Master of Pwn winner Manfred Paul details CVE-2024-2887 - a type confusion bug in Google Chrome and Microsoft Edge (Chromium) exploited for code execution in the renderer.
Exploiting V8 JavaScript & WebAssembly engine bypasses the Ubercage memory sandbox for arbitrary shellcode execution within browser sandbox.
Root cause of WebAssembly Universal Type Confusion explained, allowing declaration of struct types and recursive type groups in WebAssembly.
[
add
]
[
|
|
...
]