The Indian security researcher Rajvardhan Agarwal has publicly released a proof-of-concept exploit code for a recently discovered vulnerability that affects Google Chrome, Microsoft Edge, and other Chromium-based browsers (i.e. Opera, Brave).
The researchers uploaded the PoC code on GitHub and announced its availability via Twitter:
According to The Record, the PoC code released by the experts was the same exploited by the security duo composed of Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow during the Pwn2Own 2021 hacking contest.
The two experts earned $100,000 for demonstrating an exploit for Chrome and Microsoft Edge web browsers.
“The team used a Typer Mismatch bug to exploit the Chrome renderer and Microsoft Edge. Same exploit for both browsers. They earn $100,000 total and 10 Master of Pwn points.” states the post published on the official site of the competition.
The two experts provided details about their exploit to the Chrome security team so the bug could be addressed but did not publicly share them. Google addressed the flaw, but Agarwal made a reverse engineering of the patch developed by the tech giant. The Indian researchers analyzed the changes introduced to the component of the Chromium open-source browser project, the V8 JavaScript engine, and understood how the original exploit was working.
The bad news is that the patch has yet to be implemented into official releases of the major Chromium-based browsers, including Chrome and Edge, that remain vulnerable to the attack.
The partially good news is that the code released by Agarwal only allows an attacker to run malicious code on a user’s operating system but is not able to escape the Chrome sandbox, which means that it could not be used to compromise the underlying machine.
Anyway, we cannot exclude that threat actors could chain the zero-day with a sandbox escape exploit to weaponize Agarwal’s PoC code.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Chrome zero-day)
[adrotate banner=”5″]
[adrotate banner=”13″]
Microsoft Patch Tuesday security updates for May 2025 addressed 75 security flaws across multiple products, including…
Fortinet fixed a critical remote code execution zero-day vulnerability actively exploited in attacks targeting FortiVoice…
Interlock Ransomware 's attack on a defense contractor exposed global defense supply chain details, risking…
Marks and Spencer (M&S) confirms that threat actors stole customer data in the ransomware attack…
A 45-year-old foreign man has been arrested in Moldova for allegedly participating in ransomware attacks…
A Türkiye-linked group used an Output Messenger zero-day to spy on Kurdish military targets in…
This website uses cookies.
