Chrome V8 Zero-Day Under Active Exploitation: Detection and Emergency Patching Guide

---
title: Chrome Renderer or Browser Process Spawning Command Shell or Script Interpreter
id: 3f8a2c91-7d4e-4b6a-9f12-8c5d6e7a9b01
status: experimental
description: Detects chrome.exe spawning cmd.exe, powershell.exe, wscript, cscript, mshta, or rundll32 — a hallmark of post-exploitation following browser compromise. Chrome renderers never legitimately spawn shells.
references:
  - https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — some enterprise browser extensions or legacy SSO tooling may invoke shells; whitelist by specific command line only after validation
level: high
---
title: Chrome Process Writing Executable Content to User-Writable Directories
id: 8b1e4d72-3a9f-4c5e-b2d8-6f7a8c9e0d12
status: experimental
description: Detects chrome.exe writing executable or script files to Temp, AppData, or Downloads paths consistent with payload staging after renderer compromise.
references:
  - https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\chrome.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.vbe'
      - '.hta'
      - '.ps1'
      - '.bat'
      - '.cmd'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Legitimate file downloads by users — correlate with process lineage and network destination; unsigned binaries dropped by chrome.exe warrant immediate triage
level: medium
---
title: Chrome Child Process Executing From Anomalous Path
id: 5c7d2e91-4b8a-4f3c-a1d6-9e0f2b4c8d35
status: experimental
description: Detects processes spawned by chrome.exe executing from Temp, AppData, or ProgramData directories — indicative of staged payload execution after browser exploitation.
references:
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.t1203
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - 'C:\ProgramData\'
      - 'C:\Users\Public\'
  condition: selection_parent and selection_path
falsepositives:
  - Chrome component updater and some installer flows run from user paths — filter known Google-signed updater binaries by signature status during triage
level: high

let Lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "chrome.exe"
| where not(FileName in~ ("chrome.exe", "GoogleUpdate.exe"))
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    HostCount = dcount(DeviceName),
    Hosts = make_set(DeviceName, 20),
    CommandLines = make_set(ProcessCommandLine, 10)
    by FileName, FolderPath, SHA256
| extend IsScriptOrShell = FileName has_any ("cmd.exe", "powershell", "pwsh", "mshta", "wscript", "cscript", "rundll32", "regsvr32", "certutil", "bitsadmin", "wmic")
| extend Severity = case(
    IsScriptOrShell and HostCount <= 5, "CRITICAL — rare shell/script child of chrome.exe",
    IsScriptOrShell, "HIGH — shell/script child of chrome.exe",
    HostCount <= 3 and FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\"), "HIGH — rare child from user-writable path",
    "REVIEW")
| sort by HostCount asc

let Lookback = 14d;
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName has_any (".exe", ".dll", ".scr", ".hta", ".ps1", ".js", ".vbs", ".bat", ".cmd")
| where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\Downloads\\", "\\ProgramData\\")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256,
          InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated desc

-- Hunt: Chrome processes with suspicious child processes (post-exploitation indicator)
LET parents = SELECT Pid, Name, Exe, Username
FROM pslist()
WHERE Name =~ 'chrome'

LET children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|certutil'
   OR Exe =~ '(?i)\\Temp\\|\\AppData\\|\\ProgramData\\'

SELECT children.Pid AS ChildPid,
       children.Name AS ChildName,
       children.Exe AS ChildPath,
       children.CommandLine AS ChildCommandLine,
       children.CreateTime AS ChildStartTime,
       parents.Pid AS ChromePid,
       parents.Username AS ChromeUser
FROM children
JOIN parents ON children.Ppid = parents.Pid

# Chrome emergency patch verification — run via RMM/Intune/GPO across the fleet
# Exports per-host compliance status to CSV for aggregation

$minVersionNote = "Verify against the current Stable build at https://chromereleases.googleblog.com/"
$results = @()

# Locate Chrome installs (machine-wide and per-user)
$chromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)

$installed = $null
foreach ($p in $chromePaths) {
    if (Test-Path $p) { $installed = $p; break }
}

if ($installed) {
    $ver = (Get-Item $installed).VersionInfo.ProductVersion

    # Check for pending update awaiting restart (chrome.exe running with older version)
    $running = Get-Process chrome -ErrorAction SilentlyContinue | Select-Object -First 1
    $runningVer = $null
    if ($running) {
        try { $runningVer = ([Diagnostics.FileVersionInfo]::GetVersionInfo($running.Path)).ProductVersion } catch {}
    }

    # Check if Chrome update services are disabled (common in locked-down images — now a liability)
    $updateSvcDisabled = $false
    foreach ($svc in 'gupdate','gupdatem') {
        $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
        if ($s -and $s.StartType -eq 'Disabled') { $updateSvcDisabled = $true }
    }

    # Check registry policy that blocks updates
    $updateBlocked = $false
    $pol = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Update' -ErrorAction SilentlyContinue
    if ($pol -and $pol.UpdateDefault -eq 0) { $updateBlocked = $true }

    $results += [PSCustomObject]@{
        Hostname             = $env:COMPUTERNAME
        ChromeInstalled      = $true
        InstalledVersion     = $ver
        RunningVersion       = $runningVer
        PendingRestart       = ($runningVer -and $ver -ne $runningVer)
        UpdateSvcDisabled    = $updateSvcDisabled
        UpdatePolicyBlocked  = $updateBlocked
        Note                 = $minVersionNote
    }
} else {
    $results += [PSCustomObject]@{
        Hostname = $env:COMPUTERNAME; ChromeInstalled = $false
        InstalledVersion = $null; RunningVersion = $null
        PendingRestart = $false; UpdateSvcDisabled = $false
        UpdatePolicyBlocked = $false; Note = $minVersionNote
    }
}

$results | Export-Csv -Path "$env:TEMP\chrome_patch_status_$env:COMPUTERNAME.csv" -NoTypeInformation
$results | Format-List

# If a pending restart is detected, optionally force Chrome relaunch (coordinate with users first):
# Get-Process chrome -ErrorAction SilentlyContinue | Stop-Process -Force