Bypass CFG in Chrome

on YouTube ↗27m

" summary

Examines over ten Control Flow Guard (CFG) bypass techniques and tests each against Chrome to determine whether they can still be used to hijack protected function pointers and execute arbitrary code. Covers specific CFG evasion methods and their applicability to Chrome's protections, with examples and analysis of which techniques remain effective.

AI-written summary · about

" chapters (10)

1. 0:00black hat ASIA 2022
2. 0:46What is CFG
3. 1:35History of CFG
4. 2:32How Dose CFG Work
5. 4:11Previous CFG Bypass
6. 10:15How about Chrome
7. 11:07Bypass CFG in Chrome
8. 17:53How to Improve
9. 21:16Enhanced Security Mode of Edge
10. 25:55Takeaways

" related talks

• 43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019Zhen Feng, Gengming Liu · Black Hat USA 2019
• 48mA Weakness In Chrome & A New Hacking TechniqueGil Cohen, Omri Inbar · Global AppSec Dublin 2023
• 41mChrome Security Secret SauceParisa Tabriz · Strange Loop 2013
• 58mExploiting Adobe Flash Player In The Era Of Control Flow GuardFrancisco Falcon · Black Hat Europe 2015
• 37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome BrowserBohan Liu, Zheng Wang · Black Hat Europe 2023
• 26mLoophole: Timing Attacks on Shared Event Loops in ChromePepe Vila, Boris Köpf · 26th USENIX Security Symposium (USENIX Security '17)
• 55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS FilteringSebastian Lekies, Martin Johns, Ben Stock · Black Hat USA 2014
• 49mChrome Browser Exploitation: from zero to heap sandbox escapeMatteo Malvica · NDC Security 2025