topic Re: Amp Chrome Exploit Prevention alerts in Endpoint Security

Amp Chrome Exploit Prevention alerts

jbates5873 — Fri, 28 Jul 2023 01:16:00 GMT

Hi @cisco team,

raising this here to make you aware of a HEAP of chrome exploit prevention alerts we are getting across all of our customers.

This is almost identical to the May edition of this happening.

https://community.cisco.com/t5/endpoint-security/chrome-exe-exploit-prevention-events/td-p/4829289/page/2

Just raising awareness and to see if anyone else is getting this again?

EDIT: All of them are running this Chrome.

Re: Amp Chrome Exploit Prevention alerts

LudoD — Fri, 04 Aug 2023 07:49:19 GMT

We are still receiving alerts for Chrome exploit prevention (when playing video on auvio.rtbf.be)

Re: Amp Chrome Exploit Prevention alerts

Josh M — Thu, 10 Aug 2023 13:28:01 GMT

My large-ish org is still receiving a heap of these too, about 900~ in the past 30 days. All affected endpoints are running Chrome 115.0.5790.171 and connector version 8.1.5.21322. I opened a TAC case about 2 months ago and was informed that simply updating Chrome to version 115 would resolve the issue- but nothing has changed whatsoever.

I'd rather not turn off the Exploit Prevention engine if I can help it, but I'd also not have my inbox filled with false positives.

Re: Amp Chrome Exploit Prevention alerts

Ken Stieers — Thu, 10 Aug 2023 14:04:04 GMT

It's fixed in 8.1.7.21512.

Re: Amp Chrome Exploit Prevention alerts

Josh M — Wed, 16 Aug 2023 18:55:30 GMT

Just following up to state that I've deployed v8.1.7.21512 to a number of our workstations and have seen a solid impact on the number of chrome.exe false positives received.