The Most Secure Browser? Pwning Chrome from 2016 to 2019
summary
Claims multiple Chrome wins from 2016–2019 with three different sandbox escapes and practical exploits that run code (a 13-line calc PoC mentioned). Uses a custom mutator called semantic equivalent transform to fuzz V8, finds CVE-2016-5198 and CVE-2017-5053, and chains JIT/empty-loop tricks and object fakeing for arbitrary read/write. Exploits an indexDB UAF to leak heap and overwrite pointers, sprays thousands of blobs, then abuses renderer command prefix via a BSS pointer overwrite to launch arbitrary child-process commands — end-to-end demos succeed.
AI-written summary · about
chapters (16)
- 0:00Start
- 12:26Play with properties
- 14:02Bug primitive
- 14:22JIT Code Fragment
- 17:14Attack Surface
- 19:12IndexedDB IPC interfaces
- 21:51UAF in database_map_
- 22:30Chrome on Windows
- 25:36UAF of IndexedDBDatabase
- 27:45Read from Blob
- 28:12Exploit chain
- 29:32Exploit Chrome on ChromeOS (Linux)
- 30:24Clang Control Flow Integrity
- 31:00Chrome is a huge system!
- 32:54Command Line Injection
- 41:00Crowded layout, put everything in a blob
related talks
49mChrome Browser Exploitation: from zero to heap sandbox escape
41mChrome Security Secret Sauce
48mA Weakness In Chrome & A New Hacking Technique
35mThe Hat Trick: Exploit Chrome Twice from Runtime to JIT
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
49m$Hell on Earth: From Browser to System Compromise
59mBrowsers Gone Wild