Microsoft Defender ATP Detecting Chrome Update as Backdoor


Thread author
Staff Member
Malware Hunter
Jul 27, 2015
Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft's top enterprise security solution, is currently having a bad day and labeling yesterday's Google Chrome browser update as a backdoor trojan. The detections, as can be seen in a screenshot above shared with ZDNet by one of our readers, are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google released last night.
The alerts have caused quite a stir in enterprise environments in light of recent multiple software supply chain attacks that have hit companies across the world over the past few months. System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a "false possitive" and not an actual threat.


Level 16
Top Poster
Oct 13, 2019
True, the detection is not entirely wrong.

There no lack of legit Software that behaves like Malware, which Anti-Virus developers are forced to ignore and white-list.
It seems like it thinks one of the .pak archives delivered as part of the update is a PHP malware. This to me feels like it’s probably a poorly written signature matching on random compressed data. I do agree it’s more forgivable if it detected the behavior of Chrome’s background updater as suspicious but there’s no way Chrome contains PHP scripts or viruses in those, right?

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.