Chrome 154 for Android (154.0.8037.126) Released: Why Mobile Browser Patching Is a SOC Priority in 2026

---
title: Chrome Browser Process Spawning Shell or Script Interpreter
id: 3f8a2c41-9d1e-4b7a-a2f5-6c8d1e4b9a07
status: experimental
description: Detects chrome.exe spawning command shells, script interpreters, or LOLBins, a common post-exploitation behavior following renderer compromise or malicious extension activity.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_extensions:
    ParentCommandLine|contains: '--type='
  condition: selection_parent and selection_child and not filter_extensions
falsepositives:
  - Rare; some enterprise extensions or internal web apps launching local helpers. Tune per environment.
level: high
---
title: Executable Dropped into Chrome Download or User Temp and Executed
id: 8b2e5d90-4f1a-4c6b-9e3d-7a5c2f8b1d46
status: experimental
description: Detects execution of binaries from browser download staging or temp directories shortly after creation, consistent with drive-by download or browser-delivered payload execution.
references:
  - https://attack.mitre.org/techniques/T1204.002/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\Downloads\'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.msi'
  filter_known:
    Image|contains:
      - '\Downloads\Teams_windows'
      - '\Downloads\ZoomInstaller'
  condition: selection_path and selection_ext and not filter_known
falsepositives:
  - Users executing legitimately downloaded installers. Whitelist known software distribution paths and review hits for unsigned binaries first.
level: medium

// Hunt 1: Devices running Chrome below the 154.0.8037.97/.98 fixed baseline (Windows/macOS)
DeviceTvmSoftwareInventory
| where SoftwareName has_any ("google_chrome", "chrome")
| extend ParsedVersion = parse_version(SoftwareVersion)
| where ParsedVersion < parse_version("154.0.8037.97")
| summarize arg_max(TimeGenerated, *) by DeviceId, SoftwareName, SoftwareVersion
| project DeviceName, SoftwareName, SoftwareVersion, OSPlatform
| sort by DeviceName asc;

// Hunt 2: Chrome spawning suspicious child processes (post-exploitation indicator)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
    "bitsadmin.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, SHA256, FolderPath
| sort by TimeGenerated desc;

// Hunt 3: Android devices with outdated Chrome (requires Defender for Endpoint mobile onboarding or Intune sync)
DeviceInfo
| where OSPlatform has_any ("Android")
| join kind=inner (
    DeviceTvmSoftwareInventory
    | where SoftwareName has "chrome"
) on DeviceId
| where parse_version(SoftwareVersion) < parse_version("154.0.8037.126")
| project DeviceName, OSPlatform, SoftwareVersion, LoggedOnUsers

-- Verify Chrome version and inspect chrome.exe process trees for suspicious children
SELECT * FROM foreach(
    row={
        SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
        FROM pslist()
        WHERE Name =~ '(?i)chrome\.exe$'
    },
    query={
        SELECT Pid, Ppid, Name, Exe, Username, CreateTime,
               parse_pe(file=Exe).FileVersion AS ChromeVersion,
               CommandLine
        FROM scope()
        WHERE Name =~ '(?i)chrome\.exe$'
    })

-- Companion: children spawned by any chrome.exe process
SELECT child.Pid AS ChildPid, child.Name AS ChildName,
       child.CommandLine AS ChildCommandLine, child.Exe AS ChildExe,
       parent.Name AS ParentName, parent.Pid AS ParentPid,
       child.Username AS Username, child.CreateTime AS CreateTime
FROM foreach(
    row={
        SELECT Pid AS ParentPid, Name AS ParentName
        FROM pslist()
        WHERE Name =~ '(?i)chrome\.exe$'
    },
    query={
        SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
               ParentPid, ParentName
        FROM pslist()
        WHERE Ppid = ParentPid
            AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|msiexec)\.exe$'
    })

# Chrome patch verification — Windows fleet (run via RMM/Intune/SCCM or locally)
$FixedVersion = [version]"154.0.8037.97"
$Paths = @(
    "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
$Found = $false
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        $Found = $true
        $Installed = [version](Get-Item $Path).VersionInfo.ProductVersion
        if ($Installed -ge $FixedVersion) {
            Write-Output "COMPLIANT: Chrome $Installed at $Path (>= $FixedVersion)"
        } else {
            Write-Output "NON-COMPLIANT: Chrome $Installed at $Path — update required"
            # Trigger enterprise update mechanism if configured
            $UpdateExe = "${env:ProgramFiles(x86)}\Google\Update\GoogleUpdate.exe"
            if (Test-Path $UpdateExe) {
                Start-Process $UpdateExe -ArgumentList "/ua /installsource scheduler" -NoNewWindow
            }
        }
    }
}
if (-not $Found) { Write-Output "INFO: Chrome not installed on this host." }

#!/bin/bash
# Chrome/Chromium patch verification — Linux and Android (via ADB)

FIXED_LINUX="153.0.8010.97"
FIXED_ANDROID="154.0.8037.126"

# --- Linux desktop check ---
if command -v google-chrome >/dev/null 2>&1; then
    INSTALLED=$(google-chrome --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
    echo "[Linux] Chrome installed: $INSTALLED (fixed baseline: $FIXED_LINUX)"
    if [ "$(printf '%s\n' "$FIXED_LINUX" "$INSTALLED" | sort -V | head -n1)" != "$FIXED_LINUX" ]; then
        echo "[Linux] NON-COMPLIANT — run: sudo apt update && sudo apt install --only-upgrade google-chrome-stable"
    else
        echo "[Linux] COMPLIANT"
    fi
fi

# --- Android check via ADB (device must be connected/authorized) ---
if command -v adb >/dev/null 2>&1 && adb get-state 2>/dev/null | grep -q device; then
    ANDROID_VER=$(adb shell dumpsys package com.android.chrome | grep -m1 versionName | cut -d= -f2 | tr -d ' \r')
    echo "[Android] Chrome installed: $ANDROID_VER (fixed baseline: $FIXED_ANDROID)"
    if [ "$(printf '%s\n' "$FIXED_ANDROID" "$ANDROID_VER" | sort -V | head -n1)" != "$FIXED_ANDROID" ]; then
        echo "[Android] NON-COMPLIANT — push update via Managed Google Play or instruct user to update"
    else
        echo "[Android] COMPLIANT"
    fi
fi