Chrome 152.0.7977.82 Patches CVE-2026-85046 V8 Type Confusion — Detection and Remediation Guide

---
title: Chrome Renderer Spawning Shell or Script Interpreter
id: 8f2c4b91-6e3d-4a17-b952-0d7e5f1a3c48
status: experimental
description: Detects chrome.exe spawning cmd.exe, powershell, wscript, cscript, mshta, rundll32, or regsvr32 — a hallmark of successful browser exploit chains and sandbox escapes such as those targeting V8 type confusion vulnerabilities like CVE-2026-85046.
references:
  - http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.initial_access
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — enterprise browser extensions with native messaging hosts; validate and whitelist by full path
level: high
---
title: Chrome CrashReporting Process Anomalous Child Execution
id: 3b9d7e26-1f48-4c5a-9d63-7e2a8b0f5d19
status: experimental
description: Detects crashpad_handler.exe (Chrome CrashReporting component, affected by CVE-2026-85052) spawning unexpected child processes. Crashpad should never launch command interpreters or system utilities.
references:
  - http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.initial_access
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\crashpad_handler.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare — investigate all hits
level: critical
---
title: Chrome Writing Executable Content to User-Writable Directories
id: 5e1a8c43-2d96-4b78-a3f1-9c6d2e7b4a05
status: experimental
description: Detects chrome.exe writing PE executables or scripts to Temp, AppData, or Downloads followed by execution patterns consistent with post-exploitation payload staging after a renderer compromise.
references:
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\chrome.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.js'
      - '.hta'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Chrome software updater writes to AppData — filter known updater paths (GoogleUpdate) and known installer hashes
level: medium

// Hunt 1: Chrome spawning suspicious child processes (post-exploitation indicator)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe" or InitiatingProcessFileName =~ "crashpad_handler.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","msiexec.exe","whoami.exe","net.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt 2: Inventory devices running Chrome builds older than 152.0.7977.82
DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where FileName =~ "chrome.exe"
| extend ChromeVersion = tostring(ProcessVersionInfoProductVersion)
| where ChromeVersion startswith "152." or ChromeVersion startswith "151." or ChromeVersion startswith "150."
| extend VersionParts = split(ChromeVersion, ".")
| extend Build = toint(VersionParts[2]), Rev = toint(VersionParts[3])
| where Build < 7977 or (Build == 7977 and Rev < 82)
| summarize LastSeen = max(TimeGenerated), Versions = make_set(ChromeVersion) by DeviceName
| order by LastSeen desc;

-- Chrome exploitation hunt: enumerate chrome processes, versions, and suspicious children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       parse_file(path=Exe).Version AS ChromeVersion,
       if(condition=CommandLine =~ '(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil)',
          then='SUSPICIOUS_CHILD', else='') AS Verdict
FROM pslist()
WHERE Name =~ 'chrome|crashpad'
   OR Exe =~ '\\chrome\.exe$'

-- Identify endpoints with unpatched Chrome installations
SELECT FullPath, Size, Mtime,
       parse_pe_file(file=FullPath).FileVersion AS InstalledVersion
FROM glob(globs=['C:/Program Files/Google/Chrome/Application/chrome.exe',
                 'C:/Program Files (x86)/Google/Chrome/Application/chrome.exe'])
WHERE InstalledVersion < '152.0.7977.82'

# Chrome 152.0.7977.82 compliance check and remediation trigger
# Security Arsenal — CVE-2026-85046 / CVE-2026-85052 response

$MinVersion = [version]"152.0.7977.82"
$ChromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
)

$Installed = $null
foreach ($p in $ChromePaths) {
    if (Test-Path $p) {
        $Installed = (Get-Item $p).VersionInfo.ProductVersion
        break
    }
}

if (-not $Installed) {
    Write-Output "NOT_INSTALLED"
    exit 0
}

if ([version]$Installed -ge $MinVersion) {
    Write-Output "COMPLIANT: Chrome $Installed"
    exit 0
}

Write-Output "NON_COMPLIANT: Chrome $Installed < $MinVersion — triggering update"

# Trigger Google Update silently
$UpdateExe = "$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe"
if (Test-Path $UpdateExe) {
    Start-Process $UpdateExe -ArgumentList "/ua /installsource scheduler" -Wait
}

# Re-check after update attempt
Start-Sleep -Seconds 30
foreach ($p in $ChromePaths) {
    if (Test-Path $p) {
        $NewVersion = [version](Get-Item $p).VersionInfo.ProductVersion
        if ($NewVersion -ge $MinVersion) {
            Write-Output "REMEDIATED: Chrome now $NewVersion (browser restart required)"
            exit 0
        }
    }
}
Write-Output "FAILED: Chrome still vulnerable — escalate for manual remediation"
exit 1

#!/bin/bash
# Chrome version compliance check — CVE-2026-85046 / CVE-2026-85052
MIN_VERSION="152.0.7977.82"
CURRENT=$(google-chrome --version 2>/dev/null | awk '{print $3}')

if [ -z "$CURRENT" ]; then
  echo "NOT_INSTALLED"
  exit 0
fi

if [ "$(printf '%s\n' "$MIN_VERSION" "$CURRENT" | sort -V | head -n1)" = "$MIN_VERSION" ]; then
  echo "COMPLIANT: Chrome $CURRENT"
else
  echo "NON_COMPLIANT: Chrome $CURRENT < $MIN_VERSION"
  apt-get update && apt-get install -y --only-upgrade google-chrome-stable || \
  yum update -y google-chrome-stable
fi