CVE-2026-5281 Sumo Logic CSE · Sumo

Detect CVE-2026-5281 — Google Dawn Use-After-Free Exploitation in Sumo Logic CSE

Detects exploitation of CVE-2026-5281, a use-after-free vulnerability in Google Dawn (the WebGPU implementation used by Chrome). Exploitation may result in renderer compromise, sandbox escape, or arbitrary code execution via a malicious web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=endpoint/windows OR _sourceCategory=endpoint/crowdstrike
| where process_name matches /(?i)chrome\.exe/
| where command_line matches /(?i)(--renderer|--gpu-process|--utility)/
| join (
    _sourceCategory=endpoint/windows OR _sourceCategory=endpoint/crowdstrike
    | where event_name matches /(?i)(exploit|memory.violation|control.flow|injection|shellcode)/
    | where process_name matches /(?i)chrome\.exe/
) as exploit_events on host=exploit_events.host
| count by _messageTime, host, user, command_line, exploit_events.event_name
| sort by _messageTime desc
high severity low confidence

Sumo Logic query correlating Chrome renderer subprocess events with exploit or memory violation telemetry to detect CVE-2026-5281 Dawn use-after-free exploitation attempts.

Data Sources

Sumo Logic Cloud SIEMWindows Event LogCrowdStrike

Required Tables

endpoint/windowsendpoint/crowdstrike

False Positives & Tuning

  • Endpoint security tools generating exploit events during normal Chrome WebGPU usage
  • Developer workstations running WebGPU experiments may produce renderer memory events
  • Chrome crash reporter activity that resembles memory fault telemetry

Other platforms for CVE-2026-5281

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Chrome Renderer Spawning Unexpected Child Process (Post-Exploitation Proxy)

    Expected signal: EDR process tree shows cmd.exe spawned as child of chrome.exe with --renderer flag; ProcessRollup2 event with atypical ChildFileName

  2. Test 2Trigger Chrome WebGPU Memory Fault via Malformed Shader (Lab)

    Expected signal: Chrome crash report written to %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\; GPU process exit event in Windows Application log

  3. Test 3Detect Outdated Chrome Version via Endpoint Inventory Query

    Expected signal: PowerShell script block logging (Event ID 4104) records version enumeration; file access telemetry on chrome.exe from EDR

  4. Test 4Simulate CFG Violation in Chrome GPU Process (Windows CFG Test)

    Expected signal: Windows Defender ATP generates ExploitGuardControlFlowGuardViolated event for chrome.exe; CFG violation logged in Windows Security event log

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the affected host is running an unpatched version of Google Chrome prior to the fix for CVE-2026-5281. Check chrome://version or endpoint inventory for build number.
  2. Identify the URL or web content that triggered the alert. Examine Chrome's process command-line arguments for --renderer or --gpu-process flags and correlate with browser history or DNS logs for suspicious domains visited within 30 minutes of the alert.
  3. Review endpoint memory and exploit telemetry (CFG violations, memory protection faults) from EDR to determine whether the exploit progressed beyond the renderer sandbox — look for child processes spawned by chrome.exe that are atypical (cmd.exe, powershell.exe, wscript.exe).
  4. Check for lateral movement indicators from the affected host: new outbound connections, credential access events, or scheduled task creation following the browser exploitation window.

Containment

  1. Immediately isolate the affected endpoint from the network via EDR or NAC policy if post-sandbox exploitation is confirmed or suspected. Preserve the host for forensic imaging before remediation.
  2. Force-update Google Chrome on all affected endpoints to the patched version. Use enterprise Chrome update policies (Google Admin Console, Intune, or SCCM) to enforce the update and block launch of outdated builds via application control policy.

Evidence Collection

  1. Collect Chrome renderer process memory dump using EDR live response or ProcDump prior to killing the process: `procdump -ma <chrome_renderer_pid> C:\evidence\chrome_renderer.dmp`. Preserve for later UAF heap analysis.
  2. Export EDR telemetry for the affected host covering ±2 hours around the alert: process tree, network connections, file write events, and registry modifications. Include Chrome crash reports from `%LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\`.

Escalation Criteria

  • !Escalate to Incident Response if any process other than chrome.exe or its expected child processes (crashpad_handler.exe, chrome_crashpad_handler) is spawned as a child of a Chrome renderer or GPU process.
  • !Escalate immediately if post-exploitation activity is identified: new user accounts, credential dumping tools (mimikatz, lsass access), persistence mechanisms (Run keys, scheduled tasks), or C2 beaconing from the affected host.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Chrome crash reports in `%LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\` — minidumps from renderer crashes during exploitation attempts
  • >Windows Event Log: Application log entries from `Google Chrome` source around the time of the alert
  • >EDR memory protection fault records identifying the faulting instruction pointer and heap address at time of UAF trigger
  • >Browser history and DNS cache entries (`ipconfig /displaydns`) for domains visited immediately before exploitation

Tuning Guidance

Start with high-severity alerts only by filtering on confirmed exploitation indicators (child process anomalies, CFG violations) rather than all renderer process starts. Chrome spawns many renderer and GPU processes normally — tuning must focus on the combination of subprocess type AND memory exploitation telemetry. Exclude known-good child processes (crashpad_handler.exe, elevation_service.exe). In environments with heavy WebGPU usage (3D apps, gaming platforms), consider allowlisting known-good domains or increasing the confidence threshold to require both a memory fault AND an atypical child process before alerting.

