Fedora 44 Chromium 151.0.7922.173 Update Patches Use-After-Free and Privilege Escalation Flaws — Patching and Detection Guide

---
title: Chromium Browser Spawning Shell or Script Interpreter on Linux
id: 3f7a9c41-2b6e-4d58-a91c-8e2f5d7b3a10
status: experimental
description: Detects Chromium renderer or browser processes spawning shells or scripting interpreters, a strong indicator of successful browser exploitation or sandbox escape on Linux workstations.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-chromium-2026-7cee1b8755
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.exploitation_for_client_execution
  - attack.t1203
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/chromium'
      - '/chrome'
      - '/chromium-browser'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare developer workflows launching terminals from browser extensions
  - Legitimate xdg-open handlers (typically spawn file managers, not shells)
level: high
---
title: Chromium Writing and Executing Payload from Temporary Directory
id: 8c1d4e72-5a3b-4f69-b82d-1f6a9c4e7d25
status: experimental
description: Detects executables launched from world-writable or user temp/download locations shortly after browser activity, consistent with post-exploitation payload staging following a Chromium compromise.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-chromium-2026-7cee1b8755
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/run/user/'
  filter_user_dirs:
    Image|startswith:
      - '/home/'
    Image|contains:
      - '/.cache/'
      - '/Downloads/'
  condition: selection_path and not filter_user_dirs
falsepositives:
  - Legitimate package builds and installers running from /tmp
  - AppImage and portable tool execution from user directories
level: medium
---
title: Chromium Renderer Crash Loop Indicating Exploitation Attempts
id: 5e2b8f13-7d4a-4c81-b36f-9a1e6d8c2f47
status: experimental
description: Detects repeated Chromium crash dump generation or renderer process crashes, which may indicate repeated exploitation attempts against memory corruption vulnerabilities such as use-after-free.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-chromium-2026-7cee1b8755
  - https://attack.mitre.org/techniques/T1499.004/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/.config/chromium/Crash Reports/'
      - '/.config/chromium/*/Crashpad/'
      - '/var/crash/'
      - '/var/lib/systemd/coredump/'
    TargetFilename|contains: 'chromium'
  condition: selection
falsepositives:
  - Unstable extensions or driver issues causing legitimate repeated crashes
level: low

// Hunt for Chromium spawning suspicious child processes (post-exploitation behavior)
let suspiciousChildren = dynamic(["/bin/bash", "/bin/sh", "/usr/bin/python3", "/usr/bin/perl", "/usr/bin/curl", "/usr/bin/wget", "/usr/bin/base64", "/bin/dash", "/usr/bin/zsh"]);
let browserNames = dynamic(["chromium", "chrome", "chromium-browser"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ (browserNames)
    | where FileName in~ (suspiciousChildren) or ProcessCommandLine has_any ("base64 -d", "/tmp/", "/dev/shm/", "curl ", "wget ")
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, Source=tostring("Defender")),
    (Syslog
    | where Facility == "user" or SyslogMessage has "audit"
    | where SyslogMessage has_any (browserNames)
    | where SyslogMessage has_any (suspiciousChildren)
    | extend SyslogMessage_str = tostring(SyslogMessage)
    | project TimeGenerated, Computer, SyslogMessage_str, Source=tostring("Syslog")),
    (CommonSecurityLog
    | where Message has_any (browserNames) and Message has_any (suspiciousChildren)
    | project TimeGenerated, DeviceName=SourceHostName, Message, Source=tostring("CEF"))
| order by TimeGenerated desc

// Identify outbound browsing from outdated Chromium builds (pre-151.0.7922.173)
CommonSecurityLog
| where RequestClientApplication has "Chrome/"
| extend ChromeVersion = extract(@"Chrome/(\d+\.\d+\.\d+\.\d+)", 1, RequestClientApplication)
| where isnotempty(ChromeVersion)
| extend Major = toint(split(ChromeVersion, ".")[0]), Build = toint(split(ChromeVersion, ".")[2]), Patch = toint(split(ChromeVersion, ".")[3])
| where Major < 151 or (Major == 151 and (Build < 7922 or (Build == 7922 and Patch < 173)))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Requests=count() by SourceHostName, SourceIP, ChromeVersion
| order by LastSeen desc

-- Hunt: Chromium post-exploitation indicators on Linux endpoints
-- Looks for suspicious child processes of Chromium and execution from temp paths

LET browser_procs = SELECT Pid, Name, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)chromium|chrome'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(bash|sh|dash|zsh|python3?|perl|curl|wget|base64)$'
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)chromium|chrome')

LET tmp_exec = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '^/(tmp|var/tmp|dev/shm|run/user)/'

SELECT 'suspicious_child_of_chromium' AS Indicator, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM suspicious_children
UNION ALL
SELECT 'execution_from_temp_path' AS Indicator, Pid, NULL AS Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM tmp_exec

-- Collect recent Chromium crash artifacts for triage
SELECT FullPath, Size, Mtime
FROM glob(globs=[
  '/home/*/.config/chromium/Crash Reports/**/*',
  '/home/*/.config/chromium/*/Crashpad/pending/*',
  '/var/lib/systemd/coredump/*chromium*'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC

#!/usr/bin/env bash
# Fedora 44 Chromium security update enforcement
# Target: chromium >= 151.0.7922.173 (Fedora advisory 2026-7cee1b8755)
set -euo pipefail

REQUIRED_VERSION="151.0.7922.173"

echo "[*] Checking installed Chromium version..."

if ! rpm -q chromium &>/dev/null; then
    echo "[-] Chromium is not installed on this system. No action required."
    exit 0
fi

INSTALLED=$(rpm -q --queryformat '%{VERSION}' chromium)
echo "[*] Installed Chromium version: ${INSTALLED}"

version_ge() {
    # returns 0 if $1 >= $2
    [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

if version_ge "${INSTALLED}" "${REQUIRED_VERSION}"; then
    echo "[+] System is patched (>= ${REQUIRED_VERSION})."
else
    echo "[!] Vulnerable version detected. Updating Chromium..."
    dnf clean expire-cache
    dnf upgrade --refresh -y chromium
    NEW_VERSION=$(rpm -q --queryformat '%{VERSION}' chromium)
    echo "[*] Post-update version: ${NEW_VERSION}"
    if version_ge "${NEW_VERSION}" "${REQUIRED_VERSION}"; then
        echo "[+] Update successful. Chromium ${NEW_VERSION} installed."
        # Warn about running browser instances still holding the old build in memory
        if pgrep -x chromium &>/dev/null || pgrep -f chromium-browser &>/dev/null; then
            echo "[!] WARNING: Chromium processes are still running with the OLD build in memory."
            echo "[!] Notify users to fully close and restart the browser before resuming work."
        fi
    else
        echo "[X] ERROR: Update failed or package not yet in your mirror. Retry later or check mirror sync."
        exit 1
    fi
fi

echo "[*] Verification: chromium --version => $(chromium-browser --version 2>/dev/null || echo 'n/a')"