WebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM

on YouTube ↗43m

" summary

Claims that WebAssembly lets attackers turn parser bugs into full exploits and demonstrates 10+ Chrome/V8 sandbox escapes using concrete primitives and tools. Exploit chain includes a universal WASM type confusion from a missing type count check, a canonical index truncation bug (canonical type IDs truncated to 20 bits) that yields arbitrary JS-to-WASM downcasts and fake objects, an exception-signature confusion allowing cross-module type misuse, and a turbofan truncation that can cause a partitionalloc overwrite on Android. Uses wasm module builder, yields arbitrary in-cage read/write and successful sandbox escapes in CTFs and at least one real-world exploit.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 2:09WebAssembly type systems
3. 10:35Manfred Paul bug analysis
4. 18:24Chrome bug via type index
5. 24:43Type confusion in modules
6. 27:54Memory access in TurboFan
7. 33:31V8 sandbox design
8. 36:00V8 sandbox bypasses
9. 40:33WebAssembly security future
10. 41:58Conclusions

" related talks

• 49mChrome Browser Exploitation: from zero to heap sandbox escapeMatteo Malvica · NDC Security 2025
• 21mTwo-Faces of WASM SecurityKaizhe Huang, Pranjal Jumde · BSidesSF 2019
• 27mAttacking the WebAssembly Compiler of WebKitBohan Liu, Zong Cao (P1umer), Yeqi Fu (Q1IQ), Fangming Gu (afang5472), Zheng Wang (xmzyshypnc) · Black Hat Asia 2023
• 53mWebAssemblyBrian Sletten · Developer Summit 2020
• 35mModern Sandboxing: Using Web Assembly in JavaFrank Lyaruu · Voxxed Days Crete 2025
• 30mShrinking Software Attack Surface with WebAssembly & CNCF WasmcloudLiam Randall · Cloud Native SecurityCon Europe 2022
• 48mDon't Trust Anything! Real-world Uses For WebAssemblyKatie Bell · YOW! Perth 2023
• 35mWebAssembly: now web is a new compiler target architectureNoritada Shimizu · FOSSASIA Summit 2017