 2026-11-12T11:15:28Z
- **Last reviewed:** 2026-11-12T11:15:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5853
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5853.png
- **ID:** TL-2026-5853
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (2 shown free below)
- **CVEs:** CVE-2026-126885, CVE-2026-126895, CVE-2026-126879, CVE-2026-126846, CVE-2026-126911, CVE-2026-126864, CVE-2026-126889, CVE-2026-126859, CVE-2026-126886, CVE-2026-126887, CVE-2026-126870, CVE-2026-126912, CVE-2026-126919, CVE-2026-126878, CVE-2026-126909, CVE-2026-126847, CVE-2026-126853, CVE-2026-126865, CVE-2026-126916, CVE-2026-126903, CVE-2026-126910, CVE-2026-126842, CVE-2026-126898, CVE-2026-126871, CVE-2026-126875, CVE-2026-126862, CVE-2026-126900, CVE-2026-126904, CVE-2026-126907, CVE-2026-126851, CVE-2026-126845, CVE-2026-126881, CVE-2026-126867, CVE-2026-126863, CVE-2026-126896, CVE-2026-126869, CVE-2026-126858, CVE-2026-126891, CVE-2026-126874, CVE-2026-126876, CVE-2026-126918, CVE-2026-126866, CVE-2026-126844, CVE-2026-126884, CVE-2026-126894, CVE-2026-126861, CVE-2026-126917, CVE-2026-126856, CVE-2026-126905, CVE-2026-126873, CVE-2026-126922, CVE-2026-126914, CVE-2026-126880, CVE-2026-126872, CVE-2026-126877, CVE-2026-126888, CVE-2026-126843, CVE-2026-126854, CVE-2026-126892, CVE-2026-126897, CVE-2026-126857, CVE-2026-126883, CVE-2026-126840, CVE-2026-126848, CVE-2026-126882, CVE-2026-126906, CVE-2026-126915, CVE-2026-126893, CVE-2026-126855, CVE-2026-126908, CVE-2026-126849, CVE-2026-126901, CVE-2026-126852, CVE-2026-126850, CVE-2026-126841, CVE-2026-126902, CVE-2026-126868, CVE-2026-126921, CVE-2026-126913, CVE-2026-126890, CVE-2026-126860, CVE-2026-126920, CVE-2026-126899, CVE-2026-125350

## Description

On 2026-11-11 Google published a Stable Channel Update for Desktop moving Chrome to 157.0.8103.78 (Linux) and 157.0.8103.78/157.0.8103.79 (Windows and macOS). The release fixes 83 security vulnerabilities, 5 rated Critical and 78 rated High by the Chromium project. NVD published the record for CVE-2026-126885 on 2026-11-11 (status Awaiting Analysis, no CVSS metrics, CWE-416) with the description 'Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78', noting that a remote attacker who supplies a crafted HTML page could execute code outside the browser sandbox.

The five Critical bugs are all use-after-free (CWE-416) defects: CVE-2026-126885 (ServiceWorker, reported by Xinyang Ge on Oct 2), CVE-2026-126895 (CSS, Xinyang Ge, Oct 19), CVE-2026-126879 (Layout, Xinyang Ge, Oct 22), CVE-2026-126846 (Skia, reported by Google, Nov 2) and CVE-2026-126911 (Accessibility, Andrew Boni, Nov 2; reward pending). The 78 High-severity bugs span V8 (use-after-free, type confusion, off-by-one, integer overflow, out-of-bounds write, missing authorization, incomplete cleanup, memory corruption), Skia (buffer overflow, out-of-bounds read, uninitialized resources, information leaks, integer overflow), ANGLE, Dawn, GPU, Media, MediaStream, Extensions (incorrect authorization, race condition, use-after-free), FileSystem (link following, incorrect authorization), SiteIsolation, Network (out-of-bounds write), PDF, Passwords, Frames, DOM, HTML, Compositing, Turbolev and others. Several reports are credited to Anthropic researchers assisted by Claude and to OpenAI Codex Security, per the source article; the notice does not explain how those tools were used.

The source article does not state that any of the 83 flaws is exploited in the wild, and no public PoC is documented. It must not be confused with the separate, earlier actively exploited Chrome XML use-after-free (CVE-2026-125350), which CISA added to KEV on 2026-11-10. Google says the rollout will reach users over days and weeks and that it may restrict bug details until most users are patched or dependent third-party projects have fixed. Because Chromium is shared by Edge, Brave, Opera, Vivaldi and Electron apps, defenders should track downstream patch releases. Administrators should verify deployment across managed devices rather than assume auto-update has applied. Severity is the vendor's rating; no CVSS scores have been published.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chrome Renderer/GPU/Utility Process Spawning Shell or Script Host (Chrome 157 UAF Exploitation, CVE-2026-126885 class)** (`TL-2026-5853-SPL-001`)

