CVE-2026-11645 — Chromium V8 Out-of-Bounds Read/Write RCE Zero-Day
An out-of-bounds read AND write in V8, Chrome's JavaScript/WebAssembly engine. A crafted HTML page yields arbitrary code execution inside the browser renderer/sandbox. Exploit confirmed in the wild; CISA KEV 2026-06-09. Fixed in Chrome 149.0.7827.102/.103. This is a Falcon-side endpoint hunt for post-exploitation from a browser parent plus a vulnerable-version inventory. Defensive hunt & harden pack — no exploit code.
01
Executive Summary
CVE-2026-11645 is an out-of-bounds read and write in V8, the JavaScript/WebAssembly engine shared by Chrome and every Chromium-based browser. An attacker who convinces a user to open a specially crafted HTML page can corrupt V8 heap memory — reading sensitive data from the renderer's address space and manipulating objects/pointers to redirect execution — resulting in arbitrary code execution inside the browser renderer (sandboxed) context. CVSS 8.8 (high). No interaction beyond normal browsing is required.
Google confirmed that "an exploit for CVE-2026-11645 exists in the wild" and withheld technical specifics to give users time to patch. CISA added it to the KEV catalog on 2026-06-09. It is the fifth actively exploited Chrome zero-day of 2026 (joining CVE-2026-2441, -3909, -3910, -5281). It was reported on 2026-04-27 by researcher 303f06e3 for a $55,000 bounty. Google fixed it in Stable 149.0.7827.102/.103 (Windows/macOS) and 149.0.7827.102 (Linux); Edge, Brave, Opera and Vivaldi inherit the V8 flaw and must be moved to a build based on Chromium 149.0.7827 or later.
This pack hunts endpoints that run Falcon. The renderer compromise itself happens in-process and is largely invisible to EDR, so the durable, high-fidelity signal is what the browser does next: a chrome.exe / msedge.exe / brave.exe process (or a renderer child) spawning a shell or LOLBin, writing an executable to disk, or beaconing to new infrastructure. The pack pairs those behavioral hunts with a vulnerable-browser-version inventory hunt — the patch is the fix.
⚠ Defender priority: (1) Push the Chrome/Edge update fleet-wide and verify versions ≥ the fixed builds (Q6 + N3) — patching closes the vuln. (2) Until verified, the highest-fidelity hunt is Q1 — a browser process spawning
cmd/powershell/wscript/rundll32/mshta. There is almost no benign reason for Chrome to parent a shell. Escalate any hit and pivot to Q3 (browser writing a PE) and Q4 (post-exploit C2) on the same host.02
Source Review & Web Hunter Notes
| Tier | Source | Key Finding | Carry |
|---|---|---|---|
| 1 · News of record | The Hacker News — "Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild" | OOB read/write in V8; CVSS 8.8; exploit ITW; fixed 149.0.7827.102/.103; reporter 303f06e3 ($55k); 5th 0-day of 2026 (CVE-2026-2441/-3909/-3910/-5281) | yes |
| 2 · Vendor research | SOCRadar — CVE-2026-11645 blog | Mechanism (read process memory / redirect execution); attack chain = crafted HTML page; in-sandbox RCE; detection guidance (anomalous browser children, post-browse beacons, browser crashes); no public IOCs | yes |
| 2 · Vendor research | SOC Prime / Cyber Security News — Chromium 0-day | Heap corruption → info disclosure / crash; affects all Chromium browsers; patch-now guidance | yes |
| 1 · Government | CISA KEV — added 2026-06-09 | Confirms active exploitation; BOD 22-01 remediation timeline applies to federal/critical infra | yes |
| 2 · News | BleepingComputer / Help Net Security / Security Affairs | "Fifth Chrome zero-day of 2026"; affected/fixed builds per OS; Edge/Brave/Opera/Vivaldi exposure | yes |
Decisions: Google withheld exploit specifics and no atomic IOCs (hashes/domains) are published, so the pack is behavior-keyed, not IOC-keyed — anchor on browser-parented anomalous execution, browser-written executables, and post-exploit egress. Lead with the patch (the fix) and a version-inventory hunt. The renderer OOB primitive is invisible to EDR by design, so we hunt the consequences of a successful exploit chain on the endpoint. Treat Edge/Brave/Opera/Vivaldi as in-scope alongside Chrome.
