Expert publicly released Chromium-based browsers exploit demonstrated at Pwn2Own 2021

An Indian security researcher has published a proof-of-concept (PoC) exploit code for a vulnerability impacting Google Chrome and other Chromium-based browsers.

The Indian security researcher Rajvardhan Agarwal has publicly released a proof-of-concept exploit code for a recently discovered vulnerability that affects Google Chrome, Microsoft Edge, and other Chromium-based browsers (i.e. Opera, Brave).

The researchers uploaded the PoC code on GitHub and announced its availability via Twitter:

According to The Record, the PoC code released by the experts was the same exploited by the security duo composed of Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow during the Pwn2Own 2021 hacking contest.

 The two experts earned $100,000 for demonstrating an exploit for Chrome and Microsoft Edge web browsers.

“The team used a Typer Mismatch bug to exploit the Chrome renderer and Microsoft Edge. Same exploit for both browsers. They earn $100,000 total and 10 Master of Pwn points.” states the post published on the official site of the competition.

The two experts provided details about their exploit to the Chrome security team so the bug could be addressed but did not publicly share them. Google addressed the flaw, but Agarwal made a reverse engineering of the patch developed by the tech giant. The Indian researchers analyzed the changes introduced to the component of the Chromium open-source browser project, the V8 JavaScript engine, and understood how the original exploit was working.

The bad news is that the patch has yet to be implemented into official releases of the major Chromium-based browsers, including Chrome and Edge, that remain vulnerable to the attack.

The partially good news is that the code released by Agarwal only allows an attacker to run malicious code on a user’s operating system but is not able to escape the Chrome sandbox, which means that it could not be used to compromise the underlying machine.

Anyway, we cannot exclude that threat actors could chain the zero-day with a sandbox escape exploit to weaponize Agarwal’s PoC code.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Chrome zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]