CVE-2026-106237: Chrome Site Isolation Bypass via Permissions Info Leak — Patching and Detection Guide

---
title: Chrome Launched with Site Isolation Disabled
id: b3f7a1d2-4c8e-4f5a-9d21-7e6c5b4a3210
status: experimental
description: Detects Chrome launched with command-line flags that weaken or disable site isolation. Attackers or malicious tooling may use these flags to neutralize the very boundary CVE-2026-106237 targets, and their presence in an enterprise fleet is almost never legitimate.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106237
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_flags:
    CommandLine|contains:
      - '--disable-site-isolation-trials'
      - '--disable-features=SitePerProcess'
      - '--disable-web-security'
      - '--site-per-process=false'
  condition: selection_img and selection_flags
falsepositives:
  - Legacy internal web app compatibility testing in controlled dev environments
level: high
---
title: Chrome Renderer Spawning Unexpected Child Process
id: c8e2b4f6-1a3d-4e7b-8c92-5f4d3a2b1098
status: experimental
description: Detects chrome.exe spawning script interpreters or shells. Renderer-level exploitation chains — including those that begin with an info leak primitive such as CVE-2026-106237 — frequently escalate to command execution. Chrome spawning cmd, PowerShell, wscript, or mshta is a high-fidelity anomaly on end-user systems.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106237
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare: enterprise browser extensions invoking local helpers; baselining recommended before enforcement
level: high

// Hunt 1: Endpoints running Chrome builds vulnerable to CVE-2026-106237 (prior to 155.0.8059.39)
DeviceTvmSoftwareInventory
| where SoftwareName has_any ("chrome", "chromium")
| extend ParsedVersion = parse_version(SoftwareVersion)
| where ParsedVersion < parse_version("155.0.8059.39")
| summarize DeviceCount = dcount(DeviceId), Devices = make_set(DeviceName, 20) by SoftwareName, SoftwareVersion
| order by DeviceCount desc
;
// Hunt 2: Chrome spawning child processes consistent with post-exploitation
DeviceProcessEvents
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
;
// Hunt 3: Chrome launched with site isolation disabled via command line
DeviceProcessEvents
| where FileName in~ ("chrome.exe","msedge.exe")
| where ProcessCommandLine has_any ("--disable-site-isolation-trials","--disable-web-security","--disable-features=SitePerProcess")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

-- Hunt for Chrome installs vulnerable to CVE-2026-106237 (< 155.0.8059.39)
SELECT * FROM foreach(
  row={
    SELECT FullPath FROM glob(
      globs=[
        'HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/Google Chrome/DisplayVersion',
        'HKLM/SOFTWARE/WOW6432Node/Microsoft/Windows/CurrentVersion/Uninstall/Google Chrome/DisplayVersion',
        'HKCU/SOFTWARE/Microsoft/Windows/CurrentVersion/Uninstall/Google Chrome/DisplayVersion'
      ], accessor='registry')
  },
  query={
    SELECT FullPath AS VersionKey,
           read_file(filename=FullPath, accessor='registry') AS ChromeVersionRaw
    FROM scope()
  })

# CVE-2026-106237 - Chrome patch verification and enforcement (run as admin / via RMM)
$TargetVersion = [version]'155.0.8059.39'

# Locate installed Chrome version (machine and user scope)
$keys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome'
)
$installed = foreach ($k in $keys) {
  if (Test-Path $k) { (Get-ItemProperty $k).DisplayVersion }
}

if ($installed) {
  $v = [version]($installed | Select-Object -First 1)
  if ($v -lt $TargetVersion) {
    Write-Warning "VULNERABLE: Chrome $v detected (< $TargetVersion). Triggering update..."
    # Chrome auto-update triggers
    & "$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler 2>$null
    & "$env:ProgramFiles\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler 2>$null
  } else {
    Write-Output "COMPLIANT: Chrome $v >= $TargetVersion"
  }
} else {
  Write-Output 'Chrome not found on this host.'
}

# Enforce enterprise update policy so drift cannot recur
$pol = 'HKLM:\SOFTWARE\Policies\Google\Update'
if (-not (Test-Path $pol)) { New-Item -Path $pol -Force | Out-Null }
Set-ItemProperty $pol -Name 'AutoUpdateCheckPeriodMinutes' -Value 360 -Type DWord
Set-ItemProperty $pol -Name 'UpdateDefault' -Value 1 -Type DWord   # 1 = always allow updates
Set-ItemProperty $pol -Name 'Update{8A69D345-D564-463C-AFF1-A69D9E530F96}' -Value 1 -Type DWord
Write-Output 'Chrome auto-update policy enforced.'