ChromeOS LTC 150.0.7871.253 Patches 8 Flaws Including CVE-2026-79195 and CVE-2026-84349 Use-After-Free Bugs — Defender's Guide

Google has pushed a new Long Term Support Channel (LTC) build for ChromeOS — version 150.0.7871.253 (Platform Version 16700.63.0) — and it carries a security payload that defenders should not treat as routine. The update remediates eight vulnerabilities, six of which are rated High severity, spanning the Chromium rendering engine, the browser process itself, WebRTC, the GPU stack, extensions authorization, crash handling, and federated identity (FedCM).

If you operate ChromeOS devices on the LTC channel — common in education, healthcare, retail, and kiosk-style enterprise deployments — those devices will receive this update automatically. The LTS channel remains pinned to LTS-144 until October 6th, 2026, which means LTS fleets do not receive these fixes and carry residual exposure. That distinction matters and is the first decision point for your vulnerability management program.

The vulnerability mix is notable: four use-after-free conditions (CVE-2026-79195, CVE-2026-84349, CVE-2026-79187, CVE-2026-79078), an out-of-bounds write in Crashpad (CVE-2026-78952), an information leak in the GPU process (CVE-2026-79274), and two incorrect-authorization bugs in the Extensions subsystem (CVE-2026-78954, CVE-2026-79174). Use-after-free and out-of-bounds write bugs in renderer-reachable components are the classic building blocks of drive-by browser exploitation — a malicious web page is the only delivery mechanism required.

Technical Analysis

Affected Products and Versions

Because ChromeOS shares the Chromium engine, these component-level bugs (V8/Script, Browser, WebRTC, GPU, Extensions, Crashpad, FedCM) map to the same codebase that ships in Chrome browser on Windows, macOS, and Linux. Organizations should correlate this advisory with current Chrome stable-channel releases across their non-ChromeOS fleet — the same component fixes frequently land there on a parallel cadence.

Vulnerability Breakdown

Google has not published CVSS scores with this advisory; the High/Medium ratings are Chromium's internal severity classifications. Do not wait for NVD enrichment to act — Chromium High-severity memory corruption bugs in renderer-reachable components have a long history of weaponization.

How These Bugs Are Exploited — Defender's View

• Use-after-free in Script/V8 (CVE-2026-79195): Triggered by malicious JavaScript on any web page the user visits. A successful UAF in the JS engine typically yields arbitrary read/write primitives within the renderer sandbox — the first stage of nearly every modern browser exploit chain.
• Use-after-free in Browser (CVE-2026-84349): Memory corruption in the privileged browser process. Bugs at this layer are valued because they can bypass or weaken the renderer sandbox boundary.
• Incorrect authorization in Extensions (CVE-2026-78954, CVE-2026-79174): Authorization logic flaws in the Extensions subsystem can let an extension — or web content interacting with extension APIs — exceed its granted permission scope. This is a privilege-escalation primitive that pairs well with a malicious or compromised extension.
• Use-after-free in WebRTC (CVE-2026-79187): WebRTC is reachable from any page that invokes real-time media APIs; it requires no plugins and minimal user interaction beyond page load and API calls.
• Information leak in GPU (CVE-2026-79274): GPU-process info leaks are typically chained to defeat ASLR, turning a difficult memory corruption bug into a reliable exploit.
• Out-of-bounds write in Crashpad (CVE-2026-78952): Crashpad is the crash-reporting subsystem. A controlled OOB write in a crash handler is an unusual but real exploitation surface — particularly for attacks that intentionally crash a process and corrupt state during crash handling.
• Use-after-free in FedCM (CVE-2026-79078): The Federated Credential Management API handles identity flows. Memory corruption here sits adjacent to authentication token handling, which raises the stakes beyond a typical renderer bug.

Exploitation status: The advisory does not indicate active in-the-wild exploitation, and none of these CVEs are listed in CISA's Known Exploited Vulnerabilities catalog as of this writing. Treat this as a pre-weaponization window — the period between patch release and PoC emergence is when disciplined patching pays off. Historically, Chromium UAF bugs move from patch to public exploit technique write-ups in weeks, not months.

