Chrome RCE-to-Windows LPE exploit chain dropping chrome_cleanup.exe

Ankit Mehta@Secvyn

•updated Sep 22, 2026•2•0•3

Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.