03
Hunt Brief & Attack Chain
Working hypothesis: A user is lured to (or a compromised/malvertised site serves) a crafted HTML page; V8 JavaScript/WASM triggers the OOB read/write, corrupting the renderer heap to achieve code execution inside the renderer sandbox. The attacker then either stays in-renderer (credential/session theft, recon) or chains a sandbox/OS escape and lands post-exploitation tooling on the host. EDR telemetry begins where the browser interacts with the OS — child processes, file writes, and network egress.
| Step | Behavior | Telemetry | Hunt Angle |
|---|---|---|---|
| 1 · Lure / delivery | User visits crafted/compromised/malvertised HTML page | DnsRequest, NetworkConnectIP4 | Q4 (egress to new infra); proxy/DNS (N4) |
| 2 · V8 OOB trigger | Crafted JS/WASM corrupts renderer heap (in-process) | – (largely invisible to EDR) | GAP renderer-internal; watch for renderer crash loops (N2) |
| 3 · In-sandbox RCE | Arbitrary code in renderer context (info theft, recon) | ProcessRollup2 (renderer flags) | Q5 (renderer abnormal exit / restart storm) |
| 4 · Sandbox / host escape | Chain to OS code execution → LOLBin / shell launch | ProcessRollup2 | Q1 browser→shell; Q2 renderer→child |
| 5 · Payload to disk | Browser parent writes an executable / script | PeFileWritten, NewExecutableWritten | Q3 |
| Post · C2 / persist | Beacon to attacker infra; scheduled task / run-key | NetworkConnectIP4, ScheduledTaskRegistered, RegGenericValueUpdate | Q4; Containment §14 |
Hunt hypotheses (fidelity-ordered)
- H1 (high): A browser process directly spawns an interactive shell or scripting host → Q1. Near-zero benign baseline.
- H2 (high): A browser renderer child (sandboxed,
--type=renderer) is the parent of a non-browser executable → Q2. Renderers are heavily sandboxed and should never spawn arbitrary children. - H3 (high): A browser process writes a PE/script to a user-writable path then it executes → Q3.
- H4 (medium): A browser process makes an outbound connection to newly-seen / rare external infrastructure shortly after a browse event → Q4.
- H5 (medium): Repeated abnormal renderer exits / crash-restart storms consistent with exploit attempts (success or failure) → Q5.
- H6 (high): Endpoints still running a Chromium browser below the fixed build → Q6 (the inventory hunt; patch is the fix).
04
Consolidated IOC Table
No atomic IOCs (hashes, domains, IPs) were published — Google withheld exploit specifics. The patch (Chrome/Chromium ≥ 149.0.7827.102) is the definitive control and the strongest detections are behavioral. Copy-ready blocks in §10.
| Type | Value | Conf | Action | Context |
|---|---|---|---|---|
| Version | Chrome < 149.0.7827.102 (Win/Lin) / .103 (Win/Mac) | high | detect | Vulnerable build — patch closes the flaw |
| Version | Edge / Brave / Opera / Vivaldi < Chromium 149.0.7827 | high | detect | Same V8 engine — inherits the OOB flaw |
| Behavior | chrome.exe / msedge.exe / brave.exe → cmd/powershell/wscript/rundll32/mshta | high | detect | Post-exploit shell/LOLBin from a browser parent |
| Behavior | Renderer child (--type=renderer) spawning a non-browser process | high | detect | Sandbox escape / exploit follow-on |
| Behavior | Browser process writing a PE/script to %TEMP% / %LOCALAPPDATA% / Downloads then exec | high | hunt | Dropped payload from the renderer chain |
| Behavior | Renderer abnormal-exit / crash-restart storm | medium | hunt | Exploitation attempt indicator (success or fail) |
| CVE (family) | CVE-2026-2441 / -3909 / -3910 / -5281 | medium | enrich | Other actively-exploited 2026 Chrome 0-days; same patch hygiene |
05
Affected Surface & Telemetry Matrix
| Surface | Required Telemetry | Priority | Gap Risk |
|---|---|---|---|
| Endpoints running a Chromium browser below the fixed build | Installed-app / browser version inventory (InstalledApplication / module version) | Critical | Low — query version directly |
| Browser process lineage (escape / LOLBin) | Process tree + parent context (ProcessRollup2 / SyntheticProcessRollup2) | High | Low — standard sensor |
| Renderer child → process spawn | Parent CommandLine (--type=renderer) + child image | High | Low-Med — needs parent CommandLine retained |
| Browser-dropped executable | PE write w/ writing-process context (PeFileWritten) | High | Med — non-PE script drops not captured by PeFileWritten |
