Chrome 149-151 Patch Cycle: Mitigating 1,442 Security Flaws

---
title: Potential Chrome Sandbox Escape - Spawning Shell
id: 8c4d2f1a-9e3b-4a1c-8f5e-6d7b8a9c0d1e
status: experimental
description: Detects Chrome.exe spawning a command shell or PowerShell, a potential indicator of successful RCE and sandbox escape.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/07/10
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit:
    CommandLine|contains:
      - '--type=utility' 
      - 'chrome://'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate developer debugging or user-initiated terminal launches from browser downloads (rare)
level: high
---
title: Chrome Loading Unsigned DLLs from Non-Standard Paths
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Chrome loading DLLs from suspicious directories, potentially indicating DLL hijacking or exploit payload injection.
references:
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/07/10
tags:
  - attack.defense_evasion
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
    ImageLoaded|endswith:
      - '.dll'
    Signed: 'false'
  filter_paths:
    ImageLoaded|contains:
      - '\Program Files\Google\Chrome\'
      - '\Program Files (x86)\Google\Chrome\'
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  condition: selection and not filter_paths
falsepositives:
  - Legitimate extensions installing native modules (rarely unsigned)
level: medium

// Hunt for Chrome spawning suspicious child processes (Post-Exploitation)
DeviceProcessEvents
| where InitiatingProcessFileName == "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for Chrome processes spawning shells or downloading executables
SELECT chain.pid, chain.name AS ChildName, chain.cmdline AS ChildCmd, 
       parent.name AS ParentName, parent.cmdline AS ParentCmd
FROM chain(pid=pslist(name="chrome.exe"))
WHERE ChildName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
  OR ChildCmd =~ "http.*\.exe"

<#
.SYNOPSIS
    Audit and Remediate Chrome Version 151 Deployment.
.DESCRIPTION
    Checks the installed version of Google Chrome against the minimum safe version (151.0.x.x).
    Forces an update check if the version is out of date.
#>

$MinSafeVersion = [version]"151.0.0.0"
$ChromePaths = @(
    "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
)

$CurrentVersion = $null
$ChromePath = $null

foreach ($Path in $ChromePaths) {
    if (Test-Path $Path) {
        $ChromePath = $Path
        $CurrentVersion = (Get-Item $Path).VersionInfo.FileVersion
        break
    }
}

if ($null -eq $CurrentVersion) {
    Write-Host "[FAIL] Google Chrome not found in standard paths."
    exit 1
}

$VersionObj = [version]$CurrentVersion

Write-Host "[INFO] Current Chrome Version: $CurrentVersion"

if ($VersionObj -lt $MinSafeVersion) {
    Write-Host "[VULNERABLE] Chrome version is below 151.0.0.0."
    
    # Attempt to trigger Google Update
    $UpdateExe = "${env:ProgramFiles(x86)}\Google\Update\GoogleUpdate.exe"
    if (Test-Path $UpdateExe) {
        Write-Host "[REMEDIATE] Triggering Google Update to patch to v151..."
        Start-Process -FilePath $UpdateExe -ArgumentList "/ua /installsource scheduler" -NoNewWindow -Wait
        Write-Host "[INFO] Update trigger complete. Please verify version after restarting Chrome."
    } else {
        Write-Host "[FAIL] Google Update not found. Manual intervention required."
    }
} else {
    Write-Host "[OK] Chrome is patched to a safe version (>= 151)."
}