Chrome Browser Exploitation: from zero to heap sandbox escape
summary
Three V8 type‑confusions (2018, 2023, 2024) turn into working Windows exploits that bypass the V8 Heap sandbox and achieve remote code execution; demos use d8 for standalone V8 testing, a Python tool that encodes shell bytes as floats for JIT‑spraying, and WebAssembly modules for executable memory. The 2023 bug targets the new maglev compiler, the 2024 chain combines V8 and Blink map confusions to leak sandbox bases, and end‑to‑end exploits run successfully when built into full Chrome.
AI-written summary · about
chapters (9)
- 0:00Chrome browser exploitation intro
- 3:40Why browser exploitation matters
- 12:37JS objects in memory
- 23:09Type confusion vulnerabilities
- 28:20Pre-sandbox bugs in V8
- 30:50V8 Heap sandbox
- 32:59MagLev type confusion
- 38:15Heap sandbox bypasses
- 42:14Live exploit demo
related talks
35mThe Hat Trick: Exploit Chrome Twice from Runtime to JIT
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
43mWebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM
37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
01h 07mThe V8 Sandbox: From Compiler Correctness to Runtime Containment
49m$Hell on Earth: From Browser to System Compromise
33mWebKit Everywhere: Secure or Not?