| Post-exploit egress / C2 | Outbound IP + DNS w/ process context (NetworkConnectIP4, DnsRequest) | Medium | Med — high browser-network baseline; needs newness/rarity scoping |
| V8 renderer OOB primitive (in-process) | None — in-renderer memory corruption | N/A | GAP — invisible to EDR; rely on consequences + patch |
06
ATT&CK Mapping
| Tactic | Technique | Observed Behavior | Query / Control |
|---|---|---|---|
| Initial Access | T1189 — Drive-by Compromise | Crafted/compromised HTML page triggers V8 OOB on visit | Q4; N4; patch |
| Execution | T1203 — Exploitation for Client Execution | V8 OOB read/write → code execution in renderer | Q5; patch (Q6/N3) |
| Execution | T1059.001 / .003 / .005 — PowerShell / Cmd / VBScript | Browser parent spawns a shell or script host | Q1, Q2 |
| Defense Evasion | T1218 — System Binary Proxy Execution (rundll32 / mshta / regsvr32) | Browser parent proxies execution through a LOLBin | Q1, Q2 |
| Privilege Escalation / Defense Evasion | T1211 — Exploitation for Defense Evasion (sandbox escape) | Renderer child escapes its sandbox to spawn a process | Q2 |
| Command & Control | T1071.001 — Application Layer Protocol: Web | Browser-parented beacon to attacker infrastructure | Q4 |
| Persistence | T1547.001 / T1053.005 — Run Key / Scheduled Task | Post-exploit persistence written after browser RCE | Native N3; Containment §14 |
07
Native Audit-Log Hunts
| Hunt | Source | Logic | Response |
|---|---|---|---|
| N1 · Browser version inventory | Intune / SCCM / Jamf / winget / chrome://version | Enumerate installed Chrome/Edge/Brave/Opera/Vivaldi builds; flag any below the fixed Chromium 149.0.7827 | Force update; the definitive fix (mirrors Q6) |
| N2 · Renderer crash storm | Windows App Error / WER, chrome.exe crash dumps, Crashpad | Repeated renderer (--type=renderer) crashes on a host within a short window | Possible exploit attempt; collect crash dump, correlate Q5 |
| N3 · Persistence after browse | Sysmon EID 11/13, autoruns, Run keys, Scheduled Tasks | New run-key / task / startup item created shortly after a browser RCE indicator | Investigate; pairs with Q1–Q3 on same host |
| N4 · Drive-by infra | Secure web gateway / proxy / DNS logs | Browse to newly-registered / low-reputation / malvertising domains preceding anomalous browser behavior | Block category; enrich Q4 hits |
| N5 · Edge/Chrome enterprise policy | GPO / Intune browser policy export | Confirm auto-update enabled and not disabled by policy; confirm component updates allowed | Re-enable auto-update; the patch must actually land |
08
CrowdStrike LogScale CQL Hunt Queries
Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.
Field names validated against the Falcon event reference; process hunts include
SyntheticProcessRollup2. The V8 OOB primitive is invisible to EDR — these hunt the post-exploitation consequences on the endpoint plus a vulnerable-version inventory. Once browsers are confirmed ≥ 149.0.7827.102 fleet-wide (Q6/N1), keep Q1–Q3 as durable defense-in-depth for any browser-exploit chain.
Q1 · Browser process spawning a shell / script host / LOLBin
CONF HIGHFP LOWCOST LOW
Looks for: a Chromium browser as the direct parent of a shell, script host, or LOLBin. Accomplishes: catches the highest-fidelity post-exploit signal — browsers have almost no benign reason to spawn these.
// HUNT: Chromium browser spawning a shell / script host / LOLBin (CVE-2026-11645 post-exploit) // MITRE: T1203, T1059.001/.003/.005, T1218 | CONF: high FP: low COST: low // REQUIRES: ProcessRollup2 with ParentBaseFileName // FALSE POSITIVES: rare admin/enterprise extensions or browser-launched native messaging hosts // TUNING: allow-list known native-messaging host images per your fleet if any surface #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ParentBaseFileName=/^(chrome|msedge|brave|opera|vivaldi)\.exe$/i | FileName=/^(cmd|powershell|powershell_ise|pwsh|wscript|cscript|mshta|rundll32|regsvr32|bitsadmin|certutil|curl|installutil|msbuild)\.exe$/i | table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200) | sort(@timestamp, order=desc)
Q2 · Browser renderer child spawning a non-browser process (sandbox escape)
CONF HIGHFP LOW-MEDCOST LOW
Looks for: a sandboxed renderer (--type=renderer) that is the parent of a non-browser image. FP: browser self-spawns its own helpers (crashpad, utility, GPU) — excluded; validate child image set per browser version.
