Chrome Evasion Flags (FlutterShell)

Tim Peck@timpeck

•updated Jun 2, 2026•5•0•31

Detects the execution of Google Chrome with specific command-line flags (--hide-crash-restore-bubble and --disable-session-crashed-bubble) that are often used by malware like FlutterShell to suppress crash recovery prompts and potentially evade detection or user interaction. This behavior can indicate an attempt to hide malicious activity or maintain persistence without alerting the user to abnormal browser states.