CVE-2026-3910: Google Chromium V8 Memory Buffer Bounds Violation

let suspiciousChildProcs = dynamic(['cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe','wmic.exe']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ 'chrome.exe' or InitiatingProcessFileName =~ 'msedge.exe'
| where FileName in~ (suspiciousChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| union (
    DeviceCrashEvents
    | where TimeGenerated >= ago(7d)
    | where FileName =~ 'chrome.exe' or FileName =~ 'msedge.exe'
    | where ExceptionCode in ('0xC0000005','0xC0000094','0x80000003')
    | project TimeGenerated, DeviceName, FileName, ExceptionCode, ExceptionAddress
)
| union (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(7d)
    | where InitiatingProcessFileName =~ 'chrome.exe'
    | where RemotePort !in (80, 443)
    | where not(ipv4_is_private(RemoteIP))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
)
| sort by TimeGenerated desc

index=endpoint sourcetype=crowdstrike:events:sensor OR sourcetype=sysmon
| eval parent=lower(ParentImage), proc=lower(Image)
| where (parent LIKE "%chrome.exe" OR parent LIKE "%msedge.exe")
  AND (proc IN ("cmd.exe","powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe"))
| eval detection_source="child_process_spawn"
| append [
    search index=wineventlog EventCode=1000 OR EventCode=1001 (Application="chrome.exe" OR Application="msedge.exe")
    | eval detection_source="application_crash"
    | table _time, host, Application, EventCode, Message, detection_source
  ]
| append [
    search index=network sourcetype=firewall OR sourcetype=proxy
    | where (src_process="chrome.exe" OR src_process="msedge.exe")
    | where NOT (dest_port=80 OR dest_port=443)
    | where NOT match(dest_ip,"^(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)")
    | eval detection_source="anomalous_network"
    | table _time, host, src_process, dest_ip, dest_port, detection_source
  ]
| stats count by _time, host, detection_source, proc, parent
| sort -_time

sequence by host.name with maxspan=2m
  [process where event.type == "start"
    and process.parent.name in ("chrome.exe", "msedge.exe")
    and process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe")]
  [any where event.category in ("network", "file") and
    (process.name in ("cmd.exe", "powershell.exe") or
     network.direction == "egress" and not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"))]

SELECT
  DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  "Process Name",
  "Parent Process Name",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log','CrowdStrike Falcon')
  AND (
    (
      LOWER("Parent Process Name") LIKE '%chrome.exe'
      OR LOWER("Parent Process Name") LIKE '%msedge.exe'
    )
    AND LOWER("Process Name") IN ('cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe')
  )
  AND starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LAST 7 DAYS

_sourceCategory=endpoint/windows OR _sourceCategory=endpoint/crowdstrike
| json auto
| where (toLowerCase(ParentImage) matches "*chrome.exe" OR toLowerCase(ParentImage) matches "*msedge.exe")
  AND toLowerCase(Image) in ("cmd.exe","powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","wmic.exe")
| fields _messageTime, host, ParentImage, Image, CommandLine, User
| union
  (_sourceCategory=os/windows/events
  | kv regex "Application = (?<Application>[^\n]+)" nodrop
  | where EventID in ("1000","1001") AND (toLowerCase(Application) matches "*chrome.exe" OR toLowerCase(Application) matches "*msedge.exe")
  | fields _messageTime, host, EventID, Application)
| sort by _messageTime desc

rule cve_2026_3910_chromium_v8_exploit {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-3910 Chromium V8 memory buffer vulnerability via suspicious browser child process spawning"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-3910"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /(?i)(chrome\.exe|msedge\.exe)$/
    $proc.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe)$/
    $proc.principal.hostname = $hostname

  match:
    $hostname over 5m

  condition:
    $proc
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName IN (chrome.exe, msedge.exe)
| search FileName IN (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, wmic.exe)
| eval risk_score=case(
    FileName=="powershell.exe" AND match(CommandLine, "-enc|-EncodedCommand|-nop|-WindowStyle Hidden"), 100,
    FileName=="certutil.exe" AND match(CommandLine, "-urlcache|-decode"), 95,
    FileName=="mshta.exe", 90,
    FileName=="cmd.exe" AND match(CommandLine, "http|ftp|bitsadmin"), 85,
    true(), 70
  )
| where risk_score >= 70
| table timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, risk_score
| sort -risk_score