exodusintel / chromium-941743

Chrome v8 1Day Exploit by István Kurucsai

Chrome 73.0.3683.86 stable exploit for chromium issue 941743, tested on Windows 10 x64.

• start chrome with the --no-sandbox argument
• navigate to exp.html and start the exploit by pressing the button

chromium-941743's Issues

How use different shellcode?

Hello! I'm new to exploits. How can I use different shellcode? What is sfi?

32-bit exploit?

The exploit is interesting and very well written. Reading about the exploit primitive with the dictionary write, it looks like it is not possible to exploit this on a 32-bit platform - it seems to write 64 bits into the length field, which works on a 64-bit platform, but would corrupt the map on a 32-bit platform. Is this true? Is this unexploitable on a 32-bit system?

Is it really exploitable?

start chrome with the --no-sandbox argument

Does it mean this bug cannot be used for RCE due to sandbox?
So we can avoid real attack while we are in sandbox?