chromium-exploit-dev - GitLite

KO | EN

gitlite — search

#javascript #python #typescript #llm #go #android #machine-learning #deep-learning #docker #macos #nodejs #java #awesome #kubernetes

chromium-exploit-dev

(★ 306)

Toolkit to weaponize Chromium vulnerabilities into reliable, cross-platform, full-chain exploits

파일 탐색기

최종 버전 다운로드 (.zip)

- launch.json
- tasks.json
- - demo.mp4
  - monitor.png
- - main.md
  - tools.md
  - vulns.md
- README.md
- third-party.md
- - convert.js
  - dom.js
  - stability.js
  - v8-utils.js
  - versions.js
  - wasm-module-builder.js
- - d8.js
  - linux.js
  - useragent.js
  - win.js
- - mojo.js
- - x64-linux.js
  - x64-win.js
  - x64.js
- - cage.js
  - memory.js
  - rwx.js
- build.py
- copy_mojo_js_bindings.py
- download.py
- symbols.py
- wasm-module-builder.py
- - CVE-2024-7971.js
  - CVE-2025-0291.js
  - CVE-2025-2135.js
  - CVE-2025-5419.js
- - CVE-2024-11114.js
- - 352689356.js
  - 379140430.js
  - 395659804.js
  - 421403261.js
- calc.js
- symbols.js
.gitignore
index.html
jsconfig.json
LICENSE
main.js
monitor.html
README.md
requirements.txt
server.py

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Chromium Exploit Development Toolkit
A toolkit for weaponizing Chromium vulnerabilities into reliable, cross-platform, full-chain exploits.

## Overview
This project provides a set of powerful helper scripts but requires you to bring your own vulnerabilities.
You are responsible for implementing minimal exploitation primitives, and the toolkit handles everything else.

A custom exploit chain relies on the `main.js` script file, which lets you selectively include your vulnerabilities alongside the toolkit’s helper scripts:
```javascript
// Exploit settings
let loglevel = 5;
let run_in_worker = false;

// Exploit chain
async function main() {
    // Common helpers
    await include("kit/common/convert.js");
    await include("kit/common/dom.js");
    await include("kit/common/stability.js");
    await include("kit/common/v8-utils.js");
    await include("kit/common/versions.js");
    await include("kit/common/wasm-module-builder.js");

// Symbols database for your exploit chain
    await include("vulns/symbols.js");

// Early fingerprinting
    await include("kit/fingerprint/d8.js");
    await include("kit/fingerprint/useragent.js");

// Your initial V8 memory corruption
    // This should craft addrOf() & fakeObj() primitives
    await include("vulns/memcor/your-code.js");

// Bootstrap stage-2 primitives & gain memory read/write inside the V8 SBX
    await include("kit/v8/cage.js");

// Your V8 sandbox escape
    // This should craft arbRead() & arbWrite() primitives AND leak some pointers
    await include("vulns/v8sbx/your-code.js");

// Utils to manipulate the renderer memory
    await include("kit/v8/memory.js");

// Achieve code execution (automatically select the best method based on the leaked pointers)
    await include("kit/v8/rwx/egghunt.js");
    await include("kit/v8/rwx/isolate.js");
    await include("kit/v8/rwx/partitionalloc.js");
    await include("kit/v8/rwx/wasmrwx.js");
    await include("kit/v8/rwx.js");

// Bootstrap stage-3 primitives & provide generic shellcodes
    await include("kit/shellcodes/x64.js");
    await include("kit/shellcodes/x64-win.js");
    await include("kit/shellcodes/x64-linux.js");

// Precise fingerprinting
    await include("kit/fingerprint/win.js");
    await include("kit/fingerprint/linux.js");

// Enable MojoJS and other protected flags
    await include("kit/renderer/mojo.js");

// Your sandbox escape
    await include("vulns/sbx/your-code.js");
}

/*
    Other customizable features are implemented here
    (logging, clean exit handling, exploit reloading, scripts execution context...)
    ...
*/
```

Read [the documentation](docs/README.md) for a comprehensive overview of available features.

A testing webpage is provided in `index.html`.
It prints logs, handles crashes and allows the main script to include files from the project's subfolders.
You can run it locally using `python3 server.py`, then browse to `http://localhost:8000`.

