The Hat Trick: Exploit Chrome Twice from Runtime to JIT
summary
Claims two remote RCE chains against V8: one exploits Promise.any hole extraction to place the sentinel into a JS Map, force a Map negative size -> OOB write, expand a JS array’s length and gain arbitrary read/write; the other abuses Maglev missing write-barrier to create a dangling pointer -> arbitrary R/W -> JIT code pointer overwrite. Proof-of-concept exploits are implemented, V8 is compiled and the payload runs to spawn a shell, demonstrating reliable end-to-end exploitation.
AI-written summary · about
chapters (10)
- 0:00Introduction and agenda
- 1:20Chrome architecture overview
- 3:15Promise.any exploit details
- 6:57Promise.any vulnerability POC
- 10:04Promise.any exploit analysis
- 14:13JS Map vulnerability
- 18:59V8 compiler and GC issues
- 22:54Use after free exploit
- 29:15Heap spray and RCE
- 34:07Demo and conclusion
related talks
49mChrome Browser Exploitation: from zero to heap sandbox escape
37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
48mA Weakness In Chrome & A New Hacking Technique
43mWebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM
51mExploiting Hardware Glitches And Side Channels In Perfect Software
33mWebKit Everywhere: Secure or Not?
26mLoophole: Timing Attacks on Shared Event Loops in Chrome