CVE-2025-14174 Splunk · SPL

Detect CVE-2025-14174: Google Chromium Out of Bounds Memory Access Exploitation in Splunk

Detects exploitation of CVE-2025-14174, an out-of-bounds memory access vulnerability in Google Chromium. This vulnerability is actively exploited in the wild (CISA KEV) and can allow attackers to execute arbitrary code or escape the browser sandbox via a crafted web page. Detection focuses on abnormal Chromium process behavior including child process spawning, memory anomalies, and post-exploitation indicators.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

SPL Detection Query

Splunk (SPL)
spl 
index=endpoint sourcetype=crowdstrike:events:sensor OR sourcetype=sysmon
(process_name="chrome.exe" OR process_name="msedge.exe" OR process_name="brave.exe" OR process_name="chromium.exe")
| eval is_suspicious_child=if(match(child_process_name, "(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)"), 1, 0)
| where is_suspicious_child=1
| eval encoded_cmd=if(match(child_process_cmdline, "(?i)(-enc|-EncodedCommand|IEX|Invoke-Expression)"), 1, 0)
| eval risk_score=case(
    encoded_cmd=1, 90,
    match(child_process_name, "(?i)powershell\.exe"), 75,
    match(child_process_name, "(?i)cmd\.exe"), 65,
    true(), 50
  )
| where risk_score >= 50
| stats count as spawn_count, values(child_process_name) as child_procs, values(child_process_cmdline) as cmdlines, max(risk_score) as max_risk by host, user, process_name, process_id, _time
| where spawn_count >= 1
| sort - max_risk
| table _time, host, user, process_name, child_procs, cmdlines, spawn_count, max_risk
critical severity medium confidence

Detects Chromium browser processes spawning suspicious child processes indicative of CVE-2025-14174 exploitation. Aggregates spawn events and scores by command-line indicators of post-exploitation activity.

Data Sources

CrowdStrike FalconSysmonWindows Event Logs

Required Sourcetypes

crowdstrike:events:sensorsysmonWinEventLog:Security

False Positives & Tuning

  • Automated browser testing frameworks spawning native processes
  • Browser-integrated developer tools invoking build scripts
  • Enterprise software with legitimate browser-to-native-app integration
  • Chrome Native Messaging hosts for password managers or security tools

Other platforms for CVE-2025-14174

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Chromium Renderer Spawning CMD Shell (Simulated)

    Expected signal: Process creation event showing chrome.exe as parent of cmd.exe; file write event to C:\Temp\chromium_oob_test.txt

  2. Test 2Chrome Spawning PowerShell with Encoded Command

    Expected signal: Process creation event with chrome.exe parent, powershell.exe child with -EncodedCommand argument visible in command line

  3. Test 3Linux Chromium Spawning Shell Process

    Expected signal: Process creation audit log (auditd or Sysdig) showing chromium-browser as parent of bash process; file write to /tmp/

  4. Test 4Browser Process Network Connection to C2 Port (Simulated)

    Expected signal: Network connection event from chrome.exe to 127.0.0.1:4444; correlated with child process spawn event

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the Chrome/Chromium version on the affected host and confirm whether it predates the December 2025 security patch. Check via registry (HKLM\Software\Google\Chrome\BLBeacon\version) or by querying installed software inventory.
  2. Review the parent-child process tree for the flagged Chromium process. Determine whether a renderer or GPU process (not the main browser process) spawned the child — renderer spawns are a stronger indicator of sandbox escape.
  3. Examine the command-line arguments of the spawned child process for encoded payloads, download cradles (e.g., IEX, DownloadString, curl/wget to external IPs), or persistence commands.
  4. Check browser history and DNS logs for the URL visited immediately before the suspicious process spawn to identify the initial delivery vector (phishing, malvertising, watering hole).

Containment

  1. Isolate the affected endpoint from the network immediately if post-exploitation activity (C2 beacon, lateral movement) is confirmed. Use EDR network isolation to preserve forensic state while preventing spread.
  2. Force-terminate the Chromium process tree and any spawned child processes. Push an emergency browser policy via Group Policy or Intune to block Chrome launch on the host until the patch is applied.
  3. Revoke active user sessions and reset credentials for the affected user account, particularly if the spawned process accessed credential stores (DPAPI, browser saved passwords, Windows Credential Manager).

Evidence Collection

  1. Capture a full memory dump of the Chromium renderer process (and GPU process if applicable) before terminating. Use tools such as ProcDump or WinPmem to preserve heap state for OOB analysis.
  2. Collect browser crash reports and minidumps from %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\ — these may contain stack traces pointing to the exploited code path.
  3. Export Windows Event Logs (System, Security, Application), Sysmon logs, and EDR telemetry covering the 30 minutes before and after the first suspicious process spawn event.

Escalation Criteria

  • !Escalate immediately to Incident Response if the spawned child process established an outbound connection to an external IP, downloaded a secondary payload, or modified startup/persistence locations (Run keys, scheduled tasks, services).
  • !Escalate if the affected user has privileged access (domain admin, service account, developer with code-signing rights) due to elevated risk of credential theft and lateral movement.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Chromium crash reports and minidumps at %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\
  • >Windows Event ID 4688 (process creation) logs showing Chromium as parent of suspicious child processes
  • >Prefetch files (C:\Windows\Prefetch\) for any executables spawned by the browser within the exploitation window
  • >Network connection records (NetFlow, firewall logs) for outbound connections from chrome.exe or its child processes
  • >Browser history and visited URLs from %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite) to identify delivery site

Tuning Guidance

Reduce false positives by building an allowlist of known-good Chromium child processes specific to your environment (e.g., native messaging hosts for 1Password, LastPass, corporate SSO agents). Scope the detection to renderer process PIDs rather than the main browser PID where telemetry allows. Increase confidence by correlating process spawn events with concurrent outbound network connections or file write events in user-writable paths. Consider suppressing alerts from hosts running headless Chrome in CI/CD pipelines by tagging those assets in your CMDB and filtering by asset group.

Hunting Queries

Broad threat hunt for any non-standard processes spawned by Chromium over the past 30 days. Useful for identifying slow/low exploitation attempts or compromised hosts that were not caught by real-time detection.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where InitiatingProcessParentFileName !in~ ("explorer.exe", "chrome.exe", "update_notifier.exe", "GoogleUpdate.exe")
| summarize ChildProcesses=make_set(FileName), CommandLines=make_set(ProcessCommandLine), Count=count() by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where array_length(ChildProcesses) > 0
| order by Count desc
Hunting — SPL
spl 
index=endpoint sourcetype=sysmon EventCode=1
| where ParentImage like "%chrome.exe%" OR ParentImage like "%msedge.exe%"
| where NOT (Image like "%chrome.exe%" OR Image like "%GoogleCrashHandler%" OR Image like "%nacl64.exe%")
| stats count by host, ParentImage, Image, CommandLine
| sort - count

Atomic Red Team Tests

Test 1 Chromium Renderer Spawning CMD Shell (Simulated)
windows

Simulates the post-exploitation behavior of CVE-2025-14174 by launching Chrome and using a debug flag to spawn a cmd.exe child process, mimicking sandbox escape telemetry without actual exploitation.

Command

powershell 
Start-Process 'C:\Program Files\Google\Chrome\Application\chrome.exe' -ArgumentList '--no-sandbox', '--disable-gpu', '--renderer-cmd-prefix="cmd.exe /c whoami > C:\Temp\chromium_oob_test.txt"' -Wait

Cleanup

powershell 
Remove-Item C:\Temp\chromium_oob_test.txt -ErrorAction SilentlyContinue; Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue

Expected Telemetry

Process creation event showing chrome.exe as parent of cmd.exe; file write event to C:\Temp\chromium_oob_test.txt

Expected Detection

Alert should fire on the KQL and SPL queries detecting Chromium spawning cmd.exe

Test 2 Chrome Spawning PowerShell with Encoded Command
windows

Simulates an attacker using a Chromium exploitation foothold to run an encoded PowerShell command, representing a common post-exploitation pattern seen after browser memory corruption exploits.

Command

powershell 
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Write-Output "CVE-2025-14174 test execution"')); Start-Process 'C:\Program Files\Google\Chrome\Application\chrome.exe' -ArgumentList '--no-sandbox', "--renderer-cmd-prefix=powershell.exe -EncodedCommand $encoded"

Cleanup

powershell 
Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue; Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

Expected Telemetry

Process creation event with chrome.exe parent, powershell.exe child with -EncodedCommand argument visible in command line

Expected Detection

Should trigger high-risk score (90) in KQL and SPL detection rules due to encoded PowerShell from browser parent

Test 3 Linux Chromium Spawning Shell Process
linux

On Linux, simulates exploitation telemetry by launching Chromium with the --no-sandbox flag and a renderer prefix that spawns a shell command, generating process ancestry logs consistent with browser sandbox escape.

Command

bash 
chromium-browser --no-sandbox --renderer-cmd-prefix='bash -c "id > /tmp/chromium_oob_test.txt"' about:blank &

Cleanup

bash 
rm -f /tmp/chromium_oob_test.txt; pkill -f chromium-browser

Expected Telemetry

Process creation audit log (auditd or Sysdig) showing chromium-browser as parent of bash process; file write to /tmp/

Expected Detection

Linux-specific hunting queries should surface the bash child of chromium-browser

Test 4 Browser Process Network Connection to C2 Port (Simulated)
windows

Simulates post-exploitation C2 callback by having the Chrome process connect to a local listener on a port commonly used in exploitation frameworks (4444), generating the network telemetry that the detection correlation queries target.

Command

powershell 
Start-Job { Start-Process 'ncat' -ArgumentList '-lvp 4444' }; Start-Sleep 2; Start-Process 'C:\Program Files\Google\Chrome\Application\chrome.exe' -ArgumentList '--no-sandbox', '--utility-cmd-prefix="powershell.exe -Command New-Object System.Net.Sockets.TcpClient(\"127.0.0.1\", 4444)"'

Cleanup

powershell 
Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue; Stop-Job -Name * -ErrorAction SilentlyContinue; Stop-Process -Name ncat -Force -ErrorAction SilentlyContinue

Expected Telemetry

Network connection event from chrome.exe to 127.0.0.1:4444; correlated with child process spawn event

Expected Detection

KQL correlation query joining DeviceProcessEvents and DeviceNetworkEvents should fire with high risk score

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1203Exploitation for Client ExecutionT1059Command and Scripting InterpreterT1055Process Injection

Same Tactic: Initial Access

Popular Detections