Full Report
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Analysis Summary
# Morning News Roll-up 09/02/2026
## Overview
Today's report highlights critical vulnerabilities in Google Chrome that facilitate arbitrary code execution, alongside ongoing phishing campaigns utilizing Remote Monitoring and Management (RMM) tools and malicious S3 buckets targeting State, Local, Tribal, and Territorial (SLTT) government entities.
## Top Stories
### Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
- Summary: Google has released updates to address numerous vulnerabilities in Chrome, the most severe of which allow for arbitrary code execution (ACE). These flaws include Use-After-Free (UAF) conditions in Shared Tab Groups, WebGL, and WebRTC, as well as buffer overflows and authorization bypasses. If exploited, an attacker could gain full control of a system depending on the user's privilege level.
- Source: hxxps://chromereleases[.]googleblog[.]com/2026/09/stable-channel-update-for-desktop[.]html
### Dual-RMM Phishing and PowerShell RAT Campaign Hits SLTTs
- Summary: A sophisticated phishing campaign is currently targeting SLTT government organizations. The attackers are utilizing dual Remote Monitoring and Management (RMM) tools to maintain persistence and deploying a PowerShell-based Remote Access Trojan (RAT) to exfiltrate data and conduct further post-exploitation activities.
- Source: hxxps://www[.]cisecurity[.]org/insights/blog/dual-rmm-phishing-powershell-rat-campaign-hits-sltts
### SLTT Traffic Directing to S3 Buckets Hosting KrustyLoader
- Summary: Security researchers have identified a campaign where traffic from SLTT entities is being redirected to malicious Amazon S3 buckets. These buckets are used to host and deliver KrustyLoader, a specialized malware loader designed to facilitate the deployment of additional malicious payloads on compromised systems.
- Source: hxxps://www[.]cisecurity[.]org/insights/blog/sltt-traffic-directing-s3-buckets-hosting-krustyloader
---
# Main Topic
Multiple vulnerabilities in Google Chrome (MS-ISAC Advisory 2026-085) that allow for Arbitrary Code Execution (ACE) via drive-by compromises.
## Key Points
- The most severe vulnerabilities allow attackers to execute arbitrary code within the context of the logged-on user.
- Impact is highly dependent on user privileges; administrative users pose the greatest risk, as attackers could install programs, modify data, or create new accounts.
- The vulnerabilities cover a wide range of components including V8, WebGL, GPU, WebRTC, and the Chrome FileSystem.
- While severe, there are currently no reports of these specific vulnerabilities being exploited in the wild.
## Threat Actors
- **Attribution:** Not currently attributed to a specific named threat group.
- **Motivations:** Likely include data theft, unauthorized access, and system disruption, typical of actors utilizing drive-by compromise tactics.
## TTPs
- **Initial Access:** Drive-By Compromise ([T1189](https://attack.mitre.org/techniques/T1189/)).
- **Execution Methods:**
- Use-After-Free (UAF) in various components (WebGL, WebRTC, Shared Tab Groups).
- Buffer overflows in GPU processes.
- Improper input validation in Omnibox and DataTransfer.
- Incorrect authorization and privilege management in FileSystem and Downloads.
## Affected Systems
- Google Chrome prior to 152.0.7977.75/.76 for Windows and Mac.
- Google Chrome prior to 152.0.7977.75 for Linux.
## Mitigations
- **Immediate Patching:** Apply Google’s updates (v152.0.7977.75/.76) immediately after testing.
- **Vulnerability Management:** Establish automated application patch management (Safeguard 7.4) and a formal remediation process (Safeguard 7.1).
- **Least Privilege:** Implement the Principle of Least Privilege ([M1026](https://attack.mitre.org/mitigations/M1026/)) to ensure users operate without administrative rights, limiting the blast radius of a successful exploit.
- **Browser Security:** Ensure only fully supported and updated browsers are permitted within the enterprise (Safeguard 9.1).
## Conclusion
These vulnerabilities represent a medium risk to government and business entities due to the widespread use of Google Chrome. While no active exploitation is reported, the potential for ACE necessitates immediate patching. Organizations should prioritize moving users away from administrative accounts to mitigate the impact of browser-based drive-by attacks.