News for hackers. Stuff that matters.

A comment on Chrome zero-day released on GitHub – fixed on V8 but still works on latest.

Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by hbrundage on Monday April 12, 2021 @09:30PM (#26787218)
https://therecord.media/security-researcher-drops-chrome-and... says this isn't a fully weaponizable exploit because you still need to escape the Chrome sandbox after using this. But, the researcher shows a screenshot of having started calc.exe which seems like something that'd happen outside the sandbox?
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by rtpg on Monday April 12, 2021 @10:59PM (#26787683)
The pr adding this says that you need to run chrome with —no-sandbox to get the exploit chain (since they don’t have a sandbox buster right now). Kinda feel like the PR to metasploit is more interesting as a link
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by moozilla on Monday April 12, 2021 @11:34PM (#26787863)
Couldn't find the PR you're referring to, unless it was this one https://github.com/rapid7/metasploit-framework/pull/15007 which was added by the same author as the OP, but looks like a different exploit as far as I can tell?
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by rtpg on Tuesday April 13, 2021 @04:54AM (#26789769)
I believe it's the same exploit, check out this reference here [0], and you should see the JS snippet

https://github.com/rapid7/metasploit-framework/pull/15007/fi...

[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by saagarjha on Tuesday April 13, 2021 @05:49AM (#26790143)
The code is somewhat different, although you may have recognized that most JS engine exploits look the same once basic primitives are constructed.
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by saurik on Monday April 12, 2021 @09:34PM (#26787242)
I would imagine the researcher showed a screenshot of the exploit being run on a copy of Chrom{e,ium} where he had disabled parts of the sandbox (that, or he has a more complex exploit with another maybe-undisclosed sandbox escape).
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by r4j0x00 on Tuesday April 13, 2021 @03:29AM (#26789149)
Hey I'm the exploit author, just run "chrome.exe --no-sandbox exploit.html" it will work.
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by superjan on Tuesday April 13, 2021 @06:59AM (#26790584)
What is your motivation of putting it on github? Have you considered selling it to google?
[ Parent | on HN ]
Re:Chrome zero-day released on GitHub – fixed on V8 but stil... by albntomat0 on Tuesday April 13, 2021 @07:53AM (#26790976)
The bug was originally submitted to Google as part of Pwn2Own by two other people.

The GitHub POC was built using the patch and regression test by a third person (who you just replied to). While it's been patched in the v8 Javascript engine, that patch has not made it to Chrome (unless you're compiling Chromium from scratch) as part of Chrome's 2 week release process.

[ Parent | on HN ]