Google Chrome 67 / 68 / 69 Object.create Type Confusion
Posted by deepcore on March 6, 2020 – 9:28 am
This Metasploit modules exploits a type confusion in Google Chrome’s JIT compiler. The Object.create operation can be used to cause a type confusion between a PropertyArray and a NameDictionary. The payload is executed within the rwx region of the sandboxed renderer process, so the browser must be run with the –no-sandbox option for the payload to work.
Post a reply
You must be logged in to post a comment.