// HUNT: Browser renderer child spawning a non-browser process (sandbox escape follow-on) // MITRE: T1211, T1203 | CONF: high FP: low-med COST: low // REQUIRES: ProcessRollup2 with parent CommandLine (--type=renderer) retained // FALSE POSITIVES: browser-internal helper processes (crashpad / GPU / utility) // TUNING: child FileName!= the browser's own exe + known helper set below; add per-fleet helpers #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | ParentBaseFileName=/^(chrome|msedge|brave|opera|vivaldi)\.exe$/i | ParentCommandLine=/--type=renderer/i | FileName!=/^(chrome|msedge|brave|opera|vivaldi|crashpad_handler|chrome_crashpad_handler|identity_helper|elevation_service|notification_helper)\.exe$/i | table([@timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, SHA256HashData], limit=200) | sort(@timestamp, order=desc)
Q3 · Browser process writing an executable to disk
CONF HIGHFP MEDCOST LOW
Looks for: a Chromium browser as the writing process for a PE outside its own install/cache dirs. FP: ordinary user downloads land in Downloads — scope to executables in non-Downloads user-writable paths or correlate with Q1/Q2 on the same host.
// HUNT: Chromium browser writing a PE to a user-writable path (dropped payload) // MITRE: T1203, T1105 | CONF: high FP: medium COST: low // REQUIRES: PeFileWritten / NewExecutableWritten with ContextBaseFileName // FALSE POSITIVES: legitimate user downloads (installers) into \Downloads\ // TUNING: exclude \Downloads\; or correlate to a Q1/Q2 hit on the same aid before alerting #event_simpleName=/PeFileWritten|NewExecutableWritten/ | ContextBaseFileName=/^(chrome|msedge|brave|opera|vivaldi)\.exe$/i | TargetFileName=/\\(Users\\[^\\]+\\AppData\\Local\\Temp|ProgramData|Users\\Public)\\.+\.(exe|dll|scr|com)$/i | TargetFileName!=/\\(Users\\[^\\]+\\Downloads)\\/i | table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)
Q4 · Post-exploit egress from a browser parent to rare external infrastructure
CONF MEDFP MEDCOST MED
Looks for: outbound connections from a browser to external IPs, surfaced by rarity (least-common destinations across the fleet). FP: high — browsers talk to the internet constantly; use as a triage pivot scoped by rarity / new-infra, not a standalone alert.
// HUNT: Rare external egress from a browser parent (post-exploit C2 pivot) // MITRE: T1071.001, T1189 | CONF: medium FP: medium COST: medium // REQUIRES: NetworkConnectIP4 with ContextBaseFileName + RemoteAddressIP4 // FALSE POSITIVES: CDNs, ad/telemetry endpoints, legitimate rare sites // TUNING: exclude RFC1918; rank by rarity (count distinct hosts per RemoteAddressIP4); pivot from Q1-Q3 hosts #event_simpleName=NetworkConnectIP4 | ContextBaseFileName=/^(chrome|msedge|brave|opera|vivaldi)\.exe$/i | RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.|169\.254\.)/ | groupBy([RemoteAddressIP4, RemotePort], function=([count(ComputerName, distinct=true, as=hosts), count(aid, as=conns), collect([ComputerName])])) | sort(hosts, order=asc, limit=200)
Q5 · Browser renderer abnormal-exit / crash-restart storm
CONF MEDFP MEDCOST LOW
Looks for: a host with many short-lived renderer processes in a tight window — consistent with repeated exploit attempts (heap-grooming, success or failure). FP: heavy tab usage or a buggy site can also churn renderers — triage by burst tightness and pair with Q1–Q4.
