Chromium 154.0.8037.57 for Fedora 45: Patching CVE-2026-95277 Use-After-Free and Three Additional Critical Vulnerabilities — Detection and Remediation Guide

---
title: Chromium Renderer Spawning Shell or Interpreter on Linux
id: 3f7a1c94-8b2e-4d51-9c63-5a1e7f2b8d90
status: experimental
description: Detects Chromium browser or renderer processes spawning shells, interpreters, or download utilities — a high-fidelity indicator of successful browser exploitation such as a use-after-free chain (e.g., CVE-2026-95277) escaping or abusing the renderer.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-45-chromium-2026-735231f9e0
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/14
tags:
  - attack.execution
  - attack.exploitation_for_client_execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/chrome'
      - '/chromium'
      - '/chromium-browser'
      - '/chrome_crashpad_handler'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
      - '/chmod'
  condition: selection_parent and selection_child
falsepositives:
  - Developer workflows launching terminals from Chromium-based IDEs (rare on pure Chromium browser)
  - Legitimate 'open in terminal' extensions
level: high
---
title: Executable Dropped by Chromium Process in User-Writable Path
id: 8c2e5b17-4f3a-4d90-a671-9e3c2f1a7b45
status: experimental
description: Detects Chromium writing executable files to user-writable directories such as /tmp, /dev/shm, or user home — consistent with post-exploitation payload staging after a browser memory-corruption exploit.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-45-chromium-2026-735231f9e0
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/01/14
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: linux
detection:
  selection_source:
    Image|endswith:
      - '/chrome'
      - '/chromium'
      - '/chromium-browser'
  selection_path:
    TargetFilename|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '/run/user/'
  filter_downloads:
    TargetFilename|contains:
      - '/Downloads/'
  condition: selection_source and selection_path and not filter_downloads
falsepositives:
  - Browser cache and temporary rendering artifacts (mitigate by alerting on execute-bit set via auditd execve correlation)
level: medium
---
title: Outbound Connection from Chromium to Rare Port Followed by Process Spawn
id: 61d4a8f2-7c9b-4e15-b382-6f0a3d5c9e21
status: experimental
description: Detects Chromium establishing outbound connections to uncommon high ports in close proximity to unexpected child process creation — a pattern consistent with exploit delivery followed by C2 callback.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-45-chromium-2026-735231f9e0
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/01/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/chrome'
      - '/chromium'
      - '/chromium-browser'
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 8443
      - 9001
      - 1337
      - 31337
  filter_localhost:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  condition: selection and not filter_localhost
falsepositives:
  - Local development servers and proxy configurations
  - Legitimate applications on non-standard ports
level: medium

// Hunt: Chromium process spawning shells/interpreters/download tools (post-browser-exploit behavior)
// Requires: auditd execve logs ingested via Syslog/CEF connector
let SuspiciousChildren = dynamic(["bash", "/bin/sh", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat"]);
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "user" or SyslogMessage has "EXECVE" or SyslogMessage has "execve"
| where SyslogMessage has_any ("chromium", "chrome")
| extend RawMsg = SyslogMessage
| where SuspiciousChildren |> any_of(fun -> RawMsg has fun)
| parse RawMsg with * "ppid=" PPID:string " " *
| parse RawMsg with * "comm=\"" ChildComm:string "\"" *
| project TimeGenerated, Computer, ProcessName, ChildComm, RawMsg
| summarize EventCount = count(), DistinctChildren = dcount(ChildComm), SampleCommands = make_set(RawMsg, 5) by Computer, bin(TimeGenerated, 1h)
| order by TimeGenerated desc

// Correlate: Chromium network connections to rare ports within 10 minutes of child process creation
let BrowserChildren =
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "chromium" and SyslogMessage has_any ("bash", "curl", "wget", "python")
| summarize FirstChild = min(TimeGenerated) by Computer;
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where ApplicationProtocol in ("http", "https") or isnotempty(DestinationPort)
| where DestinationPort in (4444, 5555, 6666, 8443, 9001, 1337, 31337)
| join kind=inner BrowserChildren on $left.DeviceName == $right.Computer
| where TimeGenerated between (FirstChild .. FirstChild + 10m)
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, FirstChild
| order by TimeGenerated desc

