Abstract

Browser security is always a prevalent topic in security research. Due to the great design and long-term effort, browsers have been more and more secure. The last time Chrome was pwned in Pwn2Own dates back to Mobile Pwn2Own 2016. In that contest, we, Keen Security Lab of Tencent, pwned Nexus 6P via Chrome browser. This year, we won the Chrome Pwnium(Guest to guest persistence root via webpage), which is the most valuable award in Chrome bounty. As we all know, exploitation is also a key point in Pwning contest. It requires full and in-depth knowledge of the target. In our talk, we will share some novel exploitation techniques we used in Pwn2Own and Pwnium. For instance, although most researchers have realized JIT is a good target for bug hunting on Javascript, few people notice it could also be used to do exploitation. We will show how we used some general JIT fragments to exploit low-quality bugs.

Besides, we'll share our research on Chrome sandbox escape. We will introduce some practical methods in sandbox exploitation, including a data-only attack to do CFI bypass.

Finally, we will bring a demo of full-chain exploitation of Chrome on Linux.