// HUNT: Renderer crash/restart storm on a single host (exploitation attempt indicator) // MITRE: T1203 | CONF: medium FP: medium COST: low // REQUIRES: ProcessRollup2 renderer launches (--type=renderer) // FALSE POSITIVES: heavy multi-tab browsing; a single crashy website // TUNING: raise the threshold per your environment; correlate the burst with Q1-Q4 on same aid #event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ | FileName=/^(chrome|msedge|brave|opera|vivaldi)\.exe$/i | CommandLine=/--type=renderer/i | timeChart(span=10m, function=count(), series=ComputerName) | sort(_count, order=desc)
Q6 · Vulnerable Chromium browser version inventory (the fix)
CONF HIGHFP LOWCOST LOW
Looks for: Chrome/Edge/Brave/Opera/Vivaldi installs reporting a version below the fixed Chromium 149.0.7827 build. Accomplishes: the inventory hunt — patching is the definitive control. Note: field set depends on the AppInfo/InstalledApplication feed in your tenant — validate names before alerting.
// HUNT: Inventory Chromium browsers below the fixed build (CVE-2026-11645) // MITRE: T1203 (mitigation/visibility) | CONF: high FP: low COST: low // REQUIRES: InstalledApplication / AppInfo inventory feed (field names vary by tenant) // VERIFY: confirm AppName/AppVersion field names against your tenant data model #event_simpleName=/InstalledApplication/ | AppName=/(Google Chrome|Microsoft Edge|Brave|Opera|Vivaldi)/i | AppVersion=/^(?<maj>\d+)\.(?<min>\d+)\.(?<build>\d+)\.(?<patch>\d+)$/ | maj:=parseInt(maj) | build:=parseInt(build) | patch:=parseInt(patch) | test(maj < 149 OR (maj == 149 AND build < 7827) OR (maj == 149 AND build == 7827 AND patch < 102)) | table([ComputerName, AppName, AppVersion], limit=200) | sort(AppVersion, order=asc)
09
CrowdStrike Custom IOA Recommendations
| IOA Name | Field Patterns | Benign Exclusions | Deployment Path |
|---|---|---|---|
| Browser spawns shell/LOLBin | Parent Image *\(chrome|msedge|brave|opera|vivaldi).exe; Child cmd/powershell/wscript/cscript/mshta/rundll32/regsvr32.exe | Allow-list any sanctioned native-messaging host images | Endpoint Security → Custom IOA → Process Creation (Detect+Block) |
| Renderer child spawns process | Parent Image browser + Parent CommandLine *--type=renderer*; Child != browser/helper set | Browser-internal helpers (crashpad/GPU/utility) excluded | Custom IOA → Process Creation (Detect, then Block after baseline) |
| Browser writes PE outside Downloads | Writing Image browser; Target *\Temp\* / *\ProgramData\* / *\Public\* *.exe/.dll/.scr | Downloads dir excluded; correlate with the two IOAs above | Custom IOA → File Write (Detect / hunt) |
Q1 and Q2 are strong IOA promotions (near-zero benign baseline once helper images are excluded). Q3 promotes to Detect once the Downloads exclusion is validated. Q4/Q5 stay hunt/investigate-only due to FP risk.
10
Machine-Readable IOC Appendix
Grouped IOC Quick-Copy
No atomic IOCs were published — these are behavioral signatures, a version/patch audit (the fix), and the family CVE set. Use the CSV with REPLACE_WITH_ placeholders if your IR turns up campaign atomics.
Falcon IOC Management CSVbulk import
type,value,action,severity,expiration,description,tags sha256,REPLACE_WITH_PAYLOAD_SHA256,prevent,critical,2027-06-15,CVE-2026-11645 browser-dropped payload,campaign:Chromium-V8-OOB domain,REPLACE_WITH_DRIVEBY_DOMAIN,detect,high,2026-09-15,CVE-2026-11645 drive-by / exploit host,campaign:Chromium-V8-OOB ipv4,REPLACE_WITH_C2_IP,detect,high,2026-09-15,CVE-2026-11645 post-exploit C2,campaign:Chromium-V8-OOB
Behavioral Signaturesdetection logic
chrome/msedge/brave/opera/vivaldi.exe spawns cmd/powershell/wscript/cscript/mshta/rundll32/regsvr32 Browser renderer child (--type=renderer) spawning a non-browser, non-helper process (sandbox escape) Browser process writes a PE/script to %TEMP% / %ProgramData% / %Public% (outside \Downloads\) then it executes Browser-parented outbound connection to rare/newly-seen external infrastructure shortly after a browse event Renderer crash/restart storm on a single host within a tight window (exploit attempts)
Version / Patch Auditthe fix
