Chrome Zero-Day Exploited in the Wild — Emergency Detection and Patching Guide

---
title: Chrome Spawn Suspicious Child Process
id: 8f3d4a2c-1b5e-4f7d-9a8c-3e2b1a4d5f6e
status: experimental
description: Detects Chrome browser spawning suspicious child processes which may indicate successful browser exploitation
references:
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.initial_access
  - attack.t1204
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
  filter_legit:
    CommandLine|contains:
      - '--type='
  condition: selection_parent and selection_child and not filter_legit
falsepositives:
  - Legitimate users launching tools from browser downloads
  - Chrome extensions launching utilities
level: high
---
title: Suspicious Chrome Network Connection to Non-Standard Port
id: a7e2b5c9-3d4f-4a8e-b1c2-5d6e7f8a9b0c
status: experimental
description: Detects Chrome establishing connections to non-standard ports which may indicate C2 or exfiltration activity post-exploitation
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
    DestinationPort|notin:
      - 80
      - 443
      - 8080
      - 8443
  filter_localhost:
    DestinationIp|startswith:
      - '127.'
      - '::1'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  condition: selection and not filter_localhost
falsepositives:
  - Web applications using non-standard ports
  - Internal business applications
level: medium
---
title: Chrome Crash Dump Generation Pattern
id: b4c6d7e8-4a5b-5c9f-c2d3-6e7f8a9b0c1d
status: experimental
description: Detects unusual Chrome crash dump patterns which may indicate attempted exploitation causing instability
references:
  - https://attack.mitre.org/techniques/T1498/
author: Security Arsenal
date: 2026/04/21
tags:
  - attack.impact
  - attack.t1498
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'Crashpad\reports'
    TargetFilename|endswith:
      - '.dmp'
  timeframe: 5m
  condition: selection | count() > 3
falsepositives:
  - Legitimate Chrome crashes due to extension issues
  - Graphics driver incompatibilities
level: low

// Hunt for Chrome spawning suspicious child processes - potential exploitation indicator
let SuspiciousProcesses = datatable(Process:string)['powershell.exe','cmd.exe','wscript.exe','cscript.exe','mshta.exe','regsvr32.exe','rundll32.exe','bash.exe'];
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'chrome.exe'
| where FileName in (SuspiciousProcesses)
| where not(InitiatingProcessCommandLine contains '--type=')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

// Hunt for unusual Chrome network connections to non-standard ports
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'chrome.exe'
| where RemotePort !in (80, 443, 8080, 8443)
| where not(ipv4_is_in_range(RemoteIP, '10.0.0.0/8')) 
   and not(ipv4_is_in_range(RemoteIP, '192.168.0.0/16')) 
   and not(ipv4_is_in_range(RemoteIP, '172.16.0.0/12'))
   and not(RemoteIP startswith '127.')
| summarize count() by DeviceName, RemoteIP, RemotePort, RemoteUrl
| order by count_ desc
| take 20

// Chrome process anomaly detection - multiple crashes in short timeframe
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName =~ 'chrome.exe' 
  and ActionType =~ 'ProcessTerminated'
| project Timestamp, DeviceName, AccountName
| summarize CrashCount = count() by DeviceName, bin(Timestamp, 5m)
| where CrashCount > 5
| order by Timestamp desc

-- Hunt for Chrome processes with suspicious child processes
SELECT Parent.Name AS ParentName, Parent.Pid AS ParentPid,
       Child.Name AS ChildName, Child.Pid AS ChildPid,
       Child.CommandLine AS ChildCommandLine,
       Child.Exe AS ChildPath,
       timestamp(epoch=Child.StartTime) AS StartTime
FROM chain(pid=pslist(), name="children")
WHERE Parent.Name =~ "chrome"
  AND Child.Name =~ "(powershell|cmd|wscript|cscript|mshta|regsvr32|rundll32|bash)"
  AND NOT Child.CommandLine =~ "--type="

-- Identify recently modified Chrome cache and download directories
SELECT FullPath, Size.String AS Size,
       timestamp(epoch=Mtime) AS ModifiedTime,
       timestamp(epoch=Atime) AS AccessedTime
FROM glob(globs="*/AppData/Local/Google/Chrome/User Data/**/*")
WHERE Mtime > now() - 24h
  AND (FullPath =~ "Cache" OR FullPath =~ "Downloads")

