CVE-2026-87544: Google Chrome Extensions Authorization Bypass — Triage, Detection, and Remediation Guide

---
title: Chrome Browser Spawning Script or Shell Child Processes
id: 8b7f2c10-9a2f-4f4d-a3f1-c26e87544001
status: experimental
description: Detects chrome.exe launching common script interpreters or shells, a useful post-exploitation signal after renderer or privileged-page abuse. Expect tuning in developer-heavy environments.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87544
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  filter_common_renderer:
    CommandLine|contains:
      - '--type='
      - '--utility-sub-type='
  condition: selection_parent and selection_child and not filter_common_renderer
falsepositives:
  - Enterprise browser extensions or SSO helpers that launch local clients
  - Developer tools, automation frameworks, and user-installed password managers
level: medium
---
title: Suspicious Chrome Extension Command Line or Developer Mode Load
id: 2c9d4a77-51bd-4d90-a6c9-c26e87544002
status: experimental
description: Detects Chrome started with extension loading flags that can indicate unpacked extension abuse, developer-mode misuse, or hands-on post-compromise activity.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87544
  - https://attack.mitre.org/techniques/T1176/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
    CommandLine|contains:
      - '--load-extension='
      - '--disable-extensions-except='
      - '--enable-features=ExtensionsToolbarMenu'
      - '--allowlisted-extension-id='
  filter_policy:
    CommandLine|contains:
      - '--flag-switches-begin'
      - '--flag-switches-end'
  condition: selection and not filter_policy
falsepositives:
  - Legitimate QA, extension development, and Chromium troubleshooting
  - VDI or application-packaging validation
level: low

// Exposure: Chrome builds below 153.0.8010.36 observed in process telemetry
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "chrome.exe"
| extend Version = tostring(split(FileVersion, ".")[0]), Build = tostring(FileVersion)
| summarize Devices = dcount(DeviceId), LastSeen = max(TimeGenerated) by FolderPath, FileVersion, Build
| where Build !startswith "153.0.8010.36"
| order by LastSeen desc;

// Post-exploitation hunt: chrome spawning interpreters or LOLBins outside normal renderer utility switches
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| where ProcessCommandLine !contains "--type=" and ProcessCommandLine !contains "--utility-sub-type="
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256
| order by TimeGenerated desc;

// Extension-control plane: developer-mode or unpacked extension flags
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "chrome.exe"
| where ProcessCommandLine has_any ("--load-extension=", "--disable-extensions-except=", "--allowlisted-extension-id=")
| summarize Devices = dcount(DeviceId), Accounts = dcount(AccountName), LastSeen = max(TimeGenerated) by ProcessCommandLine, DeviceName
| order by LastSeen desc

-- Chrome exposure and suspicious child process triage
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'chrome.exe'
   OR CommandLine =~ '--load-extension=|--disable-extensions-except=|--allowlisted-extension-id='

-- Join parent/child suspicion on Windows endpoints
SELECT c.Pid AS ChildPid, c.Name AS ChildName, c.CommandLine AS ChildCmd,
       p.Pid AS ParentPid, p.Name AS ParentName, p.CommandLine AS ParentCmd,
       c.Username, c.CreateTime
FROM pslist() AS c
JOIN pslist() AS p ON c.Ppid = p.Pid
WHERE p.Name =~ 'chrome.exe'
  AND c.Name =~ 'cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe|regsvr32.exe'
  AND c.CommandLine !~ '--type=|--utility-sub-type='

# Verify installed Chrome versions and flag endpoints below 153.0.8010.36. Run elevated for HKLM coverage.
$minimum = [version]'153.0.8010.36'
$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$installs = Get-ItemProperty $paths -ErrorAction SilentlyContinue |
  Where-Object { $_.DisplayName -match 'Google Chrome' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation, Publisher

if (-not $installs) { Write-Output 'Chrome not found in uninstall registry hives.'; exit 0 }
foreach ($i in $installs) {
  $v = $null
  [void][version]::TryParse(($i.DisplayVersion -as [string]), [ref]$v)
  $status = if ($v -and $v -ge $minimum) { 'OK' } else { 'UPDATE_REQUIRED' }
  [pscustomobject]@{ Name = $i.DisplayName; Version = $i.DisplayVersion; Minimum = $minimum.ToString(); Status = $status; Path = $i.InstallLocation }
}

# Recommended enterprise controls: block unapproved extensions and disable developer mode where not required.
# Validate policy keys after deployment; do not blindly overwrite existing extension allowlists.
$chromePolicy = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
Get-ItemProperty $chromePolicy -ErrorAction SilentlyContinue |
  Select-Object ExtensionInstallBlocklist, ExtensionInstallAllowlist, DeveloperModeAvailability, DefaultExtensionsSetting