https://iamelli0t.github.io/tags/chrome/Recent content in Chrome on iamelli0t's blogHugoenTue, 20 Apr 2021 00:00:00 +0000https://iamelli0t.github.io/2021/04/20/Chromium-Issue-1196683-1195777/Tue, 20 Apr 2021 00:00:00 +0000https://iamelli0t.github.io/2021/04/20/Chromium-Issue-1196683-1195777/<p>On April 12, a code commit[1] in Chromium get people&rsquo;s attention. This is a bugfix for some vulnerability in Chromium Javascript engine v8. At the same time, the regression test case regress-1196683.js for this bugfix was also submitted. Based on this regression test case, some security researcher published an exploit sample[2]. Due to Chrome release pipeline, the vulnerability wasn&rsquo;t been fixed in Chrome stable update until April 13[3]. <br></p> <p>Coincidentally, on April 15, another code commit[4] of some bugfix in v8 has also included one regression test case regress-1195777.js. Based on this test case, the exploit sample was exposed again[5]. Since the latest Chrome stable version does not pull this bugfix commit, the sample can still exploit in render process of latest Chrome. When the vulnerable Chormium browser accesses a malicious link without enabling the sandbox (&ndash;no-sandbox), the vulnerability will be triggered and caused remote code execution.<br></p>