Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CVE-2026-11645)

let SuspiciousChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe", "certutil.exe", "bitsadmin.exe"]);
let BrowserProcs = dynamic(["chrome.exe", "msedge.exe", "brave.exe", "vivaldi.exe", "opera.exe"]);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated >= ago(7d)
| where (ActionType == "ProcessCreated" or EventID == 4688)
| where (InitiatingProcessFileName in~ (BrowserProcs) or ParentProcessName has_any (BrowserProcs))
| where (FileName in~ (SuspiciousChildProcs) or NewProcessName has_any (SuspiciousChildProcs))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessId, ProcessId
| extend RiskScore = case(
    ProcessCommandLine has_any ("Invoke-", "EncodedCommand", "-enc", "IEX", "DownloadString"), 3,
    ProcessCommandLine has_any ("http", "ftp", "curl", "wget"), 2,
    1
  )
| where RiskScore >= 1
| order by RiskScore desc, TimeGenerated desc

index=windows (sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) OR (sourcetype=wineventlog EventCode=4688)
| eval parent=lower(coalesce(ParentImage, ParentProcessName))
| eval child=lower(coalesce(Image, NewProcessName))
| where match(parent, "(chrome|msedge|brave|vivaldi|opera)\.exe")
| where match(child, "(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|schtasks|certutil|bitsadmin)\.exe")
| eval risk_score=case(
    match(CommandLine, "(?i)(invoke-|encodedcommand|-enc |iex |downloadstring)"), 3,
    match(CommandLine, "(?i)(http[s]?://|ftp://|curl|wget)"), 2,
    true(), 1
  )
| table _time, host, user, parent, child, CommandLine, risk_score
| sort -risk_score, -_time

sequence by host.name, process.parent.entity_id with maxspan=30s
  [process where event.type == "start"
   and process.name : ("chrome.exe", "msedge.exe", "brave.exe", "vivaldi.exe", "opera.exe")
   and process.parent.name != null]
  [process where event.type == "start"
   and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                        "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe",
                        "certutil.exe", "bitsadmin.exe")
   and process.parent.name : ("chrome.exe", "msedge.exe", "brave.exe", "vivaldi.exe", "opera.exe")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, destinationip, username,
       "processPath" AS ParentProcess,
       "childProcessPath" AS ChildProcess,
       "commandLine" AS CommandLine,
       LOGSOURCENAME(logsourceid) AS LogSource
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND LOWER("processPath") MATCHES '.*?(chrome|msedge|brave|vivaldi|opera)\.exe.*'
  AND LOWER("childProcessPath") MATCHES '.*?(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|schtasks|certutil|bitsadmin)\.exe.*'
  AND starttime > '2026-06-09 00:00:00'
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json auto
| where (EventID = "1" or EventID = "4688")
| where (
    (toLowerCase(ParentImage) matches "*chrome.exe*") OR
    (toLowerCase(ParentImage) matches "*msedge.exe*") OR
    (toLowerCase(ParentImage) matches "*brave.exe*") OR
    (toLowerCase(ParentImage) matches "*vivaldi.exe*") OR
    (toLowerCase(ParentImage) matches "*opera.exe*")
  )
| where (
    (toLowerCase(Image) matches "*cmd.exe*") OR
    (toLowerCase(Image) matches "*powershell.exe*") OR
    (toLowerCase(Image) matches "*mshta.exe*") OR
    (toLowerCase(Image) matches "*wscript.exe*") OR
    (toLowerCase(Image) matches "*rundll32.exe*") OR
    (toLowerCase(Image) matches "*certutil.exe*")
  )
| fields _messageTime, Computer, User, ParentImage, Image, CommandLine
| sort by _messageTime desc

rule cve_2026_11645_chromium_v8_exploit {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-11645 Chromium V8 OOB via suspicious child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11645"

  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    $parent.principal.process.file.full_path = /(?i)(chrome|msedge|brave|vivaldi|opera)\.exe/
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|schtasks|certutil|bitsadmin)\.exe/
    $child.target.process.parent_process.file.full_path = /(?i)(chrome|msedge|brave|vivaldi|opera)\.exe/
    $parent.metadata.event_timestamp.seconds < $child.metadata.event_timestamp.seconds
    $child.metadata.event_timestamp.seconds - $parent.metadata.event_timestamp.seconds <= 30

  match:
    $child.principal.hostname over 5m

  outcome:
    $risk_score = 85
    $hostname = $child.principal.hostname
    $username = $child.principal.user.userid
    $child_process = $child.principal.process.file.full_path
    $parent_process = $child.target.process.parent_process.file.full_path
    $cmdline = $child.principal.process.command_line

  condition:
    $parent and $child
}

event_simpleName=ProcessRollup2
| search ImageFileName IN ("*\\chrome.exe", "*\\msedge.exe", "*\\brave.exe", "*\\vivaldi.exe", "*\\opera.exe")
  AND ParentBaseFileName IN ("chrome.exe", "msedge.exe", "brave.exe", "vivaldi.exe", "opera.exe")
  AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe",
                   "rundll32.exe", "regsvr32.exe", "schtasks.exe", "certutil.exe", "bitsadmin.exe")
| eval risk=case(
    match(CommandLine, "(?i)invoke-|encodedcommand|-enc |iex |downloadstring"), "HIGH",
    match(CommandLine, "(?i)http[s]?://|ftp://"), "MEDIUM",
    true(), "LOW"
  )
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, risk
| sort -_time