CVE-2026-19137 & CVE-2026-19149: Critical Chrome Use-After-Free Flaws (v151.0.7922.108) — Detection and Remediation Guide

---
title: Chrome Renderer Crash Loop Indicative of Exploitation Attempt
id: 6c1a2b94-3e78-4f2a-9d51-8b7e6c5a1234
status: experimental
description: Detects repeated chrome.exe renderer or GPU process crashes within a short window, a pattern consistent with use-after-free exploitation attempts against WebGL (CVE-2026-19137) where heap grooming frequently requires multiple attempts before success.
references:
  - https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection_crash_handler:
    Image|endswith:
      - '\chrome_crashpad.exe'
      - '\chrome_crashpad_handler.exe'
    CommandLine|contains:
      - '--no-rate-limit'
      - '--attachment'
  condition: selection_crash_handler
falsepositives:
  - Legitimate browser instability on misbehaving sites or driver issues
level: medium
---
title: Chrome Browser Process Spawning Suspicious Child Processes
id: 9f3d7c21-5a48-4e91-b6d2-2c8f1a4e5678
status: experimental
description: Detects chrome.exe spawning script interpreters, command shells, or system utilities. Legitimate Chrome usage rarely spawns such children; this behavior is characteristic of post-renderer-compromise payloads following successful exploitation of renderer bugs such as CVE-2026-19137.
references:
  - https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
  - https://attack.mitre.org/techniques/T1189/
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1189
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions or enterprise SSO helpers spawning system tools (rare; tune per environment)
level: high
---
title: Unpatched Chrome Version Execution Below 151.0.7922.108
id: 2b8e4f63-7d19-4a35-c8e4-5d9a3b7c9012
status: experimental
description: Detects launch of chrome.exe from a user profile path where the binary version directory indicates a build older than 151.0.7922.108. Complements file-version inventory checks by catching execution of stale Chrome installs, portable copies, and per-user installs that evade managed patching.
references:
  - https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
author: Security Arsenal
date: 2026/08/12
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\AppData\Local\Google\Chrome\'
      - '\Chrome SxS\'
  filter_current:
    Image|contains:
      - '\151.0.7922.108\'
      - '\151.0.7922.109\'
  condition: selection and not filter_current
falsepositives:
  - Canary or enterprise-pinned builds managed under separate policy; verify version via file metadata rather than path alone where possible
level: medium

// Hunt 1: Inventory Chrome file versions across the fleet — flag anything below 151.0.7922.108
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "chrome.exe"
| extend Version = tostring(split(FolderPath, "\\")[array_length(split(FolderPath, "\\")) - 2])
| where Version startswith "1" and Version !startswith "151.0.7922.108" and Version !startswith "151.0.7922.109"
| summarize LastSeen = max(TimeGenerated), Version = any(Version) by DeviceName, FolderPath
| sort by DeviceName asc
;
// Hunt 2: Chrome spawning script interpreters or LOLBins — post-renderer-compromise behavior
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| sort by TimeGenerated desc
;
// Hunt 3: Renderer/GPU crash loop correlation — repeated chrome crashpad activity per device
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has "chrome_crashpad"
| summarize CrashEvents = count(), DistinctTimes = makeset(TimeGenerated, 20) by DeviceName, bin(TimeGenerated, 1h)
| where CrashEvents >= 5
| sort by CrashEvents desc

-- Enumerate Chrome binary version and flag suspicious children of chrome.exe
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime,
       version(string=Exe) AS ExeVersion
FROM pslist()
WHERE Name =~ '(?i)chrome'
UNION
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime,
       NULL AS ExeVersion
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|wmic)'
  AND get(pid=Pid).Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)chrome')

-- Enumerate all Chrome installation version folders to identify unpatched builds
SELECT FullPath, Mtime,
       basename(path=FullPath) AS VersionDir
FROM glob(globs=['C:/Program Files/Google/Chrome/Application/*/chrome.exe',
                 'C:/Program Files (x86)/Google/Chrome/Application/*/chrome.exe',
                 'C:/Users/*/AppData/Local/Google/Chrome/Application/*/chrome.exe'])
WHERE VersionDir !~ '151\\.0\\.7922\\.10[89]'

# Chrome CVE-2026-19137 / CVE-2026-19149 compliance audit and remediation
# Fixed versions: 151.0.7922.108 (Win/Linux) / 151.0.7922.109 (Mac)
$FixedVersion = [version]"151.0.7922.108"
$chromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
$nonCompliant = $false
foreach ($path in $chromePaths) {
    if (Test-Path $path) {
        $installed = [version](Get-Item $path).VersionInfo.ProductVersion
        if ($installed -lt $FixedVersion) {
            Write-Warning "NON-COMPLIANT: $path is version $installed (requires >= $FixedVersion)"
            $nonCompliant = $true
        } else {
            Write-Host "OK: $path is version $installed"
        }
    }
}
if ($nonCompliant) {
    # Trigger Chrome Enterprise silent update via winget, or download the MSI from:
    # https://chromeenterprise.google/browser/download/
    Write-Host "Triggering update via winget..."
    winget upgrade --id Google.Chrome --silent --accept-package-agreements --accept-source-agreements
    # Force-close running Chrome to allow the updater to complete (users will need to relaunch)
    Get-Process chrome -ErrorAction SilentlyContinue | Stop-Process -Force
    exit 1  # Signal management platform that remediation was required
} else {
    exit 0
}

#!/bin/bash
# Audit and patch Chrome on Debian/Ubuntu and RHEL/Fedora systems
FIXED="151.0.7922.108"
CURRENT=$(google-chrome --version 2>/dev/null | awk '{print $3}')
if [ -z "$CURRENT" ]; then echo "Chrome not installed"; exit 0; fi
if [ "$(printf '%s\n' "$FIXED" "$CURRENT" | sort -V | head -n1)" != "$FIXED" ]; then
  echo "NON-COMPLIANT: $CURRENT < $FIXED — updating"
  if command -v apt-get >/dev/null; then
    apt-get update && apt-get install --only-upgrade -y google-chrome-stable
  elif command -v dnf >/dev/null; then
    dnf upgrade -y google-chrome-stable
  elif command -v yum >/dev/null; then
    yum update -y google-chrome-stable
  fi
  echo "Post-update version: $(google-chrome --version)"
else
  echo "OK: Chrome $CURRENT meets $FIXED"
fi