browser-exploitation
Weaponize client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. This skill covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations. Includes scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
Browser Exploitation helps you chain client-side bugs from JS engine through sandbox layers to achieve host compromise.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Browser Exploitation helps you chain client-side bugs from JS engine through sandbox layers to achieve host compromise. Weaponize client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. This skill covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations. Includes scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
Use it when
- browser-exploitation teaches V8 JIT type confusion as a foundational technique for building complete exploit chains from JS engine bugs.
- browser-exploitation covers multiple sandbox escape vectors: heap sandbox escape using WASM pointers and addrof/fakeobj primitives.
Verify before relying
Read SKILL.md below before installing (12 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/browser-exploitation · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is browser-exploitation and what does it cover?
browser-exploitation is a skill for weaponizing client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. It covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations, along with scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
How do V8 JIT type confusion exploits work in browser-exploitation?
browser-exploitation teaches V8 JIT type confusion as a foundational technique for building complete exploit chains from JS engine bugs to RCE. Type confusion vulnerabilities in the JIT compiler allow attackers to corrupt object types in memory, enabling arbitrary read/write primitives that form the basis for escaping the V8 heap sandbox and progressing toward OS-level compromise.
What browser sandbox escape techniques does browser-exploitation teach?
browser-exploitation covers multiple sandbox escape vectors: heap sandbox escape using WASM pointers and addrof/fakeobj primitives, renderer-to-browser privilege escalation, and OS sandbox bypass through Mojo IPC abuse and GPU process vulnerabilities. These techniques chain together to move from renderer process compromise toward full system RCE.
How can browser-exploitation help exploit Electron RCE via IPC abuse?
browser-exploitation addresses Electron RCE by teaching IPC abuse and preload misconfiguration exploitation, including contextIsolation bypass and ASAR integrity tampering. These methods allow attackers to escape the renderer sandbox and achieve code execution in the main process, which typically runs with elevated privileges.
What OPSEC guidance does browser-exploitation provide for payloads?
browser-exploitation includes OPSEC-aware client-side payload development with detection evasion techniques. This covers building 1-click drive-by RCE chains that minimize forensic artifacts, evade endpoint detection, and maintain stealth during delivery and execution across modern browser architectures.
Does browser-exploitation cover GPU process and Mojo vulnerabilities?
Yes, browser-exploitation teaches fuzzing and exploitation of Mojo broker and GPU process vulnerabilities, including WebGPU GPU process use-after-free, ANGLE/Dawn GPU driver bugs, and Mojo IPC fuzzing harnesses. These represent the final sandbox layers between renderer and OS kernel.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: browser-exploitation description: Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains metadata: type: offensive phase: exploitation tools: d8, gdb-gef, pwndbg, lldb, WinDbg, IDA, Frida, jsvu, asar, electronegativity, Wireshark, mojo-tools mitre: [T1203, T1189, T1059.007, T1068, T1055, T1574] kill_chain: phase: [weaponize, deliver, exploit] step: [2, 3, 4] attck_tactics: [TA0042, TA0001, TA0002, TA0004] attck_techniques: [T1203, T1189, T1059.007, T1068, T1055.012, T1574.002] depends_on: [recon-osint, vulnerability-analysis, exploit-development, reverse-engineering] feeds_into: [initial-access, edr-evasion, shellcode-dev, privesc-windows, privesc-linux, red-team-ops] inputs: [target_browser_versions, vulnerability_list, crash_corpus, electron_app_build, attack_surface_map] outputs: [renderer_rw_primitive, sandbox_escape_poc, clientside_rce_chain, exploit_poc, finding_record] references: - references/v8-jit-typeconfusion.md - references/v8-sandbox-escape.md -
(truncated - see the full file via the links below)
File tree — 12 files
skills/browser-exploitation/SKILL.md
skills/browser-exploitation/references/clientside-rce-chains.md
skills/browser-exploitation/references/electron-webview-rce.md
skills/browser-exploitation/references/renderer-to-browser-escape.md
skills/browser-exploitation/references/v8-jit-typeconfusion.md
skills/browser-exploitation/references/v8-sandbox-escape.md
skills/browser-exploitation/scripts/chain_server.py
skills/browser-exploitation/scripts/d8_debug.sh
skills/browser-exploitation/scripts/electron_audit.py
skills/browser-exploitation/scripts/mojo_fuzz_harness.py
skills/browser-exploitation/scripts/sandbox_escape.js
skills/browser-exploitation/scripts/v8_typer.js
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Build a complete browser exploit chain from JS engine bug to RCE”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
This skill covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. Learn to build addrof and fakeobj primitives, corrupt ArrayBuffer backing stores, and leverage WASM RWX pages for renderer RCE and sandbox escape.
A comprehensive playbook for escaping multiple sandbox types encountered in CTF competitions and security research. Covers Python pyjail breakouts, Lua environment bypasses, seccomp filter evasion, chroot jailbreaks, container escape vectors, browser sandbox circumvention, and namespace isolation techniques. Includes decision trees and code patterns for each sandbox variant.
Windows Boundaries equips you with techniques and tools to cross Windows security boundaries—from kernel/user mode transitions via win32k/dxgkrnl exploits and BYOVD drivers, to UAC elevation, AppContainer/LPAC sandbox escapes, PPL circumvention, and RPC/ALPC-based token impersonation. Includes enumeration scripts, proof-of-concept exploits, and OPSEC guidance for each attack vector.
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.