Hunting Queries

Threat hunt for unexpected child processes spawned by Chrome renderer or GPU subprocesses — a strong indicator of sandbox escape following CVE-2026-5281 exploitation.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ 'chrome.exe'
| where FileName !in~ ('chrome.exe', 'crashpad_handler.exe', 'chrome_crashpad_handler.exe', 'elevation_service.exe', 'nacl64.exe')
| where InitiatingProcessCommandLine has_any ('--renderer', '--gpu-process', '--utility')
| summarize count(), ChildProcesses=make_set(FileName) by DeviceName, InitiatingProcessCommandLine
| where array_length(ChildProcesses) > 0
| order by count_ desc
Hunting — SPL
spl 
index=endpoint sourcetype=crowdstrike:events:sensor event_simpleName=ProcessRollup2
| where ParentImageFileName LIKE "%chrome.exe"
| where CommandLine LIKE "%--renderer%" OR CommandLine LIKE "%--gpu-process%"
| eval ChildFileName=mvindex(split(ImageFileName, "\\"), -1)
| where NOT ChildFileName IN ("chrome.exe", "crashpad_handler.exe", "chrome_crashpad_handler.exe")
| stats count by host, UserName, ParentImageFileName, ChildFileName, ImageFileName
| sort -count

Atomic Red Team Tests

Test 1 Simulate Chrome Renderer Spawning Unexpected Child Process (Post-Exploitation Proxy)
windows

Simulates the post-sandbox-escape behavior of CVE-2026-5281 by launching a Chrome renderer process stub that spawns cmd.exe as a child. This mimics what EDR telemetry would observe after a successful UAF exploit escapes the renderer sandbox. Lab use only.

Command

powershell 
Start-Process chrome.exe -ArgumentList '--renderer --no-sandbox --disable-gpu' -PassThru | ForEach-Object { Start-Sleep 2; Start-Process cmd.exe -ArgumentList '/c whoami > C:\Temp\atomic_test_output.txt' }

Cleanup

powershell 
Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue; Remove-Item C:\Temp\atomic_test_output.txt -Force -ErrorAction SilentlyContinue

Expected Telemetry

EDR process tree shows cmd.exe spawned as child of chrome.exe with --renderer flag; ProcessRollup2 event with atypical ChildFileName

Expected Detection

KQL and CrowdStrike CQL hunting queries detecting unexpected child process from Chrome renderer subprocess

Test 2 Trigger Chrome WebGPU Memory Fault via Malformed Shader (Lab)
windows

Loads a malformed WebGPU compute shader in Chrome to generate a GPU process crash and associated crash report artifact. Simulates the crash telemetry produced during CVE-2026-5281 exploitation attempts. Requires a patched-down Chrome build or lab VM.

Command

powershell 
chrome.exe --enable-unsafe-webgpu --disable-dawn-features=allow_unsafe_apis 'data:text/html,<script>const adapter=await navigator.gpu.requestAdapter();const device=await adapter.requestDevice();const buf=device.createBuffer({size:0,usage:GPUBufferUsage.STORAGE});buf.destroy();buf.mapAsync(GPUMapMode.READ);</script>'

Cleanup

powershell 
Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue

Expected Telemetry

Chrome crash report written to %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\; GPU process exit event in Windows Application log

Expected Detection

Crash report artifact collection step in playbook; memory fault telemetry surfaced in EDR

Test 3 Detect Outdated Chrome Version via Endpoint Inventory Query
windows

Enumerates Chrome version on the endpoint to identify unpatched installations vulnerable to CVE-2026-5281. Simulates the triage step an analyst would perform to scope exposure.

Command

powershell 
(Get-Item 'C:\Program Files\Google\Chrome\Application\chrome.exe').VersionInfo.ProductVersion; (Get-Item 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe' -ErrorAction SilentlyContinue).VersionInfo.ProductVersion

Cleanup

powershell 
No cleanup required — read-only inventory query

Expected Telemetry

PowerShell script block logging (Event ID 4104) records version enumeration; file access telemetry on chrome.exe from EDR

Expected Detection

Triage step confirms host is running a vulnerable Chrome version; version string can be fed into asset management for bulk exposure scoping

Test 4 Simulate CFG Violation in Chrome GPU Process (Windows CFG Test)
windows

Uses the Windows CFGTest utility to simulate a Control Flow Guard violation within a Chrome GPU subprocess — the class of memory safety violation triggered by a Dawn UAF. Lab environment with CFG test tooling required.

Command

powershell 
$chromeGpu = Get-Process chrome | Where-Object {$_.MainWindowTitle -eq '' -and $_.Modules.Count -lt 10} | Select-Object -First 1; Write-Output "Target Chrome GPU PID: $($chromeGpu.Id)"; & 'C:\Tools\CFGTest\cfgtest.exe' --target-pid $chromeGpu.Id --simulate-violation

Cleanup

powershell 
Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue

Expected Telemetry

Windows Defender ATP generates ExploitGuardControlFlowGuardViolated event for chrome.exe; CFG violation logged in Windows Security event log

Expected Detection

KQL query on DeviceEvents table surfaces CFG violation for Chrome renderer/GPU process matching detection rule

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1203Exploitation for Client ExecutionT1055Process InjectionT1068Exploitation for Privilege Escalation

Same Tactic: Initial Access

Popular Detections