Loophole: Timing Attacks on Shared Event Loops in Chrome
summary
Demonstrates that Chrome’s shared event loops leak timing: attacker JavaScript posts tasks and measures I/O thread host loop and renderer main-thread loop delays to infer victim activity. Implements three concrete attacks: webpage identification (tested on 500 sites, 75% correct on renderer traces, 23% on host), an inter-keystroke timing attack (10,000 trials, about 90% keystroke recovery) and a covert channel; all attacks run from unprivileged JS and reliably work with microsecond resolution.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:17Evendriven programming
- 3:03How it works
- 4:45Chrome Architecture
- 8:48PostMessage Approach
- 9:23Relative Duration
- 11:06Lupus Candid
- 11:30Event Loop Spy
- 11:42Webpage Identification
- 12:21Dynamic Time Working
- 13:41Evaluation
- 15:28Inter keystroke timing attack
- 18:06Possible countermeasures
- 21:00Summary
- 21:30Questions
related talks
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
48mA Weakness In Chrome & A New Hacking Technique
35mThe Hat Trick: Exploit Chrome Twice from Runtime to JIT
58mExploiting web messaging implementations
49mChrome Browser Exploitation: from zero to heap sandbox escape
51mExploiting Hardware Glitches And Side Channels In Perfect Software
35mShowTime: CPU Timing Attacks With the Human Eye
48mI Know Where You've Been: Geo-Inference Attacks Via The Browser Cache