CVE-2026-30912: Chrome Beta V8 Type Confusion — Active Exploitation and Patch Guide

---
title: Chrome Browser Spawning System Shell
id: 8f2a4b1c-6e3d-4c9a-9b1d-2e4f5a6c7d8e
status: experimental
description: Detects Google Chrome spawning cmd.exe, powershell.exe, or wscript.exe, which is highly indicative of successful browser exploit activity.
references:
  - https://chromereleases.googleblog.com/2026/05/chrome-beta-for-desktop-update_02063643260.html
author: Security Arsenal
date: 2026/05/02
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - cve.2026.30912
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate developer debugging (rare)
  - Misconfigured browser extensions
level: critical
---
title: Chrome Writing to Suspicious Startup Directories
id: 9a3b5c2d-7f4e-5d0a-0c2e-3f5a6b7c8d9e
status: experimental
description: Detects chrome.exe attempting to drop files in Windows Startup folders, a common persistence mechanism following browser exploitation.
references:
  - Internal Threat Research
author: Security Arsenal
date: 2026/05/02
tags:
  - attack.persistence
  - attack.t1547.001
  - cve.2026.30912
logsource:
  category: file_create
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\'
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
  condition: selection
falsepositives:
  - Low
level: high


**Microsoft Sentinel / Defender KQL**

// Hunt for Chrome spawning unauthorized shells or scripts
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for Chrome processes with unexpected child processes
SELECT Pid AS ChildPid, Name AS ChildName, Exe AS ChildPath, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Cmdline AS ParentCmd
FROM pslist()
LEFT JOIN pslist() AS Parent ON Parent.Pid = ppid
WHERE Parent.Name =~ "chrome.exe"
  AND ChildName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "bash", "sh")


**Remediation Script (PowerShell)**

<#
.SYNOPSIS
   Audit Chrome Version for CVE-2026-30912 Vulnerability.
.DESCRIPTION
   Checks the installed Google Chrome version against the fixed secure version (132.0.6834.20).
#>

$FixedVersion = [version]"132.0.6834.20"
$ChromePaths = @(
    "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

$VulnerableFound = $false

foreach ($Path in $ChromePaths) {
    if (Test-Path $Path) {
        $VersionInfo = (Get-Item $Path).VersionInfo.FileVersion
        $CurrentVersion = [version]$VersionInfo
        
        Write-Host "Found Chrome at: $Path"
        Write-Host "Current Version: $CurrentVersion"

        if ($CurrentVersion -lt $FixedVersion) {
            Write-Host "[ALERT] Vulnerable version detected! (Below $FixedVersion)" -ForegroundColor Red
            $VulnerableFound = $true
        } else {
            Write-Host "[OK] Version is patched." -ForegroundColor Green
        }
    }
}

if ($VulnerableFound) {
    Write-Host "Action Required: Update Google Chrome immediately via Google Update or Enterprise policy."
    exit 1
} else {
    Write-Host "No vulnerable versions found on this endpoint."
    exit 0
}