-- Check Chrome version for vulnerable builds
SELECT Name, Pid, CommandLine,
       timestamp(epoch=StartTime) AS StartTime,
       parse_string(data=Exe, regex='.*\\([\d.]+)\\chrome.exe') AS Version
FROM pslist()
WHERE Name =~ "chrome.exe"
  AND parse_string(data=Exe, regex='.*\\([\d.]+)\\chrome.exe') !~ ""  

# Chrome Zero-Day Emergency Patch Verification and Enforcement Script
# Author: Security Arsenal
# Date: 2026-04-21

# Set strict mode for error handling
Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

# Function to get current Chrome version
function Get-ChromeVersion {
    $chromePaths = @(
        "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
        "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
        "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
    )
    
    foreach ($path in $chromePaths) {
        if (Test-Path $path) {
            $versionInfo = (Get-Item $path).VersionInfo
            return @{
                Path = $path
                Version = $versionInfo.FileVersion
                ProductVersion = $versionInfo.ProductVersion
                LastModified = (Get-Item $path).LastWriteTime
            }
        }
    }
    return $null
}

# Function to check against latest stable version (update with current version)
function Check-VulnerabilityStatus {
    param($versionInfo)
    
    # Update this with the patched version from Google advisory
    $patchedVersion = "[INSERT_CURRENT_PATCHED_VERSION_HERE]"
    
    if ([version]$versionInfo.ProductVersion -lt [version]$patchedVersion) {
        return @{
            Status = "VULNERABLE"
            RequiredVersion = $patchedVersion
            CurrentVersion = $versionInfo.ProductVersion
        }
    } else {
        return @{
            Status = "PATCHED"
            CurrentVersion = $versionInfo.ProductVersion
        }
    }
}

# Main execution
Write-Host "=== Chrome Zero-Day Emergency Check ===" -ForegroundColor Cyan
Write-Host "Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Gray
Write-Host ""

$chromeInfo = Get-ChromeVersion

if ($null -eq $chromeInfo) {
    Write-Host "[WARNING] Chrome installation not found in standard locations." -ForegroundColor Yellow
    Write-Host "Manual verification required." -ForegroundColor Yellow
    exit 1
}

Write-Host "Chrome Installation Details:" -ForegroundColor Green
Write-Host "  Path: $($chromeInfo.Path)"
Write-Host "  Version: $($chromeInfo.ProductVersion)"
Write-Host "  Last Modified: $($chromeInfo.LastModified)"
Write-Host ""

$vulnStatus = Check-VulnerabilityStatus -versionInfo $chromeInfo

if ($vulnStatus.Status -eq "VULNERABLE") {
    Write-Host "[ALERT] VULNERABLE VERSION DETECTED!" -ForegroundColor Red
    Write-Host "  Current Version: $($vulnStatus.CurrentVersion)" -ForegroundColor Red
    Write-Host "  Required Version: $($vulnStatus.RequiredVersion)" -ForegroundColor Red
    Write-Host ""
    Write-Host "IMMEDIATE ACTION REQUIRED:" -ForegroundColor Red
    Write-Host "  1. Update Chrome to $($vulnStatus.RequiredVersion) or later" -ForegroundColor Red
    Write-Host "  2. Restart all Chrome processes" -ForegroundColor Red
    Write-Host "  3. Re-scan endpoints for compromise indicators" -ForegroundColor Red
    
    # Attempt automatic update via Chrome update mechanism
    Write-Host ""
    Write-Host "Attempting to trigger Chrome update..." -ForegroundColor Yellow
    try {
        $updater = "$env:LOCALAPPDATA\Google\Update\GoogleUpdate.exe"
        if (Test-Path $updater) {
            Start-Process -FilePath $updater -ArgumentList "/ua /installsource scheduler" -Wait -NoNewWindow
            Write-Host "Update initiated. Please verify manually after completion." -ForegroundColor Green
        }
    } catch {
        Write-Host "Automatic update failed. Manual update required." -ForegroundColor Yellow
    }
    
    exit 2
} else {
    Write-Host "[SUCCESS] Chrome is patched." -ForegroundColor Green
    Write-Host "  Current Version: $($vulnStatus.CurrentVersion)" -ForegroundColor Green
    Write-Host ""
    Write-Host "Recommended Actions:" -ForegroundColor Cyan
    Write-Host "  1. Verify all Chrome processes have been restarted" -ForegroundColor Cyan
    Write-Host "  2. Review SIEM alerts for Chrome exploitation indicators" -ForegroundColor Cyan
    Write-Host "  3. Audit browser extensions for suspicious activity" -ForegroundColor Cyan
    exit 0
}