$Hell on Earth: From Browser to System Compromise

on YouTube ↗49m

" summary

Eight browser-to-system exploit chains are dissected with concrete primitives, payloads and root causes: eight winning chains, 21 vulnerabilities, including JavaScript-core and Flash use‑after‑free bugs, Chrome array-length and Edge concat/Fill out‑of‑bounds, JPEG‑XR and DirectX driver overflows, and multiple kernel use-after-free escalations. Each chain shows how attackers achieve arbitrary read/write, bypass ASLR/DEP, load a malicious DLL or pivot to kernel ROP, and end up with SYSTEM/root shells; vendor fixes and simple logic fixes like directory traversal or env‑var checks are demonstrated.

AI-written summary · about

" chapters (13)

1. 0:00Start
2. 1:28Introduction
3. 6:10Team Shield Exploit Demo
4. 6:52Apple Safari Graphics Context UAF
5. 8:02Exploitation Steps
6. 9:33Race Condition Details
7. 10:58Team Sniper Exploit Demo
8. 17:55360 Vulcan Chrome Demo
9. 27:58360 Vulcan Team Exploit Demo
10. 38:32Lokihardt Exploit Demo
11. 43:41Execution Flow
12. 47:09Conclusion
13. 48:43Questions?

" related talks

• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 51mExploiting Hardware Glitches And Side Channels In Perfect SoftwareHerbert Bos · OWASP Global AppSec Amsterdam 2019
• 01h 05mClassic VulnerabilitiesPatricia Aas · NDC Security 2022
• 43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019Zhen Feng, Gengming Liu · Black Hat USA 2019
• 33mWebKit Everywhere: Secure or Not?Liang Chen · Black Hat Europe 2014
• 44mCutting Edge: Microsoft Browser Security — From People Who Owned ItWei Wei, Chuanda Ding, Zhipeng Huo · Black Hat Europe 2018
• 41mXSS Horror ShowGareth Heyes · OWASP AppSec Research (AppSecEU) 2015
• 48mA Weakness In Chrome & A New Hacking TechniqueGil Cohen, Omri Inbar · Global AppSec Dublin 2023