Securing Chrome Agentic Capabilities: Detection and Mitigation of Indirect Prompt Injection

---
title: Chrome Agentic AI Network Activity Detection
id: 8a4c2d10-9b3e-4f1d-8c7a-1e2f3a4b5c6d
status: experimental
description: Detects Chrome browser processes establishing connections to known Google Generative AI endpoints utilized by agentic capabilities.
references:
  - https://security.googleblog.com/2025/12/architecting-security-for-agentic.html
author: Security Arsenal
date: 2025/12/01
tags:
  - attack.initial_access
  - attack.t1190
  - browser-security
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
    Initiated: 'true'
    DestinationHostname|contains:
      - 'generativelanguage.googleapis.com'
      - 'chrome-agentic.googleapis.com'
  condition: selection
falsepositives:
  - Legitimate use of Gemini Nano or other integrated AI features by authorized users.
level: informational
---
title: Potential Indirect Prompt Injection - High Volume Request Pattern
id: 1b5d3e21-0c4f-5a2e-9d8b-2f3a4b5c6d7e
status: experimental
description: Detects potential automated agent behavior by identifying Chrome instances making rapid successive requests to multiple distinct domains, typical of an agent following links and executing actions.
references:
  - https://attack.mitre.org/techniques/T1059/ 
author: Security Arsenal
date: 2025/12/01
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
  timeframe: 30s
  condition: selection | count() > 50
falsepositives:
  - Heavy browsing by power users, link aggregators, or legitimate crawlers.
level: medium

// Hunt for Chrome processes connecting to Google Agentic/AI endpoints
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "chrome.exe"
| where RemoteUrl has "generativelanguage.googleapis.com" 
   or RemoteUrl has "googleapis.com" 
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort, LocalIP
| order by Timestamp desc

// Correlate high-frequency browsing patterns indicative of agent activity
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "chrome.exe"
| summarize RequestCount = count(), UniqueDomains = dcount(RemoteUrl) by DeviceName, bin(Timestamp, 1m)
| where RequestCount > 30 and UniqueDomains > 10
| project Timestamp, DeviceName, RequestCount, UniqueDomains
| order by RequestCount desc

-- Hunt for Chrome processes and check for connections to AI endpoints
SELECT * FROM chain(
  {
    SELECT Pid, Name, Exe, Username
    FROM pslist()
    WHERE Name =~ 'chrome.exe'
  },
  {
    SELECT Pid, RemoteAddr, State, Family
    FROM netstat(pid=Pid)
    WHERE RemoteAddr =~ 'googleapis.com' 
       OR RemoteAddr =~ 'googleusercontent.com'
  }
)

<#
.SYNOPSIS
   Chrome Agentic Feature Audit and Remediation Script
.DESCRIPTION
   Checks Chrome version against the "Safe Browsing" update for Agentic features and provides Group Policy recommendations.
#>

Write-Host "[+] Auditing Chrome for Agentic Security Hardening..." -ForegroundColor Cyan

# 1. Check Chrome Version (Placeholder for latest secure version)
$chromePath = "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe"
$chromePathx86 = "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"

if (Test-Path $chromePath) { $version = (Get-Item $chromePath).VersionInfo.FileVersion }
elseif (Test-Path $chromePathx86) { $version = (Get-Item $chromePathx86).VersionInfo.FileVersion }
else { Write-Host "[-] Chrome not found." -ForegroundColor Red; exit }

Write-Host "[INFO] Current Chrome Version: $version" -ForegroundColor Yellow

# 2. Check Registry for AI Feature Flags (Enterprise Policy)
$regPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if (Test-Path $regPath) {
    $policy = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
    if ($policy."BuiltinAiFeatureEnabled" -eq 0) {
        Write-Host "[+] AI Features are DISABLED via Policy." -ForegroundColor Green
    } else {
        Write-Host "[!] AI Features are ENABLED. Review policy if Agentic usage is restricted." -ForegroundColor Orange
    }
} else {
    Write-Host "[!] No Google Chrome Policy found. AI features likely controlled by user settings." -ForegroundColor Orange
}

Write-Host "[+] Recommendation: Enforce Chrome version >= 130.0.6723.91 (Theoretical secure baseline for Agentic mitigations)." -ForegroundColor Cyan
Write-Host "[+] Recommendation: Review 'BuiltinAiFeatureEnabled' and 'BuiltinAiHmacKeyEnabled' policies." -ForegroundColor Cyan