CVE-2026-85046 Splunk · SPL

Detect Google Chromium V8 Type Confusion (CVE-2026-85046) — Vulnerable Browser & Exploitation Activity in Splunk

Detects the presence of vulnerable Google Chromium/Chrome (V8 JavaScript engine) versions affected by CVE-2026-85046, a type confusion vulnerability (CWE-843) in V8, and associated post-exploitation behaviors. This flaw is exploited in the wild (CISA KEV) and can lead to arbitrary code execution / renderer sandbox escape chains when a victim visits a malicious page. Detection combines vulnerable-version inventory signals with browser-spawned suspicious child process activity, unexpected renderer crashes, and anomalous outbound connections characteristic of V8 type-confusion exploitation.

MITRE ATT&CK

Tactic
Execution Initial Access

SPL Detection Query

Splunk (SPL)
spl 
index=* (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") EventCode=1
| eval pproc=lower(parent_process_name), child=lower(process_name)
| where (pproc="chrome.exe" OR pproc="msedge.exe")
| where child IN ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as cmdlines by host, pproc, child, user
| convert ctime(firstTime) ctime(lastTime)
| sort - count
high severity medium confidence

Finds Chromium-based browsers spawning suspicious LOLBin children, a behavioral proxy for CVE-2026-85046 exploitation. Pair with a version-inventory lookup to confirm the browser is unpatched.

Data Sources

Sysmon Process Creation (EventCode 1)Windows Endpoint Telemetry

Required Sourcetypes

WinEventLog:Microsoft-Windows-Sysmon/OperationalXmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Automated browser testing frameworks (Selenium/Puppeteer) launching shells
  • Corporate deployment agents triggering scripted post-install actions
  • Security tooling injecting into browser processes

Other platforms for CVE-2026-85046

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Chromium browser spawning PowerShell (Windows)

    Expected signal: Sysmon EventID 1 process create with parent chrome.exe and child cmd.exe/powershell.exe

  2. Test 2Simulate browser-spawned shell (Linux)

    Expected signal: Auditd/EDR process exec with parent 'chrome' and child 'bash'/'curl'

  3. Test 3Simulate browser-spawned scripting host (macOS)

    Expected signal: EndpointSecurity ES_EVENT_TYPE_NOTIFY_EXEC with Chrome-named parent spawning zsh/osascript

Last updated: 2026-09-05 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected endpoint's Chrome/Edge (Chromium) version and compare it against the fixed Stable channel build referenced in the Chrome Releases advisory (2026-09) — versions prior to the patch are vulnerable to CVE-2026-85046.
  2. Review the alerting browser process tree: identify whether a renderer/utility child process spawned the LOLBin and capture the full command line and initiating URL/tab where available.
  3. Check for concurrent renderer crashes or GPU/utility process termination events around the alert time, a common artifact of V8 type-confusion exploitation.
  4. Determine the user context and whether the browsing session involved untrusted or newly-registered domains.

Containment

  1. Isolate the affected host from the network if a browser-spawned LOLBin executed unexpected code or reached external infrastructure.
  2. Force-deploy the patched Chromium/Chrome/Edge build via management tooling (Intune/SCCM/Workspace) and restart the browser to close the vulnerable window.
  3. Block identified malicious domains/IPs at the proxy and disable the offending browser extensions if implicated.

Evidence Collection

  1. Capture browser version, installed extensions, and the process tree (parent renderer + child LOLBin) with full command lines.
  2. Collect memory/crash dumps from crashed renderer processes and any dropped files in the user's Downloads/Temp directories.
  3. Preserve proxy/DNS logs for the session and the browser history/cache for the timeframe of the alert.

Escalation Criteria

  • !Escalate to IR if a browser-spawned process achieved persistence, executed encoded/obfuscated commands, or established C2 connections.
  • !Escalate to organization-wide response if multiple endpoints show the same exploitation pattern or if the vulnerable version is widespread and unpatched, given active KEV exploitation.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Chromium renderer crash dumps and Reporting/Crashpad database entries
  • >Browser version metadata (chrome.exe FileVersion), history/cache, and extension inventory
  • >Child process command lines and any dropped payloads in Temp/Downloads

Tuning Guidance

Baseline expected browser child processes in your environment (automation frameworks, managed deployment agents) and exclude those signed, known-good chains. Prioritize alerts where the child process command line contains encoded content, network utilities, or references to unusual paths, and where the browser version is confirmed unpatched.

Hunting Queries

Hunt for any Chromium browser spawning interpreter/LOLBin children across the estate to find exploitation attempts of CVE-2026-85046.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe") | where FileName in~ ("powershell.exe","cmd.exe","rundll32.exe","regsvr32.exe","mshta.exe") | summarize count() by DeviceName, FileName, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (parent_process_name=chrome.exe OR parent_process_name=msedge.exe) | stats count by host, process_name, parent_process_name

Atomic Red Team Tests

Test 1 Simulate Chromium browser spawning PowerShell (Windows)
windows

Launches PowerShell as a child of a process renamed to chrome.exe to emulate browser-spawned LOLBin behavior for detection validation.

Command

powershell 
copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe %TEMP%\chrome.exe && %TEMP%\chrome.exe -NoProfile -Command "Start-Process cmd.exe -ArgumentList '/c whoami'"

Cleanup

powershell 
del %TEMP%\chrome.exe

Expected Telemetry

Sysmon EventID 1 process create with parent chrome.exe and child cmd.exe/powershell.exe

Expected Detection

KQL/SPL rules flag a Chromium-named parent spawning a LOLBin child

Test 2 Simulate browser-spawned shell (Linux)
linux

Creates a chromium-named wrapper that spawns bash to emulate post-exploitation on Linux endpoints.

Command

bash 
cp /bin/bash /tmp/chrome && /tmp/chrome -c 'id; curl -s http://127.0.0.1 || true'

Cleanup

bash 
rm -f /tmp/chrome

Expected Telemetry

Auditd/EDR process exec with parent 'chrome' and child 'bash'/'curl'

Expected Detection

Elastic EQL / Chronicle rules match Chromium-parented shell execution

Test 3 Simulate browser-spawned scripting host (macOS)
macos

Emulates a Chromium browser spawning a shell/osascript child on macOS for detection coverage validation.

Command

bash 
cp /bin/zsh /tmp/Google\ Chrome && /tmp/Google\ Chrome -c 'id; osascript -e "do shell script \"whoami\""'

Cleanup

bash 
rm -f '/tmp/Google Chrome'

Expected Telemetry

EndpointSecurity ES_EVENT_TYPE_NOTIFY_EXEC with Chrome-named parent spawning zsh/osascript

Expected Detection

EDR process-lineage rule flags Chromium browser spawning scripting host

Related Detections

Tactic Hubs

TA0002ExecutionTA0001Initial Access

Related Techniques

T1203Exploitation for Client ExecutionT1189Drive-by Compromise

Same Tactic: Execution

Popular Detections