Abstract

With introduction of new mitigations and sandboxes, it is becoming more hard to exploit modern web browsers. In the past, a single V8 RCE vulnerability was enough to totally compromise the renderer process in Chrome but things have changed. With the new V8 Sandbox in place, additional bypass vulnerability is required to compromise the Chrome renderer.

In this presentation, we will explore the inner workings of the V8 Sandbox, a critical component of V8 Javascript engine that ensures the safe execution of the code within the Chrome browser. It is designed to isolate and protect the execution environment from potentially malicious code, thereby protecting user's system. We will delve into its architecture, and review how bypasses have evolved over time.

Next, we will look at the V8 Sandbox bypass vulnerability which was publicly disclosed earlier this year. Bypass was possible due to raw Heap pointer being writable inside the sandbox. According to the crbug tracker, this issue was known to Google since June 2022 but the fix was landed in April 2024. How we developed the exploit by creating a fake Isolate before it was patched will be explained in detail.

Finally, presentation will be concluded with upcoming changes to the V8 Sandbox implementation and ideas for future V8 Sandbox bypasses.