CVE-2026-85046: Chromium V8 Zero-Day Added to CISA KEV — Chrome Detection and Emergency Patching Guide

---
title: Chromium Browser Spawning Suspicious Child Process - Potential CVE-2026-85046 Post-Exploitation
id: 8f2e4b61-7c3d-4a9e-b5f1-2d8c6e4a9b3f
status: experimental
description: Detects Chrome, Edge, or other Chromium-based browsers spawning command shells, script interpreters, or LOLBins — a strong indicator of successful browser exploitation leading to sandbox escape and code execution, consistent with post-exploitation following CVE-2026-85046 V8 compromise.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate browser extensions or enterprise tooling invoking scripts
  - Software deployment tools wrapped in browser download handlers
level: high
---
title: Executable Dropped by Chromium Browser Process Outside Standard Download Flow
id: 3c7a9f25-1e8b-4d62-c4a7-9f3b5d1e8a26
status: experimental
description: Detects a Chromium-based browser process writing executable or script files to suspicious user-writable locations such as Temp, AppData, or ProgramData — consistent with payload staging after a V8 renderer compromise such as CVE-2026-85046.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.vbs'
      - '.js'
      - '.hta'
  filter_downloads:
    TargetFilename|contains:
      - '\Downloads\'
  condition: selection_source and selection_path and selection_ext and not filter_downloads
falsepositives:
  - Browser self-update mechanisms writing to AppData (verify against Google Update / Edge Update process trees)
  - Legitimate extension installations
level: medium
---
title: Chromium Renderer Process Establishing Unusual Network Connection
id: 5b1d8e74-2a6c-4f39-d8e2-7c4a1b9f5e38
status: experimental
description: Detects Chromium renderer or utility processes making outbound network connections to rare external hosts. A renderer compromise via CVE-2026-85046 may be followed by C2 communication directly from the compromised browser process before a full payload is staged.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_renderer:
    CommandLine|contains:
      - '--type=renderer'
      - '--type=utility'
  filter_common:
    DestinationHostname|contains:
      - '.google.com'
      - '.gstatic.com'
      - '.googleapis.com'
      - '.googlevideo.com'
      - '.microsoft.com'
      - '.windows.net'
      - '.akamaized.net'
      - '.cloudflare.com'
  condition: selection_image and selection_renderer and not filter_common
falsepositives:
  - Renderer processes legitimately load third-party content from diverse domains — tune with a frequency baseline; alert on connections to newly observed or low-prevalence destinations only
level: low

// Hunt 1: Chromium browsers spawning suspicious child processes (post-exploitation behavior)
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "vivaldi.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 2: Browser processes writing executables/scripts to suspicious staging paths
DeviceFileEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "vivaldi.exe")
| where FolderPath has_any ("\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\", "\\Users\\Public\\")
| where FolderPath !has "\\Downloads\\"
| where FileName endswith_any (".exe", ".dll", ".ps1", ".bat", ".vbs", ".js", ".hta")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256
| order by TimeGenerated desc

// Hunt 3: Fleet exposure — enumerate installed Chrome versions to identify unpatched endpoints
// Compare detected versions against the fixed build in Google's stable channel advisory
DeviceTvmSoftwareInventory
| where SoftwareName has_any ("google chrome", "microsoft edge")
| summarize Devices = dcount(DeviceId), DeviceList = make_set(DeviceName, 50) by SoftwareName, SoftwareVersion
| order by SoftwareName asc, SoftwareVersion asc

-- Hunt: Chromium browser processes spawning suspicious child processes
-- Indicator of post-exploitation following V8 renderer compromise (CVE-2026-85046)
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       get_item(field=pslist(pid=Ppid), member='Exe') AS ParentExe,
       get_item(field=pslist(pid=Ppid), member='CommandLine') AS ParentCommandLine
FROM pslist()
WHERE (Exe =~ '(?i)\\\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|certutil|bitsadmin)\.exe$')
  AND ParentExe =~ '(?i)\\\\(chrome|msedge|brave|opera|vivaldi)\.exe$'

# CVE-2026-85046 — Chromium V8 Patch Verification & Enforcement
# Run as SYSTEM/admin via RMM, Intune, or GPO.
# IMPORTANT: Set $MinChromeVersion to the FIXED build from Google's stable channel advisory.

$MinChromeVersion = [version]"0.0.0.0"   # <-- Replace with the fixed version from https://chromereleases.googleblog.com/
$MinEdgeVersion   = [version]"0.0.0.0"   # <-- Replace with the fixed Edge build from Microsoft's Security Update Guide

function Get-BrowserVersion {
    param([string]$Path)
    if (Test-Path $Path) { return (Get-Item $Path).VersionInfo.ProductVersion }
    return $null
}

$chromePaths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
$edgePaths = @(
    "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe",
    "$env:ProgramFiles\Microsoft\Edge\Application\msedge.exe"
)

$results = @()
foreach ($p in $chromePaths) {
    $v = Get-BrowserVersion -Path $p
    if ($v) { $results += [pscustomobject]@{ Browser = 'Chrome'; Path = $p; Version = [version]$v } }
}
foreach ($p in $edgePaths) {
    $v = Get-BrowserVersion -Path $p
    if ($v) { $results += [pscustomobject]@{ Browser = 'Edge'; Path = $p; Version = [version]$v } }
}

$nonCompliant = $false
foreach ($r in $results) {
    $min = if ($r.Browser -eq 'Chrome') { $MinChromeVersion } else { $MinEdgeVersion }
    if ($r.Version -lt $min) {
        Write-Output "[NON-COMPLIANT] $($r.Browser) $($r.Version) at $($r.Path) — below required $min"
        $nonCompliant = $true
    } else {
        Write-Output "[COMPLIANT] $($r.Browser) $($r.Version)"
    }
}

if ($nonCompliant) {
    # Trigger Google Update and Edge update tasks to accelerate patching
    Get-ScheduledTask | Where-Object { $_.TaskName -match 'GoogleUpdate|MicrosoftEdgeUpdate' } |
        ForEach-Object { Start-ScheduledTask -TaskName $_.TaskName -ErrorAction SilentlyContinue }
    Write-Output "[ACTION] Update tasks triggered. Re-run this script after update cycle completes."
    exit 1
} else {
    Write-Output "[PASS] All detected Chromium browsers meet the patched baseline for CVE-2026-85046."
    exit 0
}

# Additionally: audit WebView2 and Electron exposure — these embed the same V8 engine
Get-ChildItem "$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:LOCALAPPDATA" -Recurse -Filter "msedgewebview2.exe" -ErrorAction SilentlyContinue -Depth 4 |
    ForEach-Object { Write-Output "[WEBVIEW2] $($_.FullName) — Version: $($_.VersionInfo.ProductVersion)" }