# Fixed builds (CVE-2026-11645): Chromium 149.0.7827.102 (Win/Linux), .103 (Win/Mac) # Windows - read installed Chrome version: (Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion (Get-Item "$env:ProgramFiles (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion # Vulnerable if < 149.0.7827.102 (Win/Linux) or < 149.0.7827.103 (Win/Mac) # Force update: Chrome menu > Help > About Google Chrome > Relaunch (or push via Intune/SCCM/Jamf) # Edge/Brave/Opera/Vivaldi: update to a build based on Chromium >= 149.0.7827
Family CVEs / Notes2026 Chrome 0-days
CVE-2026-11645 # V8 out-of-bounds read/write (this pack) - fixed 149.0.7827.102/.103 - CISA KEV 2026-06-09 CVE-2026-2441 # earlier 2026 Chrome 0-day (exploited ITW) CVE-2026-3909 # earlier 2026 Chrome 0-day (exploited ITW) CVE-2026-3910 # earlier 2026 Chrome 0-day (exploited ITW) CVE-2026-5281 # earlier 2026 Chrome 0-day (exploited ITW) # Same hygiene closes all five: keep Chromium auto-update enabled + enforce restart in maintenance windows # Defense-in-depth: site isolation ON, JIT-less / V8 sandbox where feasible, block high-risk browse categories
11
Detection Validation Gates
| Gate | Check | Pass Criteria |
|---|---|---|
| Telemetry ready | Confirm ProcessRollup2 retains ParentBaseFileName + ParentCommandLine, and PeFileWritten carries ContextBaseFileName | Fields populated fleet-wide for browser processes |
| Benign baseline | Run Q1/Q2 over a 30-day lookback in a clean environment | Zero hits after helper/native-messaging exclusions — promote to IOA |
| Positive test | Lab: launch cmd.exe with a browser as the spoofed/real parent via a benign harness (never the live exploit) | Q1 fires; lineage and CommandLine captured correctly |
| Inventory accuracy | Cross-check Q6 / N1 output against ground-truth versions on a sample of hosts | Version parsing correct; vulnerable builds flagged, patched builds not |
| Promotion | Move Q1/Q2 to Custom IOA Detect+Block; Q3 to Detect | FP rate < 1/week sustained before Block mode |
12
Hardening — Tiered & Deployable
This is patchable — updating the browser is the fix. Everything else is defense-in-depth against browser-exploit chains generally. Platforms touched: Windows / macOS / Linux endpoints and browser management policy (Chrome ADMX / Edge / Intune / Jamf).
Immediate — Patch & verify (the fix)
- Update all Chromium browsers to ≥ 149.0.7827.102/.103 fleet-wide — M1051 (Update Software). Push via Intune/SCCM/Jamf/winget; Edge/Brave/Opera/Vivaldi to a Chromium-149.0.7827+ build. CISA KEV — meet the BOD 22-01 deadline.
- Enforce browser restart in a maintenance window — M1051. An updated binary on disk is not patched until the browser relaunches; force
RelaunchNotification/RelaunchNotificationPeriod. - Confirm auto-update is not disabled by policy — M1051. Verify
UpdateDefault/ComponentUpdatesEnabled(Chrome) and Edge update policy are enabled (N5). - Keep Falcon prevention + script-control on — M1040 / M1038. Backstops a successful exploit chain at the LOLBin/payload stage (Q1–Q3).
Near term — Reduce the browser attack surface (pilot first)
- Enforce Site Isolation and the V8 sandbox — M1048 (Application Isolation & Sandboxing). Confirm
SitePerProcess=1; do not disable the V8/renderer sandbox via policy. - Block high-risk browse categories on unmanaged/high-value endpoints — M1021 (Restrict Web-Based Content). SWG category + newly-registered-domain blocking during patch rollout (N4).
- ASR + PowerShell Constrained Language Mode + script-block logging (Windows) — M1042 / M1038 / M1040. Raises the cost of the post-exploit shell and improves Q1 evidence.
- Restrict/curate browser extensions via enterprise policy — M1038. Force-install allow-list; blocks a common secondary foothold.
Strategic — Default-deny & contain
- Application allowlisting (WDAC / AppLocker enforce; Gatekeeper/notarization on macOS) — M1038 / M1045. Stops a browser-dropped payload from executing even if the chain succeeds.
- Consider JIT-less / "JavaScript optimizer disabled" policy on high-risk fleets — M1048. Disabling the V8 JIT removes a large class of engine-exploitation primitives (test for app-compat impact).
- Continuous browser-version & update-policy drift monitoring — M1051. Alert fleet-wide when a browser falls below the current fixed build or auto-update is disabled.
