CVE-2026-85046: Actively Exploited Chrome V8 Type Confusion — Detection, Hunting, and Remediation Guide

---
title: Chromium-Based Browser Spawning Command Interpreter or Script Host
id: 3f8a2c14-7b9e-4d51-a6c2-8e1f5b9d3a47
status: experimental
description: Detects Chrome, Edge, or other Chromium browsers spawning command interpreters, script hosts, or LOLBins — a strong indicator of renderer compromise and sandbox escape associated with V8 exploitation such as CVE-2026-85046.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/04
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser extensions or helpdesk tooling that shell out from the browser
level: high
---
title: Chromium Browser Writing Executable Content to User-Writable Directories
id: 9c1d7e52-4a3b-48f6-b2d1-6e5c8a0f2b93
status: experimental
description: Detects Chromium-based browser processes writing PE executables or scripts to user-writable staging directories such as AppData, Temp, or Public — consistent with payload staging after a renderer exploit like CVE-2026-85046.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/09/04
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.js'
      - '.jse'
      - '.vbs'
      - '.hta'
      - '.bat'
      - '.ps1'
  filter_downloads:
    TargetFilename|contains: '\Downloads\'
  condition: selection_image and selection_path and selection_ext and not filter_downloads
falsepositives:
  - Browser updater components (typically write to Program Files or Google\Update paths, not user Temp)
  - Legitimate extension installs (constrain to PE files to reduce noise)
level: medium
---
title: Chromium Renderer Process Crash Followed by Suspicious Child Process
id: 5b2e9f38-1c7d-43a4-9e62-4d8b6f1a7c05
status: experimental
description: Detects WerFault or crashpad_handler activity referencing a Chromium browser shortly followed by the browser spawning an unusual child process — a potential indicator of failed or partial exploitation attempts against V8 (CVE-2026-85046).
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/09/04
tags:
  - attack.exploitation_for_client_execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\WerFault.exe'
      - '\crashpad_handler.exe'
    CommandLine|contains:
      - 'chrome'
      - 'msedge'
  condition: selection
falsepositives:
  - Normal renderer crashes from buggy extensions or heavy pages — correlate with subsequent browser child-process activity and repeated crashes on the same host before escalating
level: low

// Hunt 1: Chromium browser spawning suspicious child processes (renderer compromise indicator)
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","bitsadmin.exe","certutil.exe","schtasks.exe","rundll32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","brave.exe","opera.exe","vivaldi.exe")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt 2: Exposure check — identify hosts with outdated Chrome installations
DeviceProcessEvents
| where TimeGenerated > ago(2d)
| where FileName =~ "chrome.exe"
| summarize LastSeen = max(TimeGenerated), Versions = make_set(ProcessVersionInfoProductVersion, 20) by DeviceName
| order by DeviceName asc;

// Hunt 3: Browser process writing executables/scripts to user-writable staging paths
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe")
| where FolderPath has_any ("\\AppData\\Local\\Temp\\","\\AppData\\Roaming\\","\\Users\\Public\\")
| where FolderPath !has "\\Downloads\\"
| where FileName endswith_any (".exe",".dll",".js",".vbs",".hta",".bat",".ps1")
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessCommandLine
| order by TimeGenerated desc;

-- Hunt for Chromium browser processes with suspicious child processes (CVE-2026-85046 post-exploitation triage)
LET browsers = SELECT Pid, Name, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)chrome|msedge|brave|opera|vivaldi'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|wmic\.exe|bitsadmin\.exe|certutil\.exe'

SELECT suspicious_children.Pid AS ChildPid,
       suspicious_children.Name AS ChildName,
       suspicious_children.CommandLine AS ChildCommandLine,
       suspicious_children.Username AS ChildUser,
       suspicious_children.CreateTime AS ChildStartTime,
       browsers.Name AS ParentBrowser,
       browsers.Exe AS ParentPath
FROM suspicious_children
JOIN browsers ON suspicious_children.Ppid = browsers.Pid

# CVE-2026-85046 verification script - audits Chromium browser versions fleet-wide
# Run as SYSTEM or elevated admin. Extend $MinimumChromeVersion to the patched build per the Chrome advisory.

$MinimumChromeVersion = [version]"140.0.0.0"   # UPDATE: set to the fixed build from Google's stable channel advisory
$results = @()

# --- Check installed Chrome version (64-bit and 32-bit registry hives) ---
$chromePaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
$chrome = Get-ItemProperty $chromePaths -ErrorAction SilentlyContinue |
          Where-Object { $_.DisplayName -like "Google Chrome*" } |
          Select-Object -First 1

if ($chrome) {
    $installedVersion = [version]($chrome.DisplayVersion)
    $status = if ($installedVersion -lt $MinimumChromeVersion) { "VULNERABLE - UPDATE REQUIRED" } else { "Patched" }
    $results += [pscustomobject]@{
        Product  = "Google Chrome"
        Version  = $installedVersion
        Status   = $status
        Host     = $env:COMPUTERNAME
    }
    if ($installedVersion -lt $MinimumChromeVersion) {
        Write-Warning "Chrome $installedVersion is below the patched baseline. Triggering update check..."
        # Kick Google Update if present
        $updateTask = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*" }
        if ($updateTask) { $updateTask | Start-ScheduledTask }
    }
} else {
    $results += [pscustomobject]@{ Product = "Google Chrome"; Version = "Not Installed"; Status = "N/A"; Host = $env:COMPUTERNAME }
}

# --- Check running chrome.exe file version (catches portable/enterprise installs) ---
$runningChrome = Get-Process chrome -ErrorAction SilentlyContinue | Select-Object -First 1
if ($runningChrome) {
    $fileVersion = [version]($runningChrome.MainModule.FileVersionInfo.ProductVersion -replace '[^\d\.].*$','')
    $results += [pscustomobject]@{
        Product  = "Chrome (running process)"
        Version  = $fileVersion
        Status   = if ($fileVersion -lt $MinimumChromeVersion) { "RUNNING VULNERABLE BUILD - restart browser after update" } else { "Patched" }
        Host     = $env:COMPUTERNAME
    }
}

# --- Check Edge version ---
$edgeExe = "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe"
if (Test-Path $edgeExe) {
    $edgeVersion = [version]((Get-Item $edgeExe).VersionInfo.ProductVersion)
    $results += [pscustomobject]@{
        Product = "Microsoft Edge"
        Version = $edgeVersion
        Status  = "Verify against Edge stable channel - V8 inherits Chromium exposure"
        Host    = $env:COMPUTERNAME
    }
}

$results | Format-Table -AutoSize
# Export for central collection:
# $results | Export-Csv "\\your-share\chrome-audit\$env:COMPUTERNAME.csv" -NoTypeInformation