SecBoard
Zurück zur CVE-Übersicht

CVE-2026-93375

HIGH(8.1)

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 8.1 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.1

Technische Schwere

Beschreibung

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 153.0.8010.52

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "chrome.exe"
| where ProcessCommandLine contains "--enable-tracing" or ProcessCommandLine contains "--trace-startup"
| where InitiatingProcessFileName != "chrome.exe" // Look for unexpected initiators
| where ProcessCommandLine contains "--no-sandbox" or ProcessCommandLine contains "--disable-gpu-sandbox" // Indicators of sandbox escape attempts
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 | Image="*\\chrome.exe" | CommandLine IN ("*--enable-tracing*", "*--trace-startup*") | NOT ParentImage="*\\chrome.exe" | CommandLine IN ("*--no-sandbox*", "*--disable-gpu-sandbox*") | table _time, Host, ParentCommandLine, CommandLine, Image, Hashes

Sigma

title: Chrome Tracing Sandbox Escape Attempt
status: experimental
description: Detects attempts to exploit CVE-2026-93375 by monitoring Chrome processes using tracing flags and attempting to escape the sandbox.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\chrome.exe'
    CommandLine|contains:
      - '--enable-tracing'
      - '--trace-startup'
  filter_parent_chrome:
    ParentImage|endswith: '\\chrome.exe'
  selection_sandbox_escape:
    CommandLine|contains:
      - '--no-sandbox'
      - '--disable-gpu-sandbox'
  condition: selection and not filter_parent_chrome and selection_sandbox_escape
fields:
  - Image
  - CommandLine
  - ParentImage
level: high

Elastic ES|QL

from process where process.executable.name : "chrome.exe" and (process.args : "--enable-tracing" or process.args : "--trace-startup") and not process.parent.executable.name : "chrome.exe" and (process.args : "--no-sandbox" or process.args : "--disable-gpu-sandbox")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Referenzen