Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332

A Google Project Zero post on CVE-2014-3196, a Windows Chrome bug fixed in M38 that served as an early link in a potential exploit chain.

Guest blog post by Stephen Röttger

After discovering a collection of possible sandbox escape vulnerabilities in Chrome, it seemed worthwhile to exploit one of these issues as a full-chain exploit together with a renderer vulnerability to get a better understanding of the mechanics required for a modern Chrome exploit. Considering the available bugs, the most likely appeared to be issue 1755, a use-after-free with parallels to classic Javascript engine callback bugs. This is a good candidate because of the high level of control the attacker has both over the lifetime of the free’d object, and over the timing of the later use of the object.

A Project Zero post on attacking NVIDIA's Windows kernel graphics driver, covering several of the 16 vulnerabilities found during this GPU attack surface research.

A short Google Project Zero post describing an interesting Chrome issue the author discovered last month and how it was found.

A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.