-- Hunt: Chromium post-exploitation indicators on Fedora 45 endpoints
-- Identifies suspicious Chromium child processes AND checks chromium package version
LET suspicious_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
       getprocess(Ppid=Pid).Name AS ParentName
FROM pslist()
WHERE (ParentName =~ '(?i)chrom(e|ium)'
   OR Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)chrom(e|ium)'))
  AND (Name =~ '(?i)^(bash|sh|zsh|dash|python[0-9.]*|perl|curl|wget|nc|ncat|socat)$'
   OR CommandLine =~ '(?i)(curl|wget|bash -i|/dev/tcp|base64 -d|chmod \+x)')

LET chromium_version = SELECT * FROM execve(
   argv=['/bin/bash', '-c', 'rpm -q chromium 2>/dev/null || chromium --version 2>/dev/null'])

SELECT 'suspicious_child_process' AS FindingType, Pid, Ppid, ParentName, Name,
       CommandLine, Exe, Username, CreateTime, NULL AS Stdout
FROM suspicious_procs
UNION ALL
SELECT 'chromium_version_check' AS FindingType, NULL AS Pid, NULL AS Ppid,
       NULL AS ParentName, NULL AS Name, NULL AS CommandLine, NULL AS Exe,
       NULL AS Username, NULL AS CreateTime, Stdout
FROM chromium_version

-- Forensic artifact: enumerate recently executed files in user-writable staging dirs
-- Run on hosts flagged by the process-tree hunt above
SELECT FullPath, Size, Mtime, Ctime,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs=['/tmp/*', '/dev/shm/*', '/var/tmp/*'])
WHERE NOT IsDir
  AND Mtime > now() - 86400 * 7
  AND (Mode =~ 'x' OR FullPath =~ '(?i)\\.(elf|so|sh|py)$')
ORDER BY Mtime DESC

Update Chromium on all Fedora 45 systems to **154.0.8037.57** or later. The following Bash script updates the package, verifies the installed version, and flags any running Chromium processes still using the old binary (running instances keep the vulnerable code mapped until restarted — a frequently missed step):

#!/usr/bin/env bash
# Chromium 154.0.8037.57 patch and verification script - Fedora 45
# Addresses CVE-2026-95274, CVE-2026-95275, CVE-2026-95276, CVE-2026-95277

REQUIRED_VERSION="154.0.8037.57"

echo "[*] Current installed Chromium package:"
rpm -q chromium 2>/dev/null || echo "    chromium not installed"

echo "[*] Updating Chromium via dnf..."
sudo dnf upgrade --refresh -y chromium

echo "[*] Verifying installed version..."
INSTALLED=$(rpm -q --queryformat '%{VERSION}' chromium 2>/dev/null)
echo "    Installed: ${INSTALLED:-none}"

if [[ -z "$INSTALLED" ]]; then
    echo "[!] Chromium package not found. Nothing further to do."
    exit 0
fi

# Compare versions using sort -V
if [[ "$(printf '%s\n%s\n' "$REQUIRED_VERSION" "$INSTALLED" | sort -V | head -n1)" == "$REQUIRED_VERSION" ]]; then
    echo "[+] PASS: Installed version ($INSTALLED) meets or exceeds required ($REQUIRED_VERSION)"
else
    echo "[-] FAIL: Installed version ($INSTALLED) is below required ($REQUIRED_VERSION)"
    exit 1
fi

echo "[*] Checking for Chromium processes still running the OLD binary..."
STALE=$(ps -eo pid,comm,lstart | grep -E 'chrom(e|ium)' | grep -v grep || true)
if [[ -n "$STALE" ]]; then
    echo "[!] WARNING: Chromium processes are running. They must be fully restarted to load the patched binary:"
    echo "$STALE"
    echo "    Action: have users fully exit Chromium (all windows + background), then relaunch."
else
    echo "[+] No running Chromium processes detected."
fi

echo "[*] Confirming no deleted-binary mappings remain (old .so still in memory)..."
sudo lsof +L1 2>/dev/null | grep -iE 'chrom(e|ium)' || echo "[+] No stale deleted-binary mappings."

echo "[*] Done."