Google Chromium V8 Type Confusion (CVE-2026-85046) — Vulnerable Browser & Exploitation Activity

// CVE-2026-85046 — vulnerable Chromium/Chrome inventory + exploitation behavior
let SuspiciousChildren = dynamic(["powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"]);
// 1) Vulnerable-version inventory via file version telemetry
let VulnInventory = DeviceFileEvents
| where FileName in~ ("chrome.exe","msedge.exe")
| extend Ver = tostring(parse_json(AdditionalFields).FileVersion)
| where isnotempty(Ver)
| project Timestamp, DeviceName, FileName, Ver, ActionType, ReportId, InitiatingProcessAccountName;
// 2) Browser renderer spawning LOLBins (post-exploit)
let ExploitBehavior = DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe")
| where FileName in~ (SuspiciousChildren)
| where InitiatingProcessCommandLine has_any ("--type=renderer","--type=utility") or InitiatingProcessCommandLine !has "--type="
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId;
union VulnInventory, ExploitBehavior
| order by Timestamp desc

index=* (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") EventCode=1
| eval pproc=lower(parent_process_name), child=lower(process_name)
| where (pproc="chrome.exe" OR pproc="msedge.exe")
| where child IN ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as cmdlines by host, pproc, child, user
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where event.type == "start" and
  process.parent.name : ("chrome.exe", "msedge.exe", "chrome", "chromium") and
  process.name : ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","bash","sh","python3")

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "Process Name" AS proc, "Parent Process Name" AS pproc, "Command Line" AS cmd, username, DATEFORMAT(startTime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOWER("Parent Process Name") IN ('chrome.exe','msedge.exe') AND LOWER("Process Name") IN ('powershell.exe','cmd.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe') ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=*windows* OR _sourceCategory=*sysmon* "EventID=1"
| json auto nodrop
| where toLowerCase(parentImage) matches "*chrome.exe" or toLowerCase(parentImage) matches "*msedge.exe"
| where toLowerCase(image) matches /(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$/
| count by host, parentImage, image, user
| sort by _count

rule chrome_v8_type_confusion_cve_2026_85046 {
  meta:
    author = "Argus"
    description = "Chromium browser spawning LOLBins - CVE-2026-85046 V8 type confusion exploitation"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(chrome|msedge)\.exe$`)
    re.regex($e.target.process.file.full_path, `(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe$`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome|msedge)\.exe/
| ImageFileName=/(?i)\\(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin)\.exe/
| groupBy([ComputerName, ParentBaseFileName, ImageFileName, UserName], function=count())
| sort(_count, order=desc)