CSIT Demonstrates Full-Chain Browser Exploitation from Chromium Renderer to Windows System Privileges

Ernest Ang from CSIT's mobile security department presented a full-chain browser exploitation demonstrating how to escalate from a Chromium renderer process to system-level privileges on Windows. The exploit chain begins with a V8 parser vulnerability that allows incorrect bytecode generation by tricking the parser into thinking the this keyword is used when it isn't, which through bytecode flushing and lazy parsing creates an inconsistent bytecode generation primitive that escalates to arbitrary read/write within the V8 heap. The exploit bypasses the V8 sandbox (Ubercage) by exploiting the external pointer table to achieve type confusion between DOM objects, ultimately gaining code execution through WebAssembly's RWX memory regions. The second stage exploits a logic bug in Chrome's browser process (CVE unspecified) that allows arbitrary mouse control through the StartDragging mojo API, enabling forced clicks on downloaded executables to achieve medium integrity execution. The final stage exploits a race condition use-after-free vulnerability in the Windows CLFS driver involving the fs_context_to object, chaining it with the HalDispatchTable technique to enable all privilege bits on the current process token and achieve system-level access. All vulnerabilities discussed have been patched, and the demonstration achieved only a 30% success rate without addressing Mark of the Web protections or EDR evasion.