Glad to be here again, #1 this year. Thanks to everyone, and still the same as I said last year, the Chrome team and the VRP team are indeed excellent teams.
๐ฏAs we wrap up 2022, the Chrome VRP is pleased to announce the top Chrome VRP Researchers of 2022. Congratulations and great work!
Thank you for all your contributions and efforts over this past year & helping us make Chrome Browser and Chrome OS more secure for all users!
My virtual session at BlackHat has been canceled halfway (due to connecting issue I think?) ๐ I wonder if it's just me or such things may happen in other session
As we are wrapping up 2021, the Chrome VRP is pleased to announce the Top 20 Chrome VRP Researchers for this year. Congratulations and great work!
Thank you for your contributions and efforts over this past year in helping us make Chrome Browser and Chrome OS safe for all users!
This week we are starting an experiment that enables V8's Virtual Memory Cage in Chrome on Desktop (currently only on Dev + Canary channels, then Beta and finally Stable). Here is how that'll work:
Check out how we used 32gb of RAM to exploit a zero-day WebAssembly Vulnerability (CVE-2021-30734) in Apple Safari / JavaScriptCore at #Pwn2Own in 2021:
https://t.co/CCcc5RVugk
I suggest v8 dev consider to refactor part of the typer system. It seems like hard to kill all typer bugs and system is very friendly for exploitation. I've thought about it and have some ideas. Welcome everyone to discuss.@v8js
In this series of posts I'll exploit 3 bugs that I reported last year. Together they can form a full chain from Chrome beta v86 to the Android kernel. The first post is about exploiting a UAF in the kernel reachable from the App sandbox: https://t.co/A7RIzV3RoF