corpus.blog
43,317 blogs · 5,519,570 posts Claim your blog
Record · corpus.blog/posts/01a0878d-be1a-728d-b309-350831936ebc

Chrome Browser Exploitation, Part 3: Analyzing and Exploiting CVE-2018-17463

jhalon.github.io · published 29 December 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at jhalon.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
76
Words captured
34,050

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
chromereleases.googleblog.com
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/js-create-lowering.cc;l=1342?q=JSCreateObject%20&ss=chromium%2Fchromium%2Fsrc
source.chromium.org
https://bugs.chromium.org/p/chromium/issues/detail?id=888923
bugs.chromium.org
https://twitter.com/5aelo?lang=en
twitter.com
https://ssd-disclosure.com/hack2win-extreme-warm-up/
ssd-disclosure.com
https://ssd-disclosure.com/ssd-advisory-chrome-type-confusion-in-jscreateobject-operation-to-rce/
ssd-disclosure.com
https://www.youtube.com/watch?v=emt1yf2Fg9g
youtube.com
http://phrack.org/issues/70/9.html
phrack.org
https://twitter.com/exodusintel?lang=en
twitter.com
https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/
blog.exodusintel.com
https://source.chromium.org/chromium/chromium/src/+/52a9e67a477bdb67ca893c25c145ef5191976220:v8/src/compiler/js-generic-lowering.cc;l=404
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/builtins/object.tq;l=93
source.chromium.org
https://llvm.org/doxygen/classllvm_1_1TypeSwitch.html
llvm.org
https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Objects/Object_prototypes
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Inheritance_and_the_prototype_chain
developer.mozilla.org
JavaScript engine fundamentals: optimizing prototypes Read at the source ↗
mathiasbynens.be
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/create
developer.mozilla.org
https://gist.github.com/jhalon/5cbaab99dccadbf8e783921358020159
gist.github.com
https://docs.google.com/document/d/1FM4fQmIhEqPG8uGp5o9A-mnPB5BOeScZYpkHjo0KKA8/edit
docs.google.com
https://chromium-review.googlesource.com/c/v8/v8/+/3010195
chromium-review.googlesource.com
https://chromium.googlesource.com/v8/v8.git/+log/52a9e67a477bdb67ca893c25c145ef5191976220
chromium.googlesource.com
https://chromium-review.googlesource.com/c/chromium/src/+/1962898/1/build/toolchain/win/tool_wrapper.py
chromium-review.googlesource.com
https://bugs.chromium.org/p/chromium/issues/detail?id=1033106
bugs.chromium.org
https://chromium.googlesource.com/chromium/src/+/master/docs/windows_build_instructions.md
chromium.googlesource.com
https://developer.mozilla.org/en-US/docs/Web/API/console/assert
developer.mozilla.org
https://v8.dev/blog/hash-code
v8.dev
https://jayconrod.com/posts/52/a-tour-of-v8--object-representation
jayconrod.com
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/map
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Float64Array
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigUint64Array
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/toString
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DataView
developer.mozilla.org
https://microsoft.fandom.com/wiki/NX_bit
microsoft.fandom.com
https://github.com/v8/v8/commit/14917b6531596d33590edb109ec14f6ca9b95536
github.com
https://ctf101.org/binary-exploitation/return-oriented-programming/
ctf101.org
https://en.wikipedia.org/wiki/Virtual_method_table
en.wikipedia.org
https://securitylab.github.com/research/one_day_short_of_a_fullchain_renderer/
securitylab.github.com
https://twitter.com/33y0re
twitter.com
https://connormcgarr.github.io/type-confusion-part-2/
connormcgarr.github.io
https://webassembly.org/
webassembly.org
https://v8.dev/blog/liftoff
v8.dev
http://asmjs.org/spec/latest/
asmjs.org
https://twitter.com/spoofyroot/status/1379911787282243584
twitter.com
https://developer.mozilla.org/en-US/docs/WebAssembly/JavaScript_interface/Module
developer.mozilla.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/wasm/module-instantiate.cc
source.chromium.org
https://developer.mozilla.org/en-US/docs/WebAssembly/JavaScript_interface/Instance
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/WebAssembly/Exported_functions
developer.mozilla.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/wasm/wasm-objects.h;l=120
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/wasm/wasm-objects.h;l=327
source.chromium.org
Introduction to WebAssembly Read at the source ↗
rsms.me
https://bugs.chromium.org/p/v8/issues/detail?id=7758
bugs.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/wasm/jump-table-assembler.h
source.chromium.org
https://wasdk.github.io/WasmFiddle/
wasdk.github.io
https://learn.microsoft.com/en-us/windows/win32/memory/memory-protection-constants
learn.microsoft.com
https://www.exploit-db.com/shellcodes/49819
exploit-db.com
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray/set
developer.mozilla.org
https://github.com/jhalon/CVE-2018-17463
github.com
https://twitter.com/v3ded
twitter.com
http://www.phrack.org/issues/70/3.html
phrack.org
https://www.youtube.com/@BlackHatOfficialYT
youtube.com
https://www.exploit-db.com/exploits/48184
exploit-db.com
https://github.com/kdmarti2/CVE-2018-17463
github.com
https://github.com/m1ghtym0/browser-pwn
github.com
https://github.com/Escapingbug/awesome-browser-exploit
github.com
https://liveoverflow.com/getting-into-browser-exploitation-new-series-introduction-browser-0x00/ Read at the source ↗
liveoverflow.com
https://googleprojectzero.blogspot.com/2020/09/jitsploitation-two.html
googleprojectzero.blogspot.com
https://y4y.space/2022/08/05/browser-exploitation-a-case-study-of-cve-2020-6507/
y4y.space
https://zon8.re/posts/javascript-engine-fuzzing-and-exploitation-reading-list/
zon8.re
https://liveoverflow.com/revisiting-javascriptcore-internals-boxed-vs-unboxed-browser-0x06/ Read at the source ↗
liveoverflow.com
https://www.madstacks.dev/posts/V8-Exploitation-Series-Part-6/
madstacks.dev
https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/
abiondo.me
Elsewhere on jhalon.github.io (2)