Google Skia Out-of-Bounds Write (CVE-2026-3909)

union DeviceProcessEvents, DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "vivaldi.exe")
| where (ActionType == "ProcessCreated" and FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe"))
   or (ActionType in ("NetworkConnectionSuccess", "InboundConnectionAccepted") and RemotePort in (4444, 1337, 8080, 9001))
| extend RiskIndicator = case(
    FileName in~ ("cmd.exe", "powershell.exe"), "ShellSpawnedFromBrowser",
    ActionType == "NetworkConnectionSuccess" and RemotePort in (4444, 1337), "SuspiciousC2Port",
    "GenericSuspicious"
  )
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemotePort, RiskIndicator

index=endpoint sourcetype=crowdstrike:events:sensor OR sourcetype=sysmon
| where (ParentImage IN ("*\\chrome.exe", "*\\msedge.exe", "*\\brave.exe", "*\\opera.exe")
    AND Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\rundll32.exe", "*\\regsvr32.exe"))
   OR (process_name IN ("chrome.exe", "msedge.exe") AND dest_port IN (4444, 1337, 8080, 9001))
| eval risk_indicator=case(
    match(Image, "(?i)(cmd|powershell)\.exe"), "ShellSpawnedFromBrowser",
    isnotnull(dest_port), "SuspiciousOutboundPort",
    1=1, "GenericSuspicious"
  )
| table _time, host, user, ParentImage, ParentCommandLine, Image, CommandLine, dest_ip, dest_port, risk_indicator
| sort -_time

sequence by host.name with maxspan=2m
  [process where event.type == "start"
    and process.parent.name in ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe")
    and process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")]
  [any where event.category in ("network", "process")
    and (network.direction == "outbound" or process.name : "*")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, destinationport,
       "processPath", "parentProcessPath", username, LOGSOURCENAME(logsourceid)
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'CrowdStrike Falcon')
  AND (
    (LOWER("parentProcessPath") LIKE '%chrome.exe' OR LOWER("parentProcessPath") LIKE '%msedge.exe')
    AND LOWER("processPath") IN ('%cmd.exe', '%powershell.exe', '%wscript.exe', '%mshta.exe', '%rundll32.exe')
  )
  OR (
    LOWER("processPath") LIKE '%chrome.exe'
    AND destinationport IN (4444, 1337, 8080, 9001)
    AND eventdirection = 'L2R'
  )
LAST 7 DAYS
ORDER BY devicetime DESC

_sourceCategory=endpoint/windows OR _sourceCategory=endpoint/crowdstrike
| where (toLowerCase(%"ParentImage") matches "*chrome.exe" OR toLowerCase(%"ParentImage") matches "*msedge.exe")
  AND (toLowerCase(%"Image") matches "*cmd.exe" OR toLowerCase(%"Image") matches "*powershell.exe" OR toLowerCase(%"Image") matches "*wscript.exe" OR toLowerCase(%"Image") matches "*mshta.exe")
| OR (_sourceCategory=network/firewall
  AND (toLowerCase(app) matches "*chrome*" OR toLowerCase(app) matches "*msedge*")
  AND dest_port IN ("4444", "1337", "8080", "9001"))
| fields _messageTime, host, user, %"ParentImage", %"Image", %"CommandLine", dest_ip, dest_port
| sort by _messageTime desc

rule cve_2026_3909_skia_oob_write {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-3909 Google Skia OOB write exploitation via browser process anomalies"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2026-3909"
    mitre_attack = "T1203, T1189"

  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.principal.process.file.full_path = /(?i)(chrome|msedge|brave|opera)\.exe$/
    $e1.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$/
    $e1.principal.hostname = $host

  condition:
    $e1
}

event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4")
| ParentBaseFileName IN ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "vivaldi.exe")
| case(
    event_simpleName = "ProcessRollup2": FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe"),
    event_simpleName = "NetworkConnectIP4": RemotePort IN (4444, 1337, 8080, 9001)
  )
| table timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, RemoteIP, RemotePort
| sort timestamp desc