Chrome 155.0.8059.39 Patches 247 Flaws Including Critical CVE-2026-106197 and CVE-2026-106382 — Enterprise Update and Verification Guide

---
title: Chrome Browser Process Spawning Suspicious Child Process
id: 3f8a1c92-5d7e-4b41-a9c6-2e1f8d3b7a45
status: experimental
description: Detects chrome.exe spawning command interpreters, scripting engines, or Office-adjacent processes — a hallmark of successful browser exploitation leading to post-exploitation staging. Relevant to exploitation of critical Chrome UAF flaws such as CVE-2026-106197 and CVE-2026-106382.
references:
  - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some enterprise browser extensions or SSO tooling may spawn helper processes, but chrome.exe spawning cmd.exe or PowerShell is almost never legitimate
level: high
---
title: Outdated Chrome Version Detected in Process Execution
id: 8c2e4f17-6a3d-4e58-b1c9-7d4a2f6e8b31
status: experimental
description: Identifies execution of Chrome builds older than 155.0.8059.39 via version-string-bearing install paths, indicating hosts unpatched against CVE-2026-106197 and CVE-2026-106382. Tune the path matching to your environment's Chrome deployment model.
references:
  - https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\Google\Chrome\Application\154.'
      - '\Google\Chrome\Application\153.'
      - '\Google\Chrome\Application\152.'
      - '\Google\Chrome\Application\151.'
      - '\Google\Chrome\Application\150.'
  filter_canary_beta:
    Image|contains:
      - '\Chrome SxS\'
  condition: selection and not filter_canary_beta
falsepositives:
  - Versioned Chrome paths only appear when Chrome is installed per-version (enterprise MSI deployments); per-user installs use a flat Application directory
level: medium

// Hunt 1: Fleet-wide Chrome version exposure — hosts running builds below 155.0.8059.39
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "chrome.exe"
| extend ParsedVersion = parse_version(ProcessVersionInfoProductVersion)
| summarize LastSeen = max(TimeGenerated),
            ChromeVersion = any(ProcessVersionInfoProductVersion),
            UserCount = dcount(AccountName)
    by DeviceName
| extend Parsed = parse_version(ChromeVersion)
| extend IsVulnerable = iff(Parsed.Major < 155
    or (Parsed.Major == 155 and Parsed.Minor == 0 and Parsed.Build < 8059)
    or (Parsed.Major == 155 and Parsed.Minor == 0 and Parsed.Build == 8059 and Parsed.Revision < 39), true, false)
| where IsVulnerable == true
| project DeviceName, ChromeVersion, LastSeen, UserCount
| order by LastSeen desc;

// Hunt 2: Post-exploitation behavior — chrome.exe spawning LOLBins or shells
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe",
    "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
    "certutil.exe", "bitsadmin.exe", "wmic.exe")
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 3: Chrome crash clustering — repeated renderer/browser crashes on a host can indicate exploit attempts (heap grooming failures)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "chrome.exe"
| where ProcessCommandLine has "--type=" // renderer/GPU/utility child processes
| summarize ChildSpawns = count() by DeviceName, bin(TimeGenerated, 1h)
| where ChildSpawns > 500 // abnormal churn baseline — tune per environment
| order by ChildSpawns desc

-- Enumerate installed Chrome versions and running instances for patch verification
-- against CVE-2026-106197 / CVE-2026-106382 (fixed in 155.0.8059.39)
LET installs = SELECT FullPath,
       parse_string_with_regex(
         string=FullPath,
         regex='Application\\(?P<ver>[0-9.]+)\\').ver AS Version
FROM glob(globs='C:/Program Files*/Google/Chrome/Application/*/chrome.exe')

LET running = SELECT Pid, Name, Exe, Username, CreateTime, CommandLine
FROM pslist()
WHERE Name =~ 'chrome'

SELECT * FROM installs
UNION ALL
SELECT Exe AS FullPath, 'RUNNING: ' + str(string=Pid) AS Version FROM running

# Force Chrome update and verify version >= 155.0.8059.39 (CVE-2026-106197 / CVE-2026-106382)
$minVersion = [version]"155.0.8059.39"

# Trigger Google Update (Omaha) for Chrome if present
$updateExe = "$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe"
if (Test-Path $updateExe) {
    & $updateExe /ua /installsource scheduler 2>$null
    Start-Sleep -Seconds 90
}

# Locate chrome.exe (system and per-user installs)
$paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
$chrome = $paths | Where-Object { Test-Path $_ } | Select-Object -First 1

if (-not $chrome) {
    Write-Output "CHROME_NOT_INSTALLED"
    exit 0
}

$installed = [version](Get-Item $chrome).VersionInfo.ProductVersion
if ($installed -ge $minVersion) {
    Write-Output "COMPLIANT: Chrome $installed"
    exit 0
} else {
    Write-Output "NONCOMPLIANT: Chrome $installed < $minVersion — user must restart browser"
    exit 1
}

#!/bin/bash
# Verify/update Chrome on Debian/Ubuntu and RHEL-based systems
MIN="155.0.8059.39"

if command -v google-chrome >/dev/null 2>&1; then
    CUR=$(google-chrome --version | grep -oE '[0-9.]+')
    if [ "$(printf '%s\n%s\n' "$MIN" "$CUR" | sort -V | head -1)" = "$MIN" ]; then
        echo "COMPLIANT: Chrome $CUR"
    else
        echo "NONCOMPLIANT: Chrome $CUR < $MIN — updating"
        (apt-get update && apt-get install -y --only-upgrade google-chrome-stable) 2>/dev/null \
          || yum update -y google-chrome-stable 2>/dev/null
        google-chrome --version
    fi
else
    echo "CHROME_NOT_INSTALLED"
fi