New Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari

on YouTube ↗27m

" summary

Demonstrates a single WebAudio decoder bug that bypasses Safari heap isolation to get arbitrary code execution: fuzzing audio_file_stream and extended audio file services produces 16 CVEs and one exploit (CVE-2021-1747) that uses an AC-Opus append-input OOB write, overlapping CAF packets to avoid crashes, one WebAudio bug, heap-sprays about 2.5 GB of butterfly objects, builds primitives by overwriting a JS array length, and delivers a working exploit packaged as a 600 MB CAF with 17 million packets that reliably wins a CTF.

AI-written summary · about

" chapters (9)

1. 0:00Introduction and background
2. 1:56Browser security challenges
3. 3:36Web audio module analysis
4. 5:42Selecting APIs for fuzzing
5. 8:24Fuzzing strategy and results
6. 10:52Vulnerability root cause
7. 13:53Exploitation logic
8. 17:25Bypassing defense mechanisms
9. 21:04Exploit execution and outcome

" related talks

• 33mWebKit Everywhere: Secure or Not?Liang Chen · Black Hat Europe 2014
• 44mBreaking the Sound Barrier: Exploiting CoreAudio via Mach Message FuzzingDillon Franke · CODE BLUE 2025
• 38mSide Channel Attacks: Lessons Learned Or Troubles Ahead?Daniel Genkin · Hardwear.io Netherlands 2024
• 41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)Avi Lumelsky, Uri Katz · BSidesSF 2026
• 27mAttacking the WebAssembly Compiler of WebKitBohan Liu, Zong Cao (P1umer), Yeqi Fu (Q1IQ), Fangming Gu (afang5472), Zheng Wang (xmzyshypnc) · Black Hat Asia 2023
• 59mBrowsers Gone WildXiaoran Wang, Angelo Prado · Black Hat Asia 2015
• 25mExtension Breakdown...Iskander Sanchez-Rola, Davide Balzarotti, Igor Santos · 26th USENIX Security Symposium (USENIX Security '17)
• 43mPWNIE Awards at Black Hat USA 2014Adi Shamir, Eran Tromer, James Forshaw, Ralf-Philipp Weinmann, Daniel Genkin, Yuny Bulygin, Andrea Bittau · Black Hat USA 2014