Abstract

Race condition is not a type of vulnerability that is commonly associated with Chrome. With javascript being single-threaded and the browser process running only on two threads (the UI and the IO thread), it is not difficult to see why this type of bugs is overlooked. Yet a cursory look at the publicly disclosed vulnerabilities in Chrome reveals that many of them, including some that are exploited in the wild, involve some kind of race conditions or timing issues.

For example, CVE-2019-5786(Clement Lecigne, Google TAG) and CVE-2019-13720(Anton Ivanov and Alexey Kulaev at Kaspersky Labs) are both UAF due to race conditions that had been exploited in the wild, while many the sandbox escapes also involves race conditions (e.g. Issue 1062091 (Tim Becker), Issue 1125614 (myself)).

In this talk, I'll use a number of publicly disclosed vulnerabilities and to illustrate some typical situations where race conditions can arise in Chrome, as well as discussing some techniques that an attacker can use to manipulate the timing and exploit these issues.