browser-exploitation
Weaponize client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. This skill covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations. Includes scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
Browser Exploitation helps you chain client-side bugs from JS engine through sandbox layers to achieve host compromise.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/browser-exploitation · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/browser-exploitation ~/.claude/skills/browser-exploitationnpx skillfed install hypnguyen1209/offensive-claude/browser-exploitationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is browser-exploitation and what does it cover?
browser-exploitation is a skill for weaponizing client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. It covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations, along with scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
How do V8 JIT type confusion exploits work in browser-exploitation?
browser-exploitation teaches V8 JIT type confusion as a foundational technique for building complete exploit chains from JS engine bugs to RCE. Type confusion vulnerabilities in the JIT compiler allow attackers to corrupt object types in memory, enabling arbitrary read/write primitives that form the basis for escaping the V8 heap sandbox and progressing toward OS-level compromise.
What browser sandbox escape techniques does browser-exploitation teach?
browser-exploitation covers multiple sandbox escape vectors: heap sandbox escape using WASM pointers and addrof/fakeobj primitives, renderer-to-browser privilege escalation, and OS sandbox bypass through Mojo IPC abuse and GPU process vulnerabilities. These techniques chain together to move from renderer process compromise toward full system RCE.
How can browser-exploitation help exploit Electron RCE via IPC abuse?
browser-exploitation addresses Electron RCE by teaching IPC abuse and preload misconfiguration exploitation, including contextIsolation bypass and ASAR integrity tampering. These methods allow attackers to escape the renderer sandbox and achieve code execution in the main process, which typically runs with elevated privileges.
What OPSEC guidance does browser-exploitation provide for payloads?
browser-exploitation includes OPSEC-aware client-side payload development with detection evasion techniques. This covers building 1-click drive-by RCE chains that minimize forensic artifacts, evade endpoint detection, and maintain stealth during delivery and execution across modern browser architectures.
Does browser-exploitation cover GPU process and Mojo vulnerabilities?
Yes, browser-exploitation teaches fuzzing and exploitation of Mojo broker and GPU process vulnerabilities, including WebGPU GPU process use-after-free, ANGLE/Dawn GPU driver bugs, and Mojo IPC fuzzing harnesses. These represent the final sandbox layers between renderer and OS kernel.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: browser-exploitation description: Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains metadata: type: offensive phase: exploitation tools: d8, gdb-gef, pwndbg, lldb, WinDbg, IDA, Frida, jsvu, asar, electronegativity, Wireshark, mojo-tools mitre: [T1203, T1189, T1059.007, T1068, T1055, T1574] kill_chain: phase: [weaponize, deliver, exploit] step: [2, 3, 4] attck_tactics: [TA0042, TA0001, TA0002, TA0004] attck_techniques: [T1203, T1189, T1059.007, T1068, T1055.012, T1574.002] depends_on: [recon-osint, vulnerability-analysis, exploit-development, reverse-engineering] feeds_into: [initial-access, edr-evasion, shellcode-dev, privesc-windows, privesc-linux, red-team-ops] inputs: [target_browser_versions, vulnerability_list, crash_corpus, electron_app_build, attack_surface_map] outputs: [renderer_rw_primitive, sandbox_escape_poc, clientside_rce_chain, exploit_poc, finding_record] references: - references/v8-jit-typeconfusion.md - references/v8-sandbox-escape.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 12 files
skills/browser-exploitation/SKILL.md
skills/browser-exploitation/references/clientside-rce-chains.md
skills/browser-exploitation/references/electron-webview-rce.md
skills/browser-exploitation/references/renderer-to-browser-escape.md
skills/browser-exploitation/references/v8-jit-typeconfusion.md
skills/browser-exploitation/references/v8-sandbox-escape.md
skills/browser-exploitation/scripts/chain_server.py
skills/browser-exploitation/scripts/d8_debug.sh
skills/browser-exploitation/scripts/electron_audit.py
skills/browser-exploitation/scripts/mojo_fuzz_harness.py
skills/browser-exploitation/scripts/sandbox_escape.js
skills/browser-exploitation/scripts/v8_typer.js