Skip to content
A day^W^W Several months in the life of Project Zero - Part 2: The Chrome exploit of suffering
Summary
After we’d understood how the bug worked, and had passed on those details to Chrome to help them get started on a fix, we went back to our other projects. This bug remained a topic of discussion, and eventually we ran out of excuses for not trying to write an exploit for it.
- Published
- Collected
Related coverage
blog ·
projectzero.google
A day^W^W Several months in the life of Project Zero - Part 1: The Chrome bug of suffering
It was a normal week in the Project Zero office when we got an interesting email from the Chrome team — they’d been looking into a serious crash that was happening occasionally on Android builds of Chrome, but hadn’t made much progress. The same crash had then briefly reproduced on ClusterFuzz; with a test-case which referenced an external website — but it wasn’t reproducing any more, and it seemed likely that the next step was going to be to wait until the bug started reproducing again.
research ·
projectzero.google
Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332
A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.
research ·
projectzero.google
[CVE-2014-3196] Did the “Man With No Name” Feel Insecure?
A Google Project Zero post on CVE-2014-3196, a Windows Chrome bug fixed in M38 that served as an early link in a potential exploit chain.
blog ·
projectzero.google
Escaping the Chrome Sandbox with RIDL
Guest blog post by Stephen Röttger
blog ·
projectzero.google
Trashing the Flow of Data
In this blog post I want to present crbug.com/944062, a vulnerability in Chrome’s JavaScript compiler TurboFan that was discovered independently by Samuel (saelo@) via fuzzing with fuzzilli, and by myself via manual code auditing. The bug was found in beta and was fixed before it made it into the stable release of Chrome, but I think it’s interesting for a few reasons and decided to write about it. The issue was in TurboFan’s handling of the Array.indexOf builtin and at first it looked like an info leak at best, so it was not clear that you can turn this into an arbitrary write primitive. Besides that, it’s an instance of a common bug pattern in JIT compilers: the code was making assumptions at compile time without inserting the corresponding runtime checks for these assumptions.
blog ·
projectzero.google
Virtually Unlimited Memory: Escaping the Chrome Sandbox
After discovering a collection of possible sandbox escape vulnerabilities in Chrome, it seemed worthwhile to exploit one of these issues as a full-chain exploit together with a renderer vulnerability to get a better understanding of the mechanics required for a modern Chrome exploit. Considering the available bugs, the most likely appeared to be issue 1755, a use-after-free with parallels to classic Javascript engine callback bugs. This is a good candidate because of the high level of control the attacker has both over the lifetime of the free’d object, and over the timing of the later use of the object.