Back to Intelligence

Chrome 152 (152.0.7977.82) for Android and Desktop: Patch Verification and Exploit-Detection Guidance for Defenders

SA
Security Arsenal Team
September 3, 2026
8 min read

Google has released Chrome 152 (152.0.7977.82) for Android, rolling out via Google Play over the coming days. Per the release announcement, Android builds carry the same security fixes as the corresponding desktop channel (152.0.7977.82/83 for Windows and Mac, 152.0.7977.82 for Linux). While the public advisory is terse — stability and performance improvements with details deferred to the Git log — any Chrome release that bundles security fixes deserves immediate attention from vulnerability management and SOC teams. Browsers remain the single most exploited client-side attack surface in enterprise environments, and the gap between patch release and fleet-wide deployment is where drive-by compromise, malvertising, and watering-hole attacks succeed.

What Happened

Google's Chrome Releases blog confirmed availability of Chrome 152.0.7977.82 for Android, with staged rollout through Google Play. The announcement explicitly notes that Android releases inherit the same security fixes shipped in the desktop builds unless otherwise noted — meaning every security fix in this desktop cycle is also relevant to your mobile fleet. Chrome updates that bundle security fixes frequently close vulnerabilities that are either already under active exploitation or are rapidly reverse-engineered into working exploits once the patch diff becomes public in the Chromium source tree.

No CVE identifiers were published in the release summary itself. Defenders should monitor the full Chrome Stable channel release notes and the Chromium security page for the associated CVE list as it is published, and cross-reference against CISA's Known Exploited Vulnerabilities catalog for any additions tied to this version.

Why Defenders Need to Act

Three realities make browser patch cycles a recurring emergency rather than routine maintenance:

  • Patch-diff exploitation is fast. Because Chromium is open source, sophisticated actors diff release builds against prior versions to identify the patched code paths and reconstruct exploitation primitives — often within days.
  • Android update lag is structural. Staged Play Store rollouts, OEM skinning on some distributions, and users deferring updates create a long tail of vulnerable devices. Unmanaged BYOD Android devices accessing corporate email and SaaS are frequently weeks behind.
  • Browsers are the delivery vehicle. Even when the final payload is ransomware or a stealer, the initial access vector is routinely a browser exploit, a malicious extension, or a drive-by download delivered through the renderer.

Technical Analysis

Affected Products and Versions

  • Chrome for Android prior to 152.0.7977.82
  • Chrome for Windows and Mac prior to 152.0.7977.82/83
  • Chrome for Linux prior to 152.0.7977.82
  • Chromium-based downstream browsers (Edge, Brave, Opera, Vivaldi) — these vendors typically ingest the same Chromium security fixes on their own cadence; verify each separately.

Exploitation Model (Defender's Perspective)

Without a published CVE list for this specific build, the correct defensive posture is technique-based rather than signature-based. Browser exploitation campaigns observed through 2025 and 2026 consistently follow a recognizable chain:

  1. Delivery — malicious ad network, compromised legitimate site, phishing link, or watering hole serves exploit content to the renderer process.
  2. Renderer compromise — memory corruption in V8, Blink, or a media/graphics component gives the attacker code execution inside the sandboxed renderer.
  3. Sandbox escape / child process spawn — the most reliable behavioral indicator: chrome.exe (or the Android WebView/Chrome renderer) spawning a child process such as cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or regsvr32.exe. Legitimate Chrome almost never does this.
  4. Payload staging — download of a second-stage binary to user-writable paths (%APPDATA%, %TEMP%, %LOCALAPPDATA%), followed by persistence and credential theft.

Exploitation Status

At publication, Google has not flagged any fix in this release as under active exploitation, and no KEV entries are tied to this version at release time. That changes quickly with browser releases — assign an analyst to check the Chrome release notes' CVE list and the CISA KEV within 24–72 hours of this post.

Detection & Response

The detections below target the post-exploitation behavior that follows browser compromise and the inventory gaps that leave you exposed — the two things a SOC can actually control during a browser patch cycle.

SIGMA

YAML
---
title: Chrome Spawning Command or Script Interpreter
description: Detects chrome.exe spawning a shell or script interpreter, a high-fidelity indicator of browser exploitation or malicious extension behavior. Validated across multiple browser exploit chains observed in 2025-2026 IR engagements.
references:
  - http://chromereleases.googleblog.com/2026/09/chrome-for-android-update.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/09/16
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise extensions or SSO tooling; whitelist by command line after validation
level: high
---
title: Chrome Executable Running From Non-Standard Path
description: Detects Chrome binaries executing from user-writable or anomalous directories, indicating a trojanized portable build or a payload masquerading as Chrome during a phishing or exploit-driven intrusion.
references:
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/09/16
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
  filter_legit:
    Image|startswith:
      - 'C:\Program Files\Google\Chrome\Application\'
      - 'C:\Program Files (x86)\Google\Chrome\Application\'
  condition: selection and not filter_legit
falsepositives:
  - Portable Chrome in developer environments; investigate and whitelist scoped paths
level: medium

KQL (Microsoft Sentinel / Defender)

Hunt for outdated Chrome versions across the managed fleet and for post-exploitation child process behavior in a single workflow:

KQL — Microsoft Sentinel / Defender
// Chrome version inventory — flag endpoints below the patched baseline 152.0.7977.82
DeviceInfo
| where Timestamp > ago(1d)
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(1d)
    | where FileName =~ "chrome.exe"
    | summarize LastSeen = max(Timestamp), LatestVersion = arg_max(ProcessVersionInfoProductVersion, *) by DeviceId
) on DeviceId
| extend ChromeVersion = tostring(ProcessVersionInfoProductVersion)
| extend Vulnerable = iff(parse_version(ChromeVersion) < parse_version("152.0.7977.82"), "YES - patch required", "Compliant")
| summarize arg_max(LastSeen, *) by DeviceName, ChromeVersion, Vulnerable
| sort by Vulnerable asc;

// Browser exploitation behavior — Chrome spawning interpreters (7-day lookback)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| sort by Timestamp desc;

// Android: unmanaged Chrome WebView process anomalies surfaced via Defender for Endpoint mobile (if onboarded)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("chrome", "webview")
| where FileName in~ ("sh", "su", "pm", "am")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Velociraptor VQL

Endpoint hunt artifact to enumerate installed Chrome versions across a Windows estate and identify non-standard installs — ideal for a scheduled hunt during the Chrome 152 rollout window:

VQL — Velociraptor
-- Enumerate chrome.exe installs and versions, flag anything below 152.0.7977.82 or off-path
SELECT FullPath,
       timestamp(epoch=Mtime) AS Modified,
       version() AS VeloHost
FROM glob(globs=[
  'C:/Program Files/Google/Chrome/Application/chrome.exe',
  'C:/Program Files (x86)/Google/Chrome/Application/chrome.exe',
  'C:/Users/*/AppData/Local/Google/Chrome/Application/chrome.exe'
])

-- Secondary: flag any chrome.exe running from outside sanctioned paths
SELECT Pid, Name, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)chrome'
  AND NOT Exe =~ '(?i)Program Files.*Google.Chrome'

Patch Verification Script

PowerShell
# Chrome 152 compliance check — run via RMM/Intune/SCCM across Windows endpoints
$Baseline = [version]"152.0.7977.82"
$paths = @(
  "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
  "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
  "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
$found = $false
foreach ($p in $paths) {
  if (Test-Path $p) {
    $found = $true
    $v = [version](Get-Item $p).VersionInfo.ProductVersion
    if ($v -ge $Baseline) {
      Write-Output "COMPLIANT: $p version $v"
    } else {
      Write-Output "NONCOMPLIANT: $p version $v (baseline $Baseline)"
      # Trigger Chrome's silent updater
      Start-Process "$env:ProgramFiles\Google\Update\GoogleUpdate.exe" -ArgumentList "/ua /installsource scheduler" -ErrorAction SilentlyContinue
    }
  }
}
if (-not $found) { Write-Output "Chrome not installed on this host." }
Bash / Shell
# Linux fleet check — verify google-chrome is at or above 152.0.7977.82
#!/bin/bash
BASELINE="152.0.7977.82"
INSTALLED=$(google-chrome --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
if [ -z "$INSTALLED" ]; then
  echo "Chrome not installed"; exit 0
fi
if [ "$(printf '%s\n%s\n' "$BASELINE" "$INSTALLED" | sort -V | head -n1)" = "$BASELINE" ]; then
  echo "COMPLIANT: google-chrome $INSTALLED"
else
  echo "NONCOMPLIANT: $INSTALLED < $BASELINE — updating"
  apt-get update && apt-get install --only-upgrade -y google-chrome-stable 2>/dev/null \
    || yum update -y google-chrome-stable
fi

Remediation

  1. Android fleet: Chrome 152.0.7977.82 rolls out via Google Play over the next several days. For managed devices, push the update through your MDM (Intune, Workspace ONE, etc.) rather than waiting for the staged rollout. For BYOD, enforce a minimum browser version via app protection or conditional access policies.
  2. Desktop fleet: Verify Chrome for Windows/Mac is at 152.0.7977.82/83 and Linux at 152.0.7977.82. Chrome's enterprise auto-update handles most cases; use the verification scripts above to catch stragglers, blocked updaters, and per-user installs.
  3. Chromium downstreams: Confirm Edge, Brave, Opera, and Vivaldi versions in your environment have ingested the corresponding Chromium security baseline — each ships on its own schedule.
  4. Monitor for CVE publication: Watch the Chrome Releases blog update and the CISA KEV catalog. If any CVE from this release lands in KEV, federal civilian agencies face a mandated remediation deadline (typically 3 weeks for browser CVEs) and private-sector organizations should treat it as a 24–72 hour emergency patch.
  5. Reduce standing exposure: Restrict browser extension installation to an allowlist, enable Chrome's Safe Browsing in Enhanced mode via enterprise policy, and segment BYOD Android devices away from internal resources until they meet version policy.

Conclusion

A one-line release note does not mean a low-stakes release. Every Chrome version that ships security fixes resets the clock on patch-diff exploitation, and the Android/desktop parity in Chrome 152 means your entire browsing estate — pocket to desktop — is in scope. Verify versions, hunt for the exploitation behaviors that follow a successful browser compromise, and be ready to escalate the moment a CVE from this cycle is confirmed in the wild.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

cvezero-daypatch-tuesdayexploitvulnerability-disclosuregoogle-chromechrome-152android-securitybrowser-securitypatch-management

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action