/browser-exploitation

name: browser-exploitation
description: Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains
metadata:
  type: offensive
  phase: exploitation
  tools: d8, gdb-gef, pwndbg, lldb, WinDbg, IDA, Frida, jsvu, asar, electronegativity, Wireshark, mojo-tools
  mitre: [T1203, T1189, T1059.007, T1068, T1055, T1574]
kill_chain:
  phase: [weaponize, deliver, exploit]
  step: [2, 3, 4]
  attck_tactics: [TA0042, TA0001, TA0002, TA0004]
  attck_techniques: [T1203, T1189, T1059.007, T1068, T1055.012, T1574.002]
depends_on: [recon-osint, vulnerability-analysis, exploit-development, reverse-engineering]
feeds_into: [initial-access, edr-evasion, shellcode-dev, privesc-windows, privesc-linux, red-team-ops]
inputs: [target_browser_versions, vulnerability_list, crash_corpus, electron_app_build, attack_surface_map]
outputs: [renderer_rw_primitive, sandbox_escape_poc, clientside_rce_chain, exploit_poc, finding_record]
references:
  - references/v8-jit-typeconfusion.md
  - references/v8-sandbox-escape.md
  - references/renderer-to-browser-escape.md
  - references/electron-webview-rce.md
  - references/clientside-rce-chains.md
scripts:
  - scripts/v8_typer.js
  - scripts/sandbox_escape.js
  - scripts/mojo_fuzz_harness.py
  - scripts/electron_audit.py
  - scripts/chain_server.py
  - scripts/d8_debug.sh

Browser & Client-Side Exploitation

Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.

When to Activate

• A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become `addrof`/`fakeobj` and an in-renderer arbitrary R/W.
• An in-renderer R/W exists but is trapped inside the **V8 heap sandbox** (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.
• A renderer is fully compromised and you need to escape the **OS sandbox** via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).
• Auditing or exploiting an **Electron / CEF / WebView2** app: `contextIsolation`/`nodeIntegration`/`sandbox` misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.
• Assembling a **1-click drive-by RCE chain** (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.
• Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | JIT type confusion (TurboFan/Maglev/Turboshaft) | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js | | Element-kind confusion -> addrof/fakeobj | T1203 | CWE-843 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js | | OOB read/write on JSArray/TypedArray | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js | | In-renderer arbitrary R/W (fake TypedArray) | T1203 | CWE-787 | references/v8-jit-typeconfusion.md | scripts/v8_typer.js | | V8 heap-sandbox escape via raw Wasm pointer | T1203 | CWE-787 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js | | Trusted Pointer Table / WasmExportedFunctionData abuse | T1203 | CWE-843 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js | | Code/exec via Wasm JIT region pivot | T1203 | CWE-94 | references/v8-sandbox-escape.md | scripts/sandbox_escape.js | | Mojo IPC handle-confusion sandbox escape | T1203 | CWE-269 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py | | GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) | T1203 | CWE-416 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py | | Mojo interface fuzzing for broker bugs | T1203 | CWE-20 | references/renderer-to-browser-escape.md | scripts/mojo_fuzz_harness.py | | Electron contextIsolation/IPC bridge RCE | T1059.007 | CWE-1188 | references/electron-webview-rce.md | scripts/electron_audit.py | | nodeIntegration / webviewTag preload abuse | T1059.007 | CWE-829 | references/electron-webview-rce.md | scripts/electron_audit.py | | ASAR integrity / fuse / V8 snapshot tamper | T1574.002 | CWE-345 | references/electron-webview-rce.md | scripts/electron_audit.py | | XSS/open-redirect -> Electron RCE | T1189 | CWE-79 | references/electron-webview-rce.md | scripts/electron_audit.py | | 1-click drive-by chain delivery | T1189 | CWE-693 | references/clientside-rce-chains.md | scripts/chain_server.py | | Cross-engine (JSC/WebKit) primitive port | T1203 | CWE-843 | references/clientside-rce-chains.md | scripts/chain_server.py |

Quick Start

# 0. Pin the exact target build (Chrome/Edge/Electron all carry a V8 version)
#    chrome://version  | edge://version  | electron --version
jsvu --engines=v8                                   # local d8 of matching version
./scripts/d8_debug.sh ./d8 ./poc.js                 # d8 w/ exploit-friendly flags

# 1. Engine bug -> in-renderer R/W  (see references/v8-jit-typeconfusion.md)
d8 --allow-natives-syntax --shell ./scripts/v8_typer.js
#   yields addrof(), fakeobj(), read64()/write64() inside the V8 heap cage

# 2. Escape the V8 heap sandbox -> native R/W  (references/v8-sandbox-escape.md)
d8 --no-sandbox-testing-mode ./scripts/sandbox_escape.js   # local test;
#   on a real build: abuse trusted Wasm object raw pointer -> overwrite RWX Wasm code

# 3. Escape the OS sandbox: Mojo broker logic bug OR GPU-process memory bug
python3 scripts/mojo_fuzz_harness.py --interface File