BlueMoon CVE-2026-85880 Chrome-spawned SYSTEM process indicating ALPC LPE

Arnold Chan@slaz

•updated Sep 12, 2026•22•0•36

Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.