browser-exploitation-v8
This skill covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. Learn to build addrof and fakeobj primitives, corrupt ArrayBuffer backing stores, and leverage WASM RWX pages for renderer RCE and sandbox escape.
Browser Exploitation V8 teaches V8 JIT type confusion, bounds elimination, and Chrome sandbox escape techniques.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/browser-exploitation-v8 · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/browser-exploitation-v8 ~/.claude/skills/browser-exploitation-v8npx skillfed install yaklang/hack-skills/browser-exploitation-v8Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What V8 exploitation techniques does browser-exploitation-v8 teach?
browser-exploitation-v8 covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. The skill focuses on building addrof and fakeobj primitives from type confusion vulnerabilities, corrupting ArrayBuffer backing stores, and leveraging WASM RWX pages for renderer RCE and sandbox escape.
How can I build arbitrary read/write primitives using browser-exploitation-v8?
browser-exploitation-v8 teaches how to construct arbitrary read/write primitives from type confusion vulnerabilities in V8's JIT compiler. These primitives form the foundation for memory corruption attacks, enabling you to read and write arbitrary memory locations needed for further exploitation of the browser sandbox.
What is pointer compression V8 sandbox bypass in browser-exploitation-v8?
browser-exploitation-v8 covers pointer compression bypass techniques that allow attackers to circumvