Posted on

Google Chrome CVE-2026-85046 – Active Zero-Day Exploitation

Threat Overview

Google published Chrome Stable 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux on September 3, 2026. The update fixes CVE-2026-85046, a high-severity type confusion vulnerability in V8. Google explicitly states that an exploit for CVE-2026-85046 exists in the wild. Google has restricted bug details while deployment of the fix is still underway, so no reliable public exploit path, payload, or IOC set should be assumed.

References

Impacted Systems

  • Vendor/product: Google Chrome Desktop.
  • Component: V8 JavaScript engine.
  • Vulnerability: CVE-2026-85046, type confusion.
  • Fixed stable builds: 152.0.7977.82/.83 for Windows and macOS; 152.0.7977.82 for Linux.
  • Platform: Windows, macOS, Linux.
  • Exposure condition: user browsing attacker-controlled or compromised web content capable of exercising the vulnerable V8 behavior.
  • Exploitation status: Google confirms an exploit exists in the wild.

Why this matters

Chrome is ubiquitous across enterprise endpoints and exploitation of a V8 memory-safety issue can provide initial access through normal browsing activity.

Exploitation Status

Confirmed by Google. Public exploit details remain restricted.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for suspicious Chrome child processes, executable/script creation, download-to-execution behavior, new outbound destinations, DLL loading from user-writable paths, and SecurityEvent fallbacks.

Required logs

Required logs vary by hunt and are identified by the Sentinel tables referenced in each query below.

Hunt 1 – First-Pass: Chrome Spawning Suspicious Child Processes

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 2 – Executable or Script Files Written by Chrome

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".js" or FileName endswith ".vbs"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 3 – Chrome Downloads Followed by Execution

let Downloads = DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where ActionType == "FileCreated"
| project DeviceId, DownloadTime=TimeGenerated, FileName, FolderPath, SHA256;
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| join kind=inner Downloads on DeviceId, FileName
| where TimeGenerated between (DownloadTime .. DownloadTime + 15m)
| project DownloadTime, TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256
| sort by DownloadTime asc

Hunt 4 – New Public Destinations From Chrome

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName =~ "chrome.exe"
| where RemoteIPType == "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated desc

Hunt 5 – Chrome Followed by Scripting or LOLBin Activity

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine,20) by DeviceName, AccountName, FileName
| sort by LastSeen desc

Hunt 6 – Chrome-Related DLL Loads From User-Writable Paths

DeviceImageLoadEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FolderPath has_any ("\Users\","\AppData\","\Temp\","\Downloads\")
| where FileName endswith ".dll"
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 7 – SecurityEvent Fallback for Chrome-to-Shell Execution

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName endswith @"\chrome.exe"
| where NewProcessName has_any ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine
| sort by TimeGenerated asc

Detection Notes

  • Highest signal is Chrome spawning shells, script engines, or LOLBins.
  • Google has not published exploit-specific IOCs, so these hunts are intentionally behavioral.
  • Browser downloads and child processes can be legitimate; user and file reputation context matter.
  • DeviceImageLoadEvents may not be available in every Defender deployment.
  • Missing endpoint telemetry substantially reduces visibility.

Leave a comment