New Wine in an Old Bottle: Attacking Chrome WebSQL
summary
Chrome exposes SQLite via WebSQL and the team builds a mutation-based BNF fuzzer and an AST-guided mutator that generate and mutate SQL-like statements with context tracking, table managers and two mutation strategies. The tools find 3–4 use‑after‑free bugs (one present for seven years) and an out‑of‑bounds read/write (2022-3195), and they implement a heap blob spray to occupy freed chunks, achieving near‑100% heap occupation and practical leak and primitive read/write exploits.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:06Web SQL overview
- 4:20BNF fuzzing strategy
- 7:05Vulnerability case study
- 23:29AST fuzzing approach
- 29:48Conclusion
related talks
47mExploring the New World : Remote Exploitation of SQLite and Curl
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
49mChrome Browser Exploitation: from zero to heap sandbox escape
48mA Weakness In Chrome & A New Hacking Technique
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
15mSqueezing Juicy Variant Bugs Out of Modern Browsers
43mWebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM
01h 16mClassic Vulnerabilities