The `monitor.html` webpage provides a simple interface to monitor and test exploits remotely.
It displays remote hosts, exploit logs, and error statistics.
It also allows sending commands to remote hosts, including exploit reloads and a stress-test mode.

For early exploit development, you can also run the main exploit script in d8: `d8.exe main.js`.

Once an exploit chain is ready, [tools](tools/) are provided to automate various tasks:
- `build.py` for building the exploit into a single script
- `download.py` for downloading specific Google Chrome releases
- `symbols.py` for automated PDB parsing
- & more!

## Public exploits
Some exploits for public vulnerabilities are provided to showcase the toolkit's features:

#### V8 memory corruption
| Vulnerability | Affected versions (Chrome Stable) | Details |
| ---- | ---- | ---- |
| [CVE-2024-7971](vulns/memcor/CVE-2024-7971.js) | <= 127 | WASM type confusion during ParallelMove in Liftoff |
| [CVE-2025-0291](vulns/memcor/CVE-2025-0291.js) | 128 - 131 (< 131.0.6778.264, vulnerable component shipped via Finch) | Type confusion in Turboshaft's WasmGCTypeAnalyzer on single-block loops |
| [CVE-2025-2135](vulns/memcor/CVE-2025-2135.js) | 133 - 134 (< 134.0.6998.88) | Type confusion on aliasing objects in TransitionElementsKindOrCheckMap |
| [CVE-2025-5419](vulns/memcor/CVE-2025-5419.js) | <= 136 (Finch kill-switch from 133)| Out-of-bounds memory access because of invalid store-store elimination on dynamic indexes |

#### V8 sandbox escape
| Vulnerability | Affected versions (Chrome Stable) | Details |
| ---- | ---- | ---- |
| [352689356](vulns/v8sbx/352689356.js) | <= 131 | WASM function signature confusion in non-inlined TurboFan call_ref |
| [379140430](vulns/v8sbx/379140430.js) | <= 132 | Signature type confusion in WasmToJsWrapper tier-up with in-sandbox Tuple2 corruption |
| [395659804](vulns/v8sbx/395659804.js) | <= 134 | Arbitrary code execution via OSR DeoptimizationData confusion |
| [421403261](vulns/v8sbx/421403261.js) | 134 - 137 (< 137.0.7151.119, x64 only) | Signature hash i32/i64 collision in Liftoff |

#### Browser sandbox escape
| Vulnerability | Affected versions (Chrome Stable) | Details |
| ---- | ---- | ---- |
| [CVE-2024-11114](vulns/sbx/CVE-2024-11114.js) | 94 - 130 (Windows only) | Mouse can be controlled using the startDragging() Mojo IPC interface to run downloaded files and escape the sandbox |

## Demo
A demonstration exploit chain is provided in the default [main.js](main.js). It relies on the following vulnerabilities:
- CVE-2025-0291
- Issue 379140430
- CVE-2024-11114
- [DLL hijacking in putty.exe](https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-indirect-dll-hijack-2.html) (use putty.exe v0.68 & hijack winspool.drv to bypass Windows SmartScreen — exploit resources [here](static/CVE-2024-11114/))

This exploit chain works out-of-the-box on any Chrome 130 stable and extended releases up to 130.0.6723.160. It can be easily extended to M128, M129 and M131 (< 131.0.6778.264) by adding [symbols](vulns/symbols.js).

[docs/assets/demo.mp4](https://github.com/user-attachments/assets/981cc770-6844-4bff-a924-a9799b7200aa)

Exploits can also be tested remotely from the monitoring webpage:

![Exploit Monitoring](https://raw.githubusercontent.com/Petitoto/chromium-exploit-dev/main/docs/assets/monitor.png)

## Disclaimer
This toolkit is intended strictly for security research. On its own, it does not provide any material to exploit undisclosed vulnerabilities in the Chromium project. Use of this toolkit for malicious purposes is solely your responsibility.

Public releases are licensed under the GNU AGPLv3 terms. Specifically, the trading of private exploits based on this toolkit is not permitted under these terms. Previous commits made before the first public release may be unlicensed and are protected by default copyright laws.

This project includes third-party licensed components: see [here](docs/third-party.md) for details.