CVE-2025-14174

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "chrome.exe" or InitiatingProcessFileName =~ "msedge.exe"
| where ProcessCommandLine contains ".html" and ProcessCommandLine contains "out-of-bounds" // Placeholder for behavioral indicators
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

(sourcetype=WinEventLog OR sourcetype=linux_audit) (chrome.exe OR msedge.exe) (out-of-bounds AND .html) | table _time, host, Image, CommandLine, ParentImage, ParentCommandLine

Sigma

title: Chrome/Edge Out-of-Bounds Access
status: experimental
description: Detects potential exploitation attempts of out-of-bounds memory access in Chromium-based browsers via crafted HTML.
references:
    - https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
        CommandLine|all:
            - '.html'
            - 'out-of-bounds' # Placeholder for more specific behavioral indicators
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
    - Image
    - ParentImage
tags:
    - attack.execution
    - cve.2025.14174

Elastic ES|QL

from process where process.executable in ("chrome.exe", "msedge.exe") and process.command_line : (".html", "out-of-bounds") | select @timestamp, host.name, process.executable, process.command_line, process.parent.executable, process.parent.command_line