13
Deployable Playbooks
Playbook A · Force the Chrome/Edge update + restart (Windows, PowerShell)
# 1. Report installed Chrome / Edge versions
$chrome = (Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe" -EA SilentlyContinue).VersionInfo.ProductVersion
$edge = (Get-Item "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe" -EA SilentlyContinue).VersionInfo.ProductVersion
"Chrome: $chrome Edge: $edge"
# 2. Trigger Google Update to fetch the fixed build (machine-wide install)
$gu = "$env:ProgramFiles (x86)\Google\Update\GoogleUpdate.exe"
if (Test-Path $gu) { & $gu /ua /installsource scheduler }
# 3. Force users off the stale binary (relaunch policy) - set via GPO/Intune ADMX:
# Chrome: RelaunchNotification = 2 (Required), RelaunchNotificationPeriod = 14400000 (4h)
# Edge: RelaunchNotification = 2, RelaunchNotificationPeriod = 14400000
# Vulnerable if Chrome/Edge < 149.0.7827.102 (Win) - escalate hosts that do not update.
Playbook B · Enforce Site Isolation & keep auto-update on (Chrome ADMX / registry)
# HKLM\SOFTWARE\Policies\Google\Chrome SitePerProcess = 1 # enforce Site Isolation (do not disable) ComponentUpdatesEnabled = 1 # allow V8/component updates DefaultJavaScriptJitSetting = 2 # (optional, high-risk fleets) 2 = disable V8 JIT for all sites # HKLM\SOFTWARE\Policies\Microsoft\Edge SitePerProcess = 1 # Apply: gpupdate /force | verify: chrome://policy (Edge: edge://policy)
Playbook C · macOS / Linux version check (shell)
# macOS - Chrome defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString # Linux - Chrome / Chromium google-chrome --version 2>/dev/null || chromium --version # Vulnerable if < 149.0.7827.103 (macOS) / < 149.0.7827.102 (Linux). Update via MDM / package manager.
14
Containment Runbook
| Phase | Actions | Owner | Evidence |
|---|---|---|---|
| Isolate | Network-contain the host in Falcon on a confirmed Q1/Q2/Q3 hit; do not power off (preserve volatile state) | SOC L2 | Containment timestamp; Q1/Q2/Q3 event rows |
| Triage | Pull the browser process tree: identify the parent browser PID, the renderer child, any spawned shell/LOLBin command line, and any PE the browser wrote; capture the last-visited URL set | SOC L2 | Process/file tree; browser history; Q1–Q3 rows |
| Eradicate | Remove dropped payloads; kill malicious processes; check Run keys / Scheduled Tasks / startup items created post-compromise (N3); remove rogue browser extensions | IR | Autoruns / task / extension review |
| Recover | Update the browser to the fixed build and relaunch; rotate credentials and browser session cookies/tokens for accounts used on the host; re-image if OS-level code execution is confirmed | IR + IT | Browser version; cred/session-rotation log |
| Harden | Confirm patch fleet-wide (Q6/N1); push §12 controls; promote Q1/Q2 IOAs to Detect+Block | Detection Eng | Patch coverage; IOA enabled |
15
Detection Coverage Map
| Technique | Behavior | CQL | IOA | Coverage |
|---|---|---|---|---|
| — | Vulnerable browser version | Q6 | — | Good patch + N1 inventory |
| T1189 | Drive-by delivery (crafted page) | Q4 | — | Partial proxy/DNS-dependent (N4) |
| T1203 | V8 OOB renderer compromise (in-process) | Q5 | — | GAP invisible to EDR; crash-storm proxy only |
| T1059 / T1218 | Browser spawns shell / LOLBin | Q1 | IOA-1 | Good |
| T1211 / T1203 | Renderer child spawns process (escape) | Q2 | IOA-2 | Good |
| T1105 / T1203 | Browser writes a payload to disk | Q3 | IOA-3 | Partial FP risk; exclude Downloads / correlate |
| T1071.001 | Post-exploit browser C2 | Q4 | — | Partial rarity-scoped pivot only |
| T1547 / T1053 | Persistence after RCE | — | — | Partial Native N3 + containment |
Validation gates: (1) confirm ProcessRollup2 retains ParentCommandLine + PeFileWritten context fleet-wide; (2) Q1/Q2 return zero hits in a 30-day benign lookback after helper exclusions; (3) inventory browser versions (Q6/N1) and confirm the fixed build; (4) lab-validate lineage firing with a benign parent harness — never the live exploit; (5) promote Q1/Q2 to Custom IOA Detect+Block (target FP < 1/week). The renderer OOB step is an accepted detection gap — mitigated by the patch and the crash-storm proxy (Q5).
