Google has released Chrome 152 (152.0.7977.75) for Android, rolling out via Google Play over the coming days. Critically for defenders, Google confirms that this Android release contains the same security fixes as the corresponding desktop releases — 152.0.7977.75/.76 for Windows and Mac, and 152.0.7977.75 for Linux. That single sentence is the signal: the desktop channel for this milestone carried security fixes, and Android is now catching up.
In practice, this means any Android device in your fleet running a Chrome build older than 152.0.7977.75 is exposed to every vulnerability addressed in the desktop channel release until the update lands. Because Chrome milestone releases routinely bundle fixes for memory-corruption flaws in the V8 JavaScript engine, Blink renderer, and media components — the exact bug classes that drive in-the-wild mobile browser exploitation — the patch gap between desktop and Android availability is a real, measurable risk window. Mobile devices are also the least-controlled assets in most environments: BYOD, no MDM enrollment, deferred Play Store updates. That's where this release earns your attention.
No individual CVE identifiers were disclosed in this release note — Google typically publishes the detailed security fix list on the desktop stable channel update post, and restricts access to bug details until a majority of users are patched. Treat the absence of CVEs as an operational cue, not a comfort signal: verify versions, enforce updates, and hunt for exploitation indicators while the fleet catches up.
Technical Analysis
Affected product and versions:
- Google Chrome for Android — all builds prior to 152.0.7977.75
- Corresponding fixed desktop builds (sharing the same security fixes): 152.0.7977.75/.76 (Windows & Mac), 152.0.7977.75 (Linux)
Why the Android release matters to enterprise defenders:
Chrome on Android shares its core attack surface with desktop Chrome: the V8 JavaScript/WebAssembly engine, the Blink rendering engine, the Skia graphics library, and the sandbox architecture. When Google states an Android release "contains the same security fixes as their corresponding Desktop releases," the practical translation is that the vulnerability set is identical but the deployment timelines differ. Android updates are gated by Google Play staged rollouts, carrier/OEM variables on some devices, and user deferral — all of which stretch the exposure window.
From an attacker's perspective, mobile Chrome exploitation typically chains a renderer compromise (e.g., a V8 type-confusion or use-after-free reachable via drive-by web content) with a sandbox escape or a privileged component weakness. Defenders don't need the CVE list to act: the defensive priority during any Chrome milestone rollout is (1) closing the version gap, and (2) watching for renderer-level compromise behavior — Chrome child processes spawning unexpected executables or script interpreters — which is one of the few reliable host-level signals of browser exploitation before post-exploit tooling lands.
Exploitation status: No specific CVEs, PoCs, or CISA KEV entries were referenced in this announcement. However, Google's desktop-channel release notes for this milestone should be reviewed immediately for any entries flagged as exploited in the wild — historically, Chrome has shipped multiple emergency and milestone patches for actively exploited zero-days, and the desktop post is where that disclosure appears. If any fix in the 152 train is marked as exploited, escalate this from routine patch cycle to emergency change.
Detection & Response
The most valuable detection work for this release is fleet hygiene: identifying every device — desktop and mobile — still running a vulnerable Chrome build, and watching for renderer compromise behavior on unpatched endpoints during the rollout window.
Sigma Detection Rules
---
title: Chrome Renderer Spawning Shell or Script Interpreter
description: Detects chrome.exe child processes spawning command shells or script interpreters, a strong indicator of renderer compromise via drive-by exploitation. Particularly relevant during the Chrome 152 rollout window while endpoints remain unpatched.
references:
- http://chromereleases.googleblog.com/2026/09/chrome-for-android.html
- https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
id: 3f9c2a71-6b84-4d1e-9a2c-7e5f1b0d8c34
status: experimental
date: 2026/09/15
tags:
- attack.execution
- attack.t1203
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\chrome.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
filter_renderer_param:
ParentCommandLine|contains: '--type='
condition: selection_parent and selection_child and filter_renderer_param
falsepositives:
- Rare; some enterprise browser extensions or kiosk integrations may spawn helper processes from Chrome. Investigate before suppressing.
level: high
---
title: Outdated Chrome Binary Executed From Non-Standard Path
description: Detects chrome.exe executing outside the standard Google Chrome installation directories, which can indicate a trojanized browser or sideloaded fake update — a common lure during publicized Chrome update cycles.
references:
- http://chromereleases.googleblog.com/2026/09/chrome-for-android.html
- https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
id: 8d1e4b52-2c7a-4f39-b6e1-9a0d5c3f7e28
status: experimental
date: 2026/09/15
tags:
- attack.defense_evasion
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\chrome.exe'
filter_standard_paths:
Image|startswith:
- 'C:\Program Files\Google\Chrome\Application\'
- 'C:\Program Files (x86)\Google\Chrome\Application\'
- 'C:\Users\'
condition: selection and not filter_standard_paths
falsepositives:
- Portable Chrome deployments or Chromium-based tooling; baseline per environment.
level: medium
KQL — Microsoft Sentinel / Defender
// Hunt: Identify endpoints running Chrome builds older than 152.0.7977.75
// Uses Defender TVM software inventory to surface unpatched Chrome installs.
