CVE-2025-14174

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "chrome.exe" or InitiatingProcessFileName =~ "msedge.exe"
| where ProcessCommandLine contains "--type=renderer" and ProcessCommandLine contains "--enable-gpu-rasterization"
| where ProcessCommandLine contains "--disable-gpu-compositing" or ProcessCommandLine contains "--disable-accelerated-video-decode"
| where ProcessCommandLine contains "--disable-direct-composition" or ProcessCommandLine contains "--disable-software-rasterizer"
| where ProcessCommandLine contains "--disable-gpu"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventID=1) (Image="*\\chrome.exe" OR Image="*\\msedge.exe") (CommandLine="*--type=renderer*" AND CommandLine="*--enable-gpu-rasterization*") (CommandLine="*--disable-gpu-compositing*" OR CommandLine="*--disable-accelerated-video-decode*" OR CommandLine="*--disable-direct-composition*" OR CommandLine="*--disable-software-rasterizer*" OR CommandLine="*--disable-gpu*") | table _time, Host, Image, CommandLine, ParentImage, ParentCommandLine, Hashes

Sigma

title: Chrome/Edge ANGLE Out-of-Bounds Memory Access Attempt
id: 9a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious process command-lines that might indicate an attempt to exploit CVE-2025-14174 in Chromium-based browsers.
author: SecBoard
date: 2025/12/12
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
    CommandLine|contains:
      - '--type=renderer'
      - '--enable-gpu-rasterization'
  condition: selection and (1 of disable_gpu*)
  disable_gpu_compositing:
    CommandLine|contains: '--disable-gpu-compositing'
  disable_accelerated_video_decode:
    CommandLine|contains: '--disable-accelerated-video-decode'
  disable_direct_composition:
    CommandLine|contains: '--disable-direct-composition'
  disable_software_rasterizer:
    CommandLine|contains: '--disable-software-rasterizer'
  disable_gpu:
    CommandLine|contains: '--disable-gpu'
level: high

Elastic ES|QL

from process where (process.executable.endswith('chrome.exe') or process.executable.endswith('msedge.exe')) and (process.args contains '--type=renderer' and process.args contains '--enable-gpu-rasterization') and (process.args contains '--disable-gpu-compositing' or process.args contains '--disable-accelerated-video-decode' or process.args contains '--disable-direct-composition' or process.args contains '--disable-software-rasterizer' or process.args contains '--disable-gpu')