16
Hunt Summary Ticket
TITLE: Hunt - CVE-2026-11645 (Chromium V8 Out-of-Bounds Read/Write RCE Zero-Day)
SEVERITY: High (CISA KEV 2026-06-09, exploited ITW, CVSS 8.8; in-browser RCE via crafted page)
SCOPE: Endpoints running Chrome/Edge/Brave/Opera/Vivaldi < Chromium 149.0.7827.102/.103
HYPOTHESIS: A crafted HTML page triggers a V8 OOB read/write -> renderer RCE; attacker chains to
the OS and spawns a shell/LOLBin, drops a payload, and beacons out. EDR sees the
post-exploit consequences (browser-parented execution / file write / egress).
QUERIES RUN: Q1 browser->shell/LOLBin (IOA) | Q2 renderer child spawns process (IOA) |
Q3 browser writes PE (IOA) | Q4 rare browser egress | Q5 renderer crash storm |
Q6 vulnerable version inventory
+ Native N1-N5 (version inventory, crash storm, persistence, drive-by infra, update policy)
DO FIRST: Patch browsers >= 149.0.7827.102/.103 and force relaunch (Q6/N1); then Q1, Q2 - escalate any hit
FINDINGS: <pending analyst execution>
GAPS: V8 renderer OOB primitive is invisible to EDR (in-process); drive-by step needs proxy/DNS
ACTIONS: Force browser update fleet-wide; enforce Site Isolation + auto-update; block high-risk
browse categories during rollout; promote Q1/Q2 to Custom IOA Detect+Block
OWNER: HuntPack
VERSION: v0.2 - 2026-06-15
17
Changelog
v0.22026-07-24CQL correctness pass. All
table() calls now carry an explicit row limit: the default is 200 and truncation is silent, so a capped result was indistinguishable from a complete one. Atomic-IOC sweeps (filters over 5+ hashes or C2 IPs) use limit=max so a wide infection is never silently under-scoped; behavioural hunts use limit=200, where exceeding the cap indicates the query needs tuning. Where present, event names that do not exist in the Falcon data model were corrected (e.g. ServiceInstalled is a Sysmon concept, not a Falcon event; ElfFileWritten is ELFFileWritten) — such queries could never return a row. No detection logic, fields, or IOCs changed.v0.12026-06-15Initial pack (review-v2 gold layout): fixed left-sidebar scrollspy TOC, collapsible, cloud selector inside the CQL section, per-card Copy/Open-in-Falcon, Grouped IOC Quick-Copy grid, coverage map, validation gates, ticket. Confirmed KEV listing (2026-06-09), CVSS 8.8, fixed builds 149.0.7827.102/.103, reporter 303f06e3 ($55k), 5th Chrome 0-day of 2026 (CVE-2026-2441/-3909/-3910/-5281), Chromium-browser scope (Edge/Brave/Opera/Vivaldi). 6 CQL + 5 native hunts, 3 IOA candidates. Behavior-keyed (no atomic IOCs published).
18
References
| Tier | Source | Used For |
|---|---|---|
| 1 | The Hacker News — Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild | Mechanism, CVSS, fixed builds, reporter/bounty, 5th-0-day-of-2026 + family CVEs, browser scope |
| 2 | SOCRadar — CVE-2026-11645 Chrome V8 Bug | Exploitation primitives, attack chain (crafted HTML), detection guidance, mitigation/hardening |
| 2 | Cyber Security News — Chromium 0-day · SOC Prime — CVE-2026-11645 | Heap-corruption impact, all-Chromium exposure, patch-now guidance |
| 1 | CISA KEV Catalog (added 2026-06-09) | Active-exploitation confirmation; BOD 22-01 remediation timeline |
| 2 | Security Affairs · BleepingComputer · Help Net Security | KEV reporting, per-OS affected/fixed builds, fifth-0-day context |
HuntPack v0.1 · CVE-2026-11645 (Chromium V8 OOB R/W RCE) · Generated 2026-06-15 · Defensive use only — no exploit code. The patch (Chromium ≥ 149.0.7827.102) is the fix; behavioral hunts cover the post-exploitation chain and are durable defense-in-depth for browser-exploit follow-on. Validate field names (especially the Q6 inventory feed) in your tenant before promoting any query to alerting.