DeviceTvmSoftwareInventory
| where SoftwareName has "chrome" and SoftwareName !has "edge"
| extend ParsedVersion = parse_version(SoftwareVersion)
| extend IsVulnerable = iff(ParsedVersion < parse_version("152.0.7977.75"), true, false)
| where IsVulnerable == true
| summarize Devices = dcount(DeviceId), DeviceList = make_set(DeviceName, 25) by SoftwareName, SoftwareVersion
| order by Devices desc
;
// Companion hunt: chrome.exe spawning suspicious child processes on unpatched hosts
DeviceProcessEvents
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine has "--type="
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
Velociraptor VQL
-- Hunt: Enumerate installed Chrome versions across Windows endpoints
-- Flags any install below 152.0.7977.75 for remediation
SELECT Fqdn,
split(string=ChromePath, sep='\\')[-2] AS ChromeVersion,
ChromePath
FROM foreach(row={
SELECT FullPath AS ChromePath
FROM glob(globs=['C:/Program Files/Google/Chrome/Application/*/chrome.exe',
'C:/Program Files (x86)/Google/Chrome/Application/*/chrome.exe'])
})
WHERE ChromeVersion < '152.0.7977.75'
Remediation & Verification Script
# Chrome 152 Fleet Verification — run via RMM/Intune/SCCM across Windows endpoints
# Flags installs below the fixed build 152.0.7977.75
$FixedVersion = [version]"152.0.7977.75"
$results = @()
# Check registry uninstall hives (covers per-machine and per-user installs)
$paths = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($path in $paths) {
$results += Get-ItemProperty $path -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -like '*Google Chrome*' } |
Select-Object DisplayName, DisplayVersion
}
if (-not $results) {
Write-Output "Chrome not installed on $env:COMPUTERNAME"
exit 0
}
foreach ($r in $results) {
$installed = [version]$r.DisplayVersion
if ($installed -lt $FixedVersion) {
Write-Output "VULNERABLE: $env:COMPUTERNAME running Chrome $installed — update to $FixedVersion or later"
# Trigger enterprise update immediately via Google Update
& "$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler 2>$null
exit 1
} else {
Write-Output "COMPLIANT: $env:COMPUTERNAME running Chrome $installed"
exit 0
}
}
Remediation
- Update Android devices to Chrome 152.0.7977.75 immediately. The update rolls out via Google Play over several days — do not wait for the staged rollout on managed or high-risk devices. Push it manually via the Play Store (Play Store → profile → Manage apps & device → Updates) or enforce it through your MDM's managed Google Play configuration.
- Enforce via MDM/EMM. For corporate-owned and enrolled BYOD Android devices, use your EMM platform (Intune, Workspace ONE, etc.) to set Chrome as a required app with a minimum version constraint of 152.0.7977.75. Configure managed Google Play to auto-update Chrome rather than leaving updates to user discretion.
- Verify desktop parity. Confirm Windows/Mac endpoints are on 152.0.7977.75/.76 and Linux on 152.0.7977.75. The Android release explicitly inherits the desktop security fixes, so a mixed patch state — patched desktops, stale phones — is a common and dangerous posture.
- Review the desktop stable channel release notes for Chrome 152 at the Chrome Releases blog (http://chromereleases.googleblog.com/) for the enumerated security fixes. Any fix annotated as exploited in the wild converts this from routine maintenance to an emergency patch — check CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) for additions tied to this milestone and honor any associated remediation deadlines.
- Restrict sideloaded browser installs. During publicized update cycles, fake "Chrome update" APK lures are a recurring social-engineering vector. Enforce Play Integrity / block unknown-source installs via Android Enterprise policy.
- Deploy the detection content above during the rollout window. Renderer-spawned child processes on unpatched endpoints are your best early-warning signal while the fleet converges on the fixed build.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.