Is it really exploitable? about chromium-941743

[sucrose]

I can't find any information about this exploit. Visiting https://bugs.chromium.org/p/chromium/issues/detail?id=941743 throws a Permission Denied.

[ducphanduyagentp]

@sucrose @hardhub The detail about the exploit development process can be found here: https://blog.exodusintel.com/2019/04/03/a-window-of-opportunity/

They also mentioned that it needs a sandbox escape for a full chain, so I don't think this works with the sandbox.

@sucrose @hardhub The detail about the exploit development process can be found here: https://blog.exodusintel.com/2019/04/03/a-window-of-opportunity/

They also mentioned that it needs a sandbox escape for a full chain, so I don't think this works with the sandbox.

If it is correct then what is the risk for real user which uses chrome in sandbox?

[P1umer]

I am confused why this exp cannot be run on UBUNTU except for the effects of shellcode...
I re-written it again and found that the problem is on read8(). Why can't the read8 function repeatedly modify the buffer_backing_store?
The second call to read8() always gives an error: "Trace/breakpoint trap (core dumped)"