Full-chain renderer-to-host code execution via V8, WebP and Crashpad bugs, fixed in 152.0.7977.82 (Google Chrome)
A detailed technical write-up of the chain is now public, which lowers the bar for others to rebuild it, and Chrome's background update does not protect a machine until the browser is relaunched — many enterprise endpoints are still running the vulnerable build.
Researchers at Xbow chained three Chrome zero-days — a V8 Maglev deoptimization bug giving read/write in the pointer-compression cage, an animated-WebP decoder flaw that escapes the V8 sandbox by abusing a property Blink wrongly trusted, and an overflow in the Crashpad crash handler — into an exploit that runs code on the Windows host from a web page, with no credentials or plugin required. Google has fixed all three and paid its top $250,000 full-chain bounty. The Register's report names no CVE identifiers and reports no exploitation in use; the fix only takes effect after Chrome is relaunched.
Affected: Chrome releases before 152.0.7977.82; the report does not state the earliest affected version. The final Crashpad stage targets Windows; the V8 and WebP stages are not described as platform-specific.
How to Test
Open chrome://version (or chrome://settings/help) and confirm the build is 152.0.7977.82 or later; a pending update shown in the menu means the running process is still the old version. For fleets, query installed Chrome versions via Chrome Browser Cloud Management, your MDM or endpoint inventory. The report gives no indicators of compromise; unexplained Crashpad handler crashes or renderer crashes on WebP-heavy pages would warrant a look but are not stated as indicators.
How to Patch
Push Chrome 152.0.7977.82 or later and force a relaunch (e.g., set RelaunchNotification=Required with a short RelaunchNotificationPeriod); pin a minimum version with Chrome enterprise policy and verify via inventory. Where Chromium-based browsers (Edge, Brave, etc.) are in use, confirm they have picked up the corresponding V8/WebP/Crashpad fixes — the report does not address them.