CVE-2026-87491 Elastic Security · Elastic

Detect Google Chromium V8 Out-of-Bounds Write (CVE-2026-87491) — Exploitation & Unpatched Exposure in Elastic Security

Detects exploitation indicators and unpatched exposure for CVE-2026-87491, a KEV-listed out-of-bounds write (CWE-787) in Google Chromium's V8 JavaScript engine. Successful exploitation of this memory-corruption zero-day allows arbitrary code execution in the renderer process, typically chained with a sandbox escape for full host compromise. Because no CVSS or fixed-version list was published in the correlated intel, detection focuses on observable exploitation behavior: Chrome/Chromium renderer processes crashing or spawning anomalous child processes, browser processes performing unusual code execution or network activity, and endpoint software inventory reporting Chromium builds older than the emergency Stable channel update released 2026-09-09. Maps to drive-by/exploitation-for-client-execution activity.

MITRE ATT&CK

Tactic
Initial Access Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
process where event.type == "start" and
  process.parent.name in~ ("chrome.exe","msedge.exe","brave.exe","chromium.exe","opera.exe") and
  process.parent.command_line : ("*--type=renderer*","*--type=utility*","*--type=gpu-process*") and
  process.name in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe")
high severity medium confidence

Elastic EQL sequence matching Chromium renderer/utility children that are shells or LOLBins, a post-exploitation signal for the V8 OOB-write CVE-2026-87491.

Data Sources

Elastic DefendWindows process events

Required Tables

logs-endpoint.events.process-*

False Positives & Tuning

  • Headless browser automation launching child processes
  • Legitimate enterprise browser management workflows
  • Security or QA tooling driving the browser programmatically

Other platforms for CVE-2026-87491

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Chromium renderer spawning a shell

    Expected signal: Sysmon EventID 1 / EDR process-creation event showing a chrome.exe parent with a --type=renderer command line spawning cmd.exe.

  2. Test 2Simulate renderer-spawned PowerShell download cradle

    Expected signal: Process-creation telemetry showing chrome.exe (renderer) parent launching powershell.exe.

  3. Test 3Enumerate installed Chromium version for exposure check

    Expected signal: Process execution recording the browser version string; software-inventory collectors report the installed Chromium build.

Last updated: 2026-09-10 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the alerting host runs a Chromium-family browser and check its exact version against the emergency Stable channel update released 2026-09-09 (chromereleases.googleblog.com); versions older than that build are exposed to CVE-2026-87491.
  2. Examine the parent browser command line to confirm the child process originated from a sandboxed renderer/utility process (--type=renderer/--type=utility) rather than the main browser process.
  3. Review the child process command line and subsequent process tree for encoded PowerShell, download cradles, or LOLBin abuse indicating hands-on-keyboard follow-through.
  4. Correlate the user's recent browsing/proxy history for a suspicious or newly-registered site delivering the malicious V8 payload (drive-by).

Containment

  1. Isolate the affected endpoint from the network via EDR to prevent sandbox-escape follow-on and lateral movement.
  2. Force-deploy the patched Chromium/Chrome/Edge build to the host and organization-wide, and disable or block the offending browser version until updated.

Evidence Collection

  1. Capture the full process tree, command lines, and loaded modules for the browser and all child processes.
  2. Collect Chrome/Chromium crash dumps (chrome_debug.log, minidumps under the user Crashpad directory) and browser history/cache for the exploiting URL, plus relevant Sysmon/EDR telemetry.

Escalation Criteria

  • !Escalate to incident response if the renderer child process executed code, established C2, or achieved persistence — indicating a successful sandbox escape.
  • !Escalate if multiple hosts show the same browser exploitation pattern or if the delivery URL is confirmed malicious, indicating a targeted campaign against the org.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Chromium crash minidumps and chrome_debug.log under the user's Crashpad/Crash Reports directory
  • >Browser history, cache, and Network Service logs showing the exploiting URL
  • >Sysmon/EDR process-creation records linking a --type=renderer parent to shell/LOLBin children
  • >Installed-software inventory recording the vulnerable Chromium build version

Tuning Guidance

Baseline legitimate renderer-spawned child processes in your environment (browser automation, managed extensions, print/PDF helpers) and add them to an allowlist to reduce noise. Prioritize the software-inventory version check for exposure management and reserve the behavioral process-tree rules for high-severity alerting, since renderer processes rarely spawn shells or LOLBins under normal use.

Hunting Queries

Baselines which child processes are spawned from Chromium renderer processes so anomalous shells/LOLBins stand out for hunting CVE-2026-87491 exploitation.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ('chrome.exe','msedge.exe','brave.exe','chromium.exe') | where InitiatingProcessCommandLine has '--type=renderer' | summarize count() by FileName, DeviceName | order by count_ desc
Hunting — SPL
spl 
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentCommandLine="*--type=renderer*" | stats count by Image, host | sort - count

Identifies hosts running Chromium builds older than the 2026-09-09 fix that remain exposed to CVE-2026-87491.

Hunting — KQL
kql 
DeviceTvmSoftwareInventory | where SoftwareName has_any ('chrome','edge','chromium') | project DeviceName, SoftwareName, SoftwareVersion | order by SoftwareVersion asc
Hunting — SPL
spl 
| inputlookup software_inventory | search product="*Chrome*" OR product="*Chromium*" OR product="*Edge*" | table host, product, version | sort version

Atomic Red Team Tests

Test 1 Simulate Chromium renderer spawning a shell
windows

Launches cmd.exe with a parent command line mimicking a Chromium renderer process to validate the process-tree detection logic (does not exploit V8).

Command

powershell 
copy C:\Windows\System32\cmd.exe %TEMP%\chrome.exe & "%TEMP%\chrome.exe" /c "cmd.exe /c echo renderer-child-test --type=renderer"

Cleanup

powershell 
del %TEMP%\chrome.exe

Expected Telemetry

Sysmon EventID 1 / EDR process-creation event showing a chrome.exe parent with a --type=renderer command line spawning cmd.exe.

Expected Detection

Behavioral KQL/SPL/EQL rules fire on the renderer-parent-to-shell relationship.

Test 2 Simulate renderer-spawned PowerShell download cradle
windows

Emulates post-exploitation follow-on by having a renamed chrome.exe (renderer) launch PowerShell in a lab, testing LOLBin detection.

Command

powershell 
copy C:\Windows\System32\cmd.exe %TEMP%\chrome.exe & "%TEMP%\chrome.exe" /c "powershell.exe -NoProfile -Command Write-Output 'v8-oob-test --type=renderer'"

Cleanup

powershell 
del %TEMP%\chrome.exe

Expected Telemetry

Process-creation telemetry showing chrome.exe (renderer) parent launching powershell.exe.

Expected Detection

LOLBin/shell child detection rules alert on renderer-spawned PowerShell.

Test 3 Enumerate installed Chromium version for exposure check
linux

Reads the installed Chrome/Chromium version to validate the software-inventory exposure hunt for CVE-2026-87491.

Command

bash 
google-chrome --version || chromium --version || chromium-browser --version

Cleanup

bash 
true

Expected Telemetry

Process execution recording the browser version string; software-inventory collectors report the installed Chromium build.

Expected Detection

Version-based exposure hunt flags builds older than the 2026-09-09 emergency Stable channel update.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1189Drive-by CompromiseT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Initial Access

Popular Detections