Detect Google Skia Out-of-Bounds Write (CVE-2026-3909) in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2026-3909, an out-of-bounds write vulnerability in Google Skia graphics library. Skia is embedded in Chrome and other Google products. Exploitation can lead to arbitrary code execution via crafted web content or malicious files. This vulnerability is confirmed exploited in the wild (CISA KEV).
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
union DeviceProcessEvents, DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "vivaldi.exe")
| where (ActionType == "ProcessCreated" and FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe"))
or (ActionType in ("NetworkConnectionSuccess", "InboundConnectionAccepted") and RemotePort in (4444, 1337, 8080, 9001))
| extend RiskIndicator = case(
FileName in~ ("cmd.exe", "powershell.exe"), "ShellSpawnedFromBrowser",
ActionType == "NetworkConnectionSuccess" and RemotePort in (4444, 1337), "SuspiciousC2Port",
"GenericSuspicious"
)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemotePort, RiskIndicatorIdentifies browser processes (Chrome and Chromium-based) spawning unexpected child processes or making suspicious outbound connections — common post-exploitation behaviour following a Skia renderer compromise.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate browser extensions that spawn helper processes
- Developer workflows invoking CLI tools from browser-triggered scripts
- Corporate proxy or DLP software that establishes connections on unusual ports from browser processes
Other platforms for CVE-2026-3909
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Browser Spawning Shell (Windows)
Expected signal: Sysmon Event ID 1 showing cmd.exe with ParentImage containing chrome.exe; Windows Security 4688 process creation log
- Test 2Simulate Suspicious Outbound Network Connection from Browser Process (Linux)
Expected signal: Auditd or Sysmon-for-Linux network connection event showing process named 'chrome' connecting to port 4444
- Test 3Simulate Renderer Sandbox Escape via LOLBin Execution (Windows)
Expected signal: Sysmon Event ID 1 with regsvr32.exe CommandLine containing /i:http and scrobj.dll; Sysmon Event ID 3 network connection from regsvr32.exe
- Test 4Skia OOB Write Crash Reproduction (macOS — Lab Only)
Expected signal: Chrome crash report generated in crash-dumps-dir; macOS Console logs show SIGSEGV or SIGABRT from renderer process
Unlock Pro Content
Get the full detection package for CVE-2026-3909 including response playbook, investigation guide, and atomic red team tests.