♫Why♥Not♪ (@Python_s_) on X

What it is

A third-party alert (dated October 13, 2026) relaying XBOW's disclosure of a Chrome for Windows exploit chain. The chain runs V8 Maglev memory corruption (CVE-2026-85045), then Animated WebP decoder memory corruption (Chromium issue 548509153), then a Crashpad sandbox escape (CVE-2026-78952). The alert's source is the XBOW write-up plus a Google stable-channel release post from September 2026. This post is a relay, not the primary research.

Preconditions / Affected

• Chrome for Windows builds that lack the August–September 2026 security fixes. The alert gives no specific version number, so check against Google's September 2026 stable release notes rather than this post.
• Exposure is just loading a crafted page, with no click or download.

What to do

• Update Chrome to the latest stable release and restart the browser. The fix only applies after the restart.
• Verify Chrome versions across managed endpoints.
• For retrospective triage, look for:
• abnormal Chrome or Crashpad crashes
• unexpected child processes
• suspicious execution following webpage visits

Caveats

• No campaign-specific IOCs are published, so detection rests on behavioral signals, not signatures.
• No malicious in-the-wild exploitation of this chain is confirmed. Its status is a laboratory full-chain exploit that Google reproduced.
• The alert's "high confidence" rating rests on first-party research and Google advisories, but the alert itself is a secondary summary. Confirm fixed-version details at the linked XBOW and Google sources.