PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cleanly Escaping the Chrome Sandbox

theori.io | research | #use-after-free | #sandbox-escape | #exploit | #chrome | #chromium | #mojo-ipc
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Theori's walkthrough of Issue 1062091, a use-after-free in Chrome's browser process reached via Mojo IPC, turned into a sandbox escape for Chrome and Chromium-based Edge, with full exploit details.
Published
Collected

Related coverage

research · projectzero.google
Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332
A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.
blog · projectzero.google
Escaping the Chrome Sandbox with RIDL
Guest blog post by Stephen Röttger
blog · projectzero.google
Virtually Unlimited Memory: Escaping the Chrome Sandbox
After discovering a collection of possible sandbox escape vulnerabilities in Chrome, it seemed worthwhile to exploit one of these issues as a full-chain exploit together with a renderer vulnerability to get a better understanding of the mechanics required for a modern Chrome exploit. Considering the available bugs, the most likely appeared to be issue 1755, a use-after-free with parallels to classic Javascript engine callback bugs. This is a good candidate because of the high level of control the attacker has both over the lifetime of the free’d object, and over the timing of the later use of the object.
blog · projectzero.google
Racing MIDI messages in Chrome
A guest post from Chrome Security describing a severe use-after-free in Chrome's browser process on Linux, Chrome OS and OS X, triggerable directly from the web without breaking the sandbox.
research · bughunters.google.com
Changes to the Chrome VRP
Today we are announcing changes to the [Chrome Vulnerability Rewards Program](about/rules/chrome-friends/chrome-vulnerability-reward-program-rules), adjusting our reward amounts and program categories to reward deeper security research, recognize high-value fixes across more severity tiers, and provide new opportunities for researcher recognition.
research · portswigger.net
Inline Style Exfiltration: leaking data with chained CSS conditionals
Chained CSS if() conditionals in inline styles exfiltrate attribute data such as usernames via background requests — no selectors or stylesheet imports needed; Burp actions brute-force values.
Back