TL-2026-5853: Chrome 157.0.8103.78 fixes five Critical use-after-free bugs (CVE-2026-126885 ServiceWorker, CVE-2026-126895 CSS, CVE-2026-126879 Layout, CVE-2026-126846 Skia, CVE-2026-126911 Accessibility) reachable from a crafted HTML page and described by NVD as enabling code execution outside the sandbox. A sandboxed chrome.exe renderer, gpu-process or utility process has no legitimate reason to launch cmd, PowerShell, script hosts or rundll32/regsvr32. This is a behaviour-first detection for post-exploitation of any browser memory-corruption flaw. No in-the-wild exploitation is reported for these CVEs; the rule is preventive hunting content.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1189, T1203, T1068, T1059.001, T1059.003
- **Data sources:** sysmon, Sysmon EventCode 1 (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*chrome.exe" (ParentCommandLine="*--type=renderer*" OR ParentCommandLine="*--type=gpu-process*" OR ParentCommandLine="*--type=utility*") (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*wscript.exe" OR Image="*cscript.exe" OR Image="*mshta.exe" OR Image="*rundll32.exe" OR Image="*regsvr32.exe") | eval chrome_process_type=case(like(ParentCommandLine,"%--type=renderer%"),"renderer",like(ParentCommandLine,"%--type=gpu-process%"),"gpu-process",true(),"utility") | table _time host user ParentImage chrome_process_type Image CommandLine ParentCommandLine ProcessGuid
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine has_any ("--type=renderer", "--type=gpu-process", "--type=utility")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Chrome Renderer, GPU or Utility Process Spawning Shell or Script Host
id: 6f1c2a54-3b7e-4d08-9a21-5c8e1f0b7a11
status: experimental
description: Detects a sandboxed Chrome renderer, gpu-process or utility process launching a shell, script host or LOLBin, a strong indicator of browser exploitation and sandbox escape (Chrome 157 use-after-free class, CVE-2026-126885).
references:
  - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html
  - https://nvd.nist.gov/vuln/detail/CVE-2026-126885
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1189
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.126885
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
    ParentCommandLine|contains:
      - '--type=renderer'
      - '--type=gpu-process'
      - '--type=utility'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions using native messaging hosts that are implemented as scripts (these run from the browser process, not renderer)
  - Developer tooling or test automation launching Chrome with scripted helpers
level: high
```

**Known false positives:**

- Native messaging host or helper scripts launched by the Chrome browser process or an extension
- Developer or QA automation harnesses that spawn shells from Chrome-related processes

**Tuning notes:** Renderer, gpu-process and utility parents should essentially never launch shells, so start with no exclusions. If a validated internal tool triggers it, exclude by exact child CommandLine or signed hash rather than by parent. Also run against Edge, Brave, Opera, Vivaldi and Electron app binaries by adding their image names to ParentImage while downstream Chromium patches roll out.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable Chrome Build Running (< 157.0.8103.78) Exposed to Chrome 157 Critical UAFs (locked: unlock with TL Creds)
- Chrome-Launched Encoded or Hidden PowerShell (Post-Exploitation Execution) (locked: unlock with TL Creds)
- Non-Browser Process Spawned by Chrome Making Outbound Connections (C2 Callback after Exploitation) (locked: unlock with TL Creds)
- Chrome Launched with Sandbox or Site Isolation Disabled (Exploitation Enabler) (locked: unlock with TL Creds)
- Chrome Writing Executable or Script into Startup Folder (Persistence after Exploitation) (locked: unlock with TL Creds)
- Chrome-Spawned Host and Network Discovery Commands (Post-Exploitation Reconnaissance) (locked: unlock with TL Creds)
- Chrome Process Writing Run-Key Persistence (Post-Exploitation after Chrome 157 UAF) (locked: unlock with TL Creds)
- Chrome-Spawned Download Utility for Ingress Tool Transfer (Post-Exploitation / C2 Staging) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 9)

Defanged, TLP:CLEAR.

- URL: `hxxps://chromereleases[.]googleblog[.]com/2026/11/stable-channel-update-for-desktop_01744469280.html`
- URL: `hxxps://issues[.]chromium[.]org/issues/568699166`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Google Chrome Fixes 83 Security Flaws, Including 5 Critical Ones that Could Enable RCE Attacks](https://cybersecuritynews.com/google-chrome-fixes-83-security-flaws/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html)
- [NVD: CVE-2026-126885](https://nvd.nist.gov/vuln/detail/CVE-2026-126885)
- [Chromium issue 568699166 (CVE-2026-126885 ServiceWorker UAF)](https://issues.chromium.org/issues/568699166)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-125350 Chrome XML UAF added 2026-11-10, separate issue)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Chrome Zero-Day Exploited in the Wild (earlier, separate XML vulnerability)](https://cybersecuritynews.com/google-chrome-0-day-exploited/)
- [SecurityWeek: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical](https://securityweek.com/chrome-157-rolls-out-with-213-security-fixes-seven-rated-critical)
- [Malwarebytes: Chrome 157 fixes 213 security issues, including 7 critical flaws](https://www.malwarebytes.com/?p=484548)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5853