Chrome 156 Stable Channel Update: 353 Security Fixes — Enterprise Patch Verification and Detection Guide

---
title: Chrome Renderer or Utility Process Spawning Command Shell
description: Detects chrome.exe spawning cmd.exe, powershell.exe, or script interpreters — a strong post-exploitation indicator following renderer or sandbox compromise. Browsers should essentially never spawn shells in normal operation.
references:
  - https://chromereleases.googleblog.com/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/10/21
id: 6b1f3a9c-2d4e-4f8a-b7c1-9e5d2a8f3c04
status: experimental
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser extensions invoking local helpers
  - Legitimate software updaters launched from browser (investigate command line)
level: high
---
title: Outdated Chrome Version Executing on Endpoint
description: Detects execution of Chrome builds older than 156.0.8078.47 via command-line version artifacts or non-standard install paths. Correlate with software inventory; tunable to environment baseline.
references:
  - https://chromereleases.googleblog.com/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/10/21
id: 3c8e5f1a-7b2d-4a9e-8c6f-1d4b7e2a5f09
status: experimental
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Google\Chrome\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_standard:
    Image|startswith:
      - 'C:\Program Files\Google\Chrome\Application\'
      - 'C:\Program Files (x86)\Google\Chrome\Application\'
  condition: selection_path and not filter_standard
falsepositives:
  - Portable Chrome deployments
  - User-scope Chrome installs under AppData (legitimate but unmanaged — flag for review)
level: medium
---
title: Suspicious Child Process From Chromium-Based Browser on Linux
description: Detects chrome or chromium processes spawning shells or download tools on Linux, consistent with post-exploitation behavior following browser compromise.
references:
  - https://chromereleases.googleblog.com/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/10/21
id: 9d2a7c4e-5f1b-4e8a-9d3c-6a8f1b4e7c02
status: experimental
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/chrome'
      - '/chromium'
      - '/chromium-browser'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Developer workflows launching terminals from browser-based IDEs
level: high

// Hunt 1: Fleet-wide Chrome version compliance — flag any running Chrome below 156.0.8078.47
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "chrome.exe"
| extend VersionParts = split(FileVersion, ".")
| extend Major = toint(VersionParts[0]), Build = toint(VersionParts[2]), Patch = toint(VersionParts[3])
| extend IsCompliant = iff(Major > 156 or (Major == 156 and Build > 8078) or (Major == 156 and Build == 8078 and Patch >= 47), true, false)
| where IsCompliant == false
| summarize LastSeen = max(TimeGenerated), ReportedVersion = any(FileVersion) by DeviceName, ReportedVersion
| order by LastSeen desc

// Hunt 2: Behavioral — Chrome spawning LOLBins or shells (post-exploitation TTP)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 3: Linux endpoints ingested via Syslog/CEF — shell spawned by browser process
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("chrome", "chromium")
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "curl ", "wget ", "python")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Enumerate Chrome version from registry/uninstall keys and running processes
SELECT 
    Name AS ProcessName,
    Pid,
    Exe AS ProcessPath,
    CreateTime AS ProcessStart,
    Username
FROM pslist()
WHERE Name =~ '(?i)chrome\.exe' OR Exe =~ '(?i)chrome'

-- Companion: read installed Chrome version from Windows registry
SELECT 
    FullPath,
    Data.value AS InstalledVersion,
    Mtime AS KeyLastWrite
FROM glob(
    globs='HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome\\DisplayVersion',
    accessor='registry'
)

# Chrome 156 Compliance Verification - Security Arsenal
# Target: 156.0.8078.47 or higher
$targetVersion = [version]"156.0.8078.47"
$results = [PSCustomObject]@{
    Hostname          = $env:COMPUTERNAME
    InstalledVersion  = $null
    RunningVersion    = $null
    Compliant         = $false
    StaleProcessFound = $false
}

# Check installed version via registry (covers both machine and user scope)
$regPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"
)
foreach ($path in $regPaths) {
    if (Test-Path $path) {
        $v = (Get-ItemProperty $path -ErrorAction SilentlyContinue).DisplayVersion
        if ($v) { $results.InstalledVersion = $v; break }
    }
}

# Check RUNNING chrome.exe processes - patch not effective until restart
$chromeProcs = Get-Process chrome -ErrorAction SilentlyContinue
if ($chromeProcs) {
    $runningFile = $chromeProcs[0].Path
    if ($runningFile) {
        $results.RunningVersion = (Get-Item $runningFile).VersionInfo.ProductVersion
        if ($results.InstalledVersion -and $results.RunningVersion) {
            if ([version]$results.RunningVersion -lt $targetVersion -and [version]$results.InstalledVersion -ge $targetVersion) {
                $results.StaleProcessFound = $true
            }
        }
    }
}

# Compliance check on installed version
if ($results.InstalledVersion) {
    $results.Compliant = ([version]$results.InstalledVersion -ge $targetVersion)
}

# Trigger Google Update if non-compliant and update service exists
if (-not $results.Compliant) {
    $updateExe = "$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe"
    if (Test-Path $updateExe) {
        Start-Process $updateExe -ArgumentList "/ua /installsource scheduler" -NoNewWindow
        Write-Output "Triggered Google Update on $env:COMPUTERNAME"
    }
}

$results | Format-List
# Exit code for RMM alerting: 1 if non-compliant or stale process, 0 if clean
if (-not $results.Compliant -or $results.StaleProcessFound) { exit 1 } else { exit 0 }