CVE-2026-2441: Google Chromium CSS Use-After-Free Exploitation

let suspiciousChildProcs = dynamic(['cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','schtasks.exe','certutil.exe','bitsadmin.exe']);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ 'chrome.exe' or InitiatingProcessFileName =~ 'chromium.exe'
| where InitiatingProcessCommandLine has '--type=renderer'
| where FileName in~ (suspiciousChildProcs)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ProcessId
| extend AlertReason = 'Chromium renderer spawned suspicious child process - potential CVE-2026-2441 exploitation'

index=endpoint sourcetype=crowdstrike:events:sensor OR sourcetype=sysmon
(ParentImage="*\\chrome.exe" OR ParentImage="*\\chromium.exe")
ParentCommandLine="*--type=renderer*"
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\schtasks.exe")
| eval alert_reason="Chromium renderer spawned suspicious child process - CVE-2026-2441"
| table _time, host, user, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId, ParentProcessId, alert_reason
| sort -_time

sequence by host.name with maxspan=30s
  [process where event.type == "start"
    and (process.parent.name : ("chrome.exe", "chromium", "chrome") or process.parent.executable : ("*chrome*", "*chromium*"))
    and process.parent.args : "--type=renderer"
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "schtasks.exe")
  ]
  [network where event.type == "connection"
    and process.name : ("cmd.exe", "powershell.exe", "rundll32.exe")
    and not destination.ip : ("127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "ParentImage",
  "ParentCommandLine",
  "Image" AS child_process,
  "CommandLine" AS child_cmdline,
  sourceip,
  destinationip
FROM events
WHERE
  LOWER("ParentImage") LIKE '%chrome.exe' OR LOWER("ParentImage") LIKE '%chromium%'
AND "ParentCommandLine" ILIKE '%--type=renderer%'
AND (
  LOWER("Image") LIKE '%cmd.exe'
  OR LOWER("Image") LIKE '%powershell.exe'
  OR LOWER("Image") LIKE '%wscript.exe'
  OR LOWER("Image") LIKE '%mshta.exe'
  OR LOWER("Image") LIKE '%rundll32.exe'
  OR LOWER("Image") LIKE '%regsvr32.exe'
  OR LOWER("Image") LIKE '%certutil.exe'
)
AND LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
LAST 7 DAYS

_sourceCategory=endpoint/sysmon OR _sourceCategory=endpoint/crowdstrike
| json field=_raw "ParentImage", "ParentCommandLine", "Image", "CommandLine", "Computer", "User"
| where (ParentImage matches "*chrome.exe" OR ParentImage matches "*chromium*")
| where ParentCommandLine matches "*--type=renderer*"
| where Image matches "*cmd.exe" OR Image matches "*powershell.exe" OR Image matches "*wscript.exe" OR Image matches "*mshta.exe" OR Image matches "*rundll32.exe" OR Image matches "*regsvr32.exe" OR Image matches "*certutil.exe" OR Image matches "*bitsadmin.exe"
| withtime _messageTime
| fields _messageTime, Computer, User, ParentImage, ParentCommandLine, Image, CommandLine
| sort by _messageTime desc

rule cve_2026_2441_chromium_css_uaf_exploitation {
  meta:
    author = "df00tech detection engineering"
    description = "Detects CVE-2026-2441 Chromium CSS use-after-free exploitation via renderer child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-2441"
    yara_version = "YL2.0"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(chrome\.exe|chromium)$/
    $proc.principal.process.command_line = /--type=renderer/
    $proc.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|schtasks\.exe)$/
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("chrome.exe", "chromium.exe", "chromium")
| CommandLine = "*--type=renderer*"
| FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "schtasks.exe")
| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| rename ComputerName as host, UserName as user, ParentBaseFileName as parent_process, FileName as child_process, CommandLine as child_cmdline
| sort timestamp desc