Detection & Response

Post-patch verification is the primary defense, but you should also hunt for the behavioral signatures of renderer compromise and extension abuse across your Chromium-based endpoints. Browser exploitation leaves observable traces: renderer or GPU processes spawning unexpected children, suspicious extension installs, and crash-handler anomalies.

Sigma Rules

The following rules target the most reliable behavioral indicator of Chromium exploitation on Windows endpoints running Chrome (the same engine): a renderer, GPU, or utility process spawning a shell or script interpreter — behavior that essentially never occurs legitimately.

---
title: Chromium Renderer or GPU Process Spawning Shell or Script Interpreter
id: 3f8a2c91-7b4e-4d1a-9c62-8e5f6a1b2d3e
status: experimental
description: Detects Chrome renderer, GPU, or utility processes spawning command shells or script interpreters, consistent with post-exploitation following browser memory corruption (e.g., CVE-2026-79195, CVE-2026-79187, CVE-2026-84349 class bugs).
references:
  - http://chromereleases.googleblog.com/2026/09/long-term-support-channel-update-for_0889074137.html
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
    ParentCommandLine|contains:
      - '--type=renderer'
      - '--type=gpu-process'
      - '--type=utility'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; some enterprise browser automation frameworks may trigger
level: high
---
title: Suspicious Chrome Extension Installed Outside Enterprise Policy Path
id: 9c4d7e12-2a8f-4b36-8d51-1f3e7b9a4c52
status: experimental
description: Detects Chrome extension directories created outside enterprise force-install or policy-managed paths, relevant to Extensions authorization abuse scenarios (CVE-2026-78954, CVE-2026-79174).
references:
  - http://chromereleases.googleblog.com/2026/09/long-term-support-channel-update-for_0889074137.html
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: '\AppData\Local\Google\Chrome\User Data\'
    TargetFilename|contains: '\Extensions\'
    TargetFilename|endswith: '\manifest.json'
  filter_sideload:
    TargetFilename|contains: '\Downloads\'
  condition: selection and not filter_sideload
falsepositives:
  - Legitimate user-installed extensions from the Chrome Web Store; baseline the environment and alert on new or unsigned extension IDs
level: medium
---
title: Crashpad Handler Launched by Unusual Parent Process
id: 5b1e8f47-6c3a-49d2-a784-2d6c4e8b1f35
status: experimental
description: Detects Chrome's Crashpad handler being spawned by processes other than chrome.exe, which may indicate abuse of the crash-handling subsystem relevant to CVE-2026-78952 (out-of-bounds write in Crashpad).
references:
  - http://chromereleases.googleblog.com/2026/09/long-term-support-channel-update-for_0889074137.html
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\crashpad_handler.exe'
  filter_legit:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\explorer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Non-Chrome applications bundling Crashpad (Electron apps); tune by full image path
level: medium

KQL — Microsoft Sentinel / Defender

Use these queries to hunt for post-exploitation behavior and to assess patch exposure across your Chromium fleet. Note that DeviceFileEvents surfaces the installed Chrome version, letting you build an exposure picture without a separate scanner sweep.

// Hunt 1: Chrome renderer/GPU/utility processes spawning shells or LOLBins
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessCommandLine has_any ("--type=renderer", "--type=gpu-process", "--type=utility")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 2: New Chrome extension manifests written in the last 14 days (Extensions authZ bugs)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has @"\Google\Chrome\User Data\" and FolderPath has @"\Extensions\"
| where FileName =~ "manifest.json"
| summarize FirstSeen = min(TimeGenerated), Devices = dcount(DeviceId) by FolderPath
| order by FirstSeen desc

// Hunt 3: Fleet exposure — identify endpoints running outdated Chrome builds
DeviceFileEvents
| where TimeGenerated > ago(1d)
| where FileName =~ "chrome.exe" and FolderPath has @"\Google\Chrome\Application\"
| extend ChromeVersion = tostring(FolderPath)
| summarize arg_max(TimeGenerated, *) by DeviceName
| project DeviceName, FolderPath, TimeGenerated

Velociraptor VQL

For DFIR teams triaging a suspected browser-compromise endpoint, this artifact enumerates Chromium child-process anomalies and extension artifacts in one pass.

-- Hunt for Chrome renderer-spawned children and recently modified extension artifacts
LET proc_hunt = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '--type=(renderer|gpu-process|utility)'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)\\.exe$'
  AND Ppid IN (SELECT Pid FROM proc_hunt)

LET extension_artifacts = SELECT FullPath, Mtime, Size
FROM glob(globs='C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Extensions/*/*/manifest.json')
WHERE Mtime > (now() - 1209600)

SELECT * FROM suspicious_children
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'EXTENSION_ARTIFACT' AS Name, FullPath AS CommandLine, '' AS Exe, '' AS Username, Mtime AS CreateTime FROM extension_artifacts

Remediation

Immediate Actions

1. Verify LTC devices received the update. LTC-channel devices update automatically, but "will be updated" is not "is updated." In the Google Admin console (Devices → Chrome → Devices), confirm the OS version reports 150.0.7871.253 / platform 16700.63.0 or later. Force a reboot on devices with pending updates — ChromeOS applies OS updates on restart.
2. Address LTS-channel exposure. LTS devices remain on LTS-144 until October 6, 2026 and do not receive these eight fixes. If your LTS devices browse untrusted web content (as opposed to locked-down kiosk/VDI launcher roles), evaluate migrating them to the LTC channel ahead of the LTS-150 transition, or isolate their browsing surface.
3. Patch Chrome on Windows/macOS/Linux endpoints in parallel — the underlying Chromium component bugs are shared. Enforce auto-update via policy (RelaunchNotification, RelaunchWindow) and verify version compliance.
4. Audit extensions. Given the two Extensions authorization CVEs (CVE-2026-78954, CVE-2026-79174), enforce an allowlist via ExtensionInstallAllowlist / ExtensionInstallForcelist policy and inventory what is already installed. Authorization flaws in the Extensions subsystem are only dangerous if risky extensions are present.

Verification Script

This PowerShell script audits Windows endpoints for installed Chrome version and flags non-compliant builds, and lists installed extensions for authorization-abuse review. Run it via your RMM or as a scheduled task across the fleet.

# ChromeOS LTC 150 / Chromium component patch verification (Windows endpoints)
# Checks installed Chrome version against the fixed component baseline

$FixedVersion = [version]"150.0.7871.253"
$chromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)

$chrome = $chromePaths | Where-Object { Test-Path $_ } | Select-Object -First 1

if ($chrome) {
    $installed = [version](Get-Item $chrome).VersionInfo.ProductVersion
    Write-Host "[+] Chrome installed: $installed"
    if ($installed -lt $FixedVersion) {
        Write-Host "[!] VULNERABLE: Chrome build is below $FixedVersion. Affected by CVE-2026-79195, CVE-2026-84349, CVE-2026-79187, CVE-2026-78952, CVE-2026-79078, CVE-2026-79274, CVE-2026-78954, CVE-2026-79174."
        exit 1
    } else {
        Write-Host "[OK] Chrome is at or above the fixed baseline."
        exit 0
    }
} else {
    Write-Host "[-] Chrome not found on this endpoint."
}

# Enumerate user-installed extensions for authorization-abuse review (CVE-2026-78954 / CVE-2026-79174)
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\*\Extensions" -Directory -ErrorAction SilentlyContinue |
    ForEach-Object { Write-Host "[EXT] $($_.FullName)" }

Hardening Recommendations

• Enforce extension allowlisting through Chrome Enterprise policy; deny-by-default removes the Extensions attack surface entirely.
• Restrict WebRTC where business-justified (policy WebRtcLocalIpsAllowedUrls, or disabling WebRTC on kiosk roles) — CVE-2026-79187 requires WebRTC API reachability.
• Enable site isolation and strict site-per-process (default in current ChromeOS, but verify it has not been policy-disabled).
• Monitor the CISA KEV catalog for any of these eight CVEs. If one lands there, federal civilian agencies face a binding remediation deadline under BOD 22-01, and private-sector organizations should treat the KEV due date as their own.
• Reference: Official advisory — Chrome Releases Blog: Long Term Support Channel Update for ChromeOS.

Summary Timeline Guidance

The pre-weaponization window for Chromium memory-corruption bugs is measured in weeks. Treat this LTC release with the same urgency you would a browser stable-channel security drop — because that is exactly what it is.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub