Detect CVE-2026-2441: Google Chromium CSS Use-After-Free Exploitation in Elastic Security
Detects exploitation of CVE-2026-2441, a use-after-free vulnerability in the CSS engine of Google Chromium. This vulnerability is actively exploited in the wild (CISA KEV) and can allow remote code execution via a malicious web page. Detection focuses on abnormal Chromium renderer process behavior, suspicious child process spawning, and memory corruption indicators consistent with UAF exploitation.
MITRE ATT&CK
Elastic Detection Query
sequence by host.name with maxspan=30s
[process where event.type == "start"
and (process.parent.name : ("chrome.exe", "chromium", "chrome") or process.parent.executable : ("*chrome*", "*chromium*"))
and process.parent.args : "--type=renderer"
and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "schtasks.exe")
]
[network where event.type == "connection"
and process.name : ("cmd.exe", "powershell.exe", "rundll32.exe")
and not destination.ip : ("127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
]EQL sequence rule correlating a Chromium renderer spawning a suspicious process followed by an outbound network connection from that process, indicating successful exploitation and potential C2 callback.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise proxy tools that legitimately intercept Chrome network calls
- Automated testing frameworks (Selenium, Playwright) that control Chrome subprocess behavior
- Non-standard Chromium forks used in kiosk or embedded environments
Other platforms for CVE-2026-2441
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Chromium Renderer Spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing chrome.exe (with --type=renderer in command line) as ParentImage for cmd.exe process creation. DeviceProcessEvents in MDE will show the renderer→cmd.exe lineage.
- Test 2Chromium Renderer Spawning PowerShell with Network Callback
Expected signal: Sysmon Event ID 1 (process create: powershell under chrome renderer), Sysmon Event ID 3 (network connection from powershell to 127.0.0.1:8080). Elastic EQL sequence rule should correlate both events.
- Test 3Validate Unpatched Chrome Version Detection via Asset Inventory
Expected signal: Registry query results showing Chrome version strings per host. CrowdStrike RTR or MDE LiveResponse will log the query execution.
- Test 4CSS Object Lifecycle Stress Test for UAF Trigger Research
Expected signal: On a vulnerable build: renderer process crashes (SIGSEGV or similar) visible in /var/log/syslog or Chromium crash reports under ~/.config/chromium/Crash Reports/. On a patched build: no crash, normal page operation.
Response Playbook
Triage
- Identify the affected host and user account. Determine Chrome/Chromium version installed and compare against patched version from the Feb 13 2026 stable channel release (https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html).
- Review process tree for the Chromium renderer process: capture parent PID, the child process spawned, and its command line arguments. Determine whether the child process executed payloads (e.g., downloaded files, injected into other processes, modified registry).
- Check network connections from the Chrome process and any spawned child processes. Look for connections to non-standard ports, newly-registered domains, or IP addresses with low reputation. Use threat intel feeds to assess destination reputation.
- Review browser history and visited URLs around the time of the alert. Identify the specific page or redirect chain that may have delivered the exploit. This is critical for identifying additional victims and blocking the malicious domain/URL.
Containment
- Immediately isolate the affected endpoint from the network to prevent lateral movement or data exfiltration. Use EDR agent network isolation if available. Preserve system state before isolation for forensic purposes.
- Force-terminate all Chrome/Chromium processes on the affected host. Block the identified malicious URL/domain at proxy and DNS layers. Deploy emergency Chrome version update via GPO or MDM to all unpatched endpoints — prioritize internet-facing workstations and privileged user machines.
Evidence Collection
- Collect a memory dump of the affected Chrome renderer process (and any spawned child processes) before termination. Use tools like WinPmem or ProcDump. Memory artifacts are critical for UAF analysis — heap spray patterns and freed object reuse may be recoverable.
- Export endpoint telemetry: full process tree, network connection logs, file system changes, and registry modifications from the 30-minute window surrounding the alert. Collect browser profile data (cookies, localStorage, cache) which may contain attacker-controlled content or exfiltrated data.
Escalation Criteria
- !Escalate to IR immediately if the spawned child process established outbound C2 connections, downloaded additional payloads, or performed credential access (e.g., accessed LSASS, read browser credential stores, queried Vault/secrets manager APIs).
- !Escalate if the affected user has privileged access (domain admin, cloud admin, DevOps secrets access) or if multiple hosts show similar alerts within a short timeframe, suggesting a watering-hole campaign or targeted spear-phishing delivering this exploit.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Chrome renderer process crash dumps in %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\ — may contain exploit shellcode or heap spray evidence - >
Windows Error Reporting (WER) logs at %ProgramData%\Microsoft\Windows\WER\ReportQueue\ for crash data associated with the exploit trigger - >
Prefetch files for any LOLBin child processes spawned (C:\Windows\Prefetch\) establishing execution timeline - >
Chrome browser history and cache at %LOCALAPPDATA%\Google\Chrome\User Data\Default\ — identifies malicious URL - >
Sysmon Event ID 1 (Process Create), 3 (Network Connection), and 10 (Process Access) from the exploitation window
Tuning Guidance
Start with high-confidence renderer→LOLBin spawning detections. Whitelist known Chrome helper executables (crashpad_handler, nacl64, notification_helper, elevation_service) and enterprise-specific Native Messaging hosts identified during baseline review. For organizations using Electron or CEF applications, add parent process exclusions based on specific application paths. Tune confidence down to medium on hosts running automated browser testing (Selenium Grid, Playwright workers) where renderer subprocess behavior is expected to be non-standard. Consider adding version-based suppression: once Chrome is patched to the post-Feb-13-2026 stable release, reduce alert priority for up-to-date endpoints while retaining critical severity for unpatched systems.
Hunting Queries
Broad hunt for any non-standard child processes spawned by Chrome renderer processes over the past 14 days. Establishes baseline and surfaces anomalous process lineage that may indicate prior undetected exploitation of CVE-2026-2441 or similar browser vulnerabilities.
DeviceProcessEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ 'chrome.exe'
| where InitiatingProcessCommandLine has '--type=renderer'
| where FileName !in~ ('chrome.exe', 'chromium.exe', 'nacl64.exe', 'crashpad_handler.exe', 'elevation_service.exe', 'notification_helper.exe', 'setup.exe')
| summarize ChildProcesses = make_set(FileName), Count = count() by DeviceName, InitiatingProcessFileName
| where Count > 0
| order by Count descindex=endpoint sourcetype=sysmon ParentImage="*chrome.exe" ParentCommandLine="*--type=renderer*"
| stats count by host, Image, CommandLine
| where NOT match(Image, "(?i)(chrome|chromium|nacl64|crashpad|notification_helper|elevation_service)")
| sort -countAtomic Red Team Tests
Simulates the post-exploitation behavior of CVE-2026-2441 by directly launching cmd.exe with chrome.exe as its parent process using a --type=renderer argument, bypassing actual exploit delivery. Tests detection coverage for the renderer→shell spawn pattern.
Command
Start-Process -FilePath 'C:\Program Files\Google\Chrome\Application\chrome.exe' -ArgumentList '--type=renderer','--no-sandbox','--disable-dev-shm-usage' -PassThru | ForEach-Object { Start-Sleep -Seconds 2; Start-Process -FilePath 'cmd.exe' -ArgumentList '/c whoami > C:\Windows\Temp\cve_2026_2441_test.txt' }Cleanup
Remove-Item C:\Windows\Temp\cve_2026_2441_test.txt -ErrorAction SilentlyContinue; Stop-Process -Name chrome -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 showing chrome.exe (with --type=renderer in command line) as ParentImage for cmd.exe process creation. DeviceProcessEvents in MDE will show the renderer→cmd.exe lineage.
Expected Detection
Primary KQL and SPL detection rules should fire on the renderer→cmd.exe spawn. CrowdStrike CQL ProcessRollup2 event should trigger alert.
Simulates full post-exploitation chain: renderer spawning PowerShell which then makes an outbound network connection, mimicking C2 callback behavior after successful CVE-2026-2441 exploitation.
Command
# Lab only — simulates C2 callback pattern post-exploitation
$chromePath = 'C:\Program Files\Google\Chrome\Application\chrome.exe'
$psCmd = 'powershell.exe -NoProfile -NonInteractive -Command "Invoke-WebRequest -Uri http://127.0.0.1:8080/beacon -UseBasicParsing -TimeoutSec 5 -ErrorAction SilentlyContinue"'
Start-Process -FilePath $chromePath -ArgumentList '--type=renderer','--no-sandbox' -PassThru | ForEach-Object { Start-Sleep -Seconds 2; Start-Process -FilePath 'powershell.exe' -ArgumentList "-NoProfile -NonInteractive -Command `"Invoke-WebRequest -Uri http://127.0.0.1:8080/beacon -UseBasicParsing -TimeoutSec 5`"" }Cleanup
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue; Stop-Process -Name chrome -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 (process create: powershell under chrome renderer), Sysmon Event ID 3 (network connection from powershell to 127.0.0.1:8080). Elastic EQL sequence rule should correlate both events.
Expected Detection
Elastic EQL sequence rule fires on renderer→powershell spawn + subsequent network connection. Sumo Logic and Chronicle rules detect the process creation component.
Queries endpoint telemetry to identify hosts running Chrome versions predating the CVE-2026-2441 patch (Feb 13 2026 stable channel). This validates detection coverage for the vulnerable population and should be run as a pre-exploitation hunt.
Command
# Identify unpatched Chrome installations across the environment
# Run in MDE Advanced Hunting or via CrowdStrike RTR
Get-ItemProperty 'HKLM:\SOFTWARE\Google\Chrome' -Name 'pv' -ErrorAction SilentlyContinue | Select-Object PSComputerName, pv
Get-ItemProperty 'HKCU:\SOFTWARE\Google\Chrome\BLBeacon' -Name 'version' -ErrorAction SilentlyContinue | Select-Object PSComputerName, version
# Compare output against patched version from Feb 13 2026 stable channel releaseCleanup
No cleanup required — read-only registry queryExpected Telemetry
Registry query results showing Chrome version strings per host. CrowdStrike RTR or MDE LiveResponse will log the query execution.
Expected Detection
No alert expected from this test — it is a detection validation and asset inventory check. Hosts returning pre-patch version numbers should be flagged for emergency update and elevated monitoring.
Lab-only HTML/JS test page that aggressively allocates and deallocates CSS objects to stress-test browser CSS engine memory management. Intended for controlled lab analysis of UAF conditions similar to CVE-2026-2441. DO NOT run against production systems.
Command
# Lab environment only — requires unpatched Chromium build
# Create a test HTML file to stress CSS object lifecycle
cat > /tmp/cve_2026_2441_lab.html << 'EOF'
<!DOCTYPE html><html><body><script>
const elements = [];
function stressCSSLifecycle() {
for (let i = 0; i < 10000; i++) {
const el = document.createElement('div');
el.style.cssText = `position:absolute;top:${i}px;color:red;font-size:${i%100}px`;
document.body.appendChild(el);
elements.push(el);
}
elements.forEach(el => { if (el.parentNode) el.parentNode.removeChild(el); });
elements.length = 0;
requestAnimationFrame(stressCSSLifecycle);
}
requestAnimationFrame(stressCSSLifecycle);
</script></body></html>
EOF
# Launch unpatched Chromium against the test page (lab only)
/opt/chromium-unpatched/chromium --no-sandbox --disable-gpu /tmp/cve_2026_2441_lab.htmlCleanup
rm -f /tmp/cve_2026_2441_lab.html; pkill -f chromium-unpatchedExpected Telemetry
On a vulnerable build: renderer process crashes (SIGSEGV or similar) visible in /var/log/syslog or Chromium crash reports under ~/.config/chromium/Crash Reports/. On a patched build: no crash, normal page operation.
Expected Detection
Crash-based detection rules and EDR memory corruption telemetry may fire. This test validates that the patch eliminates the UAF condition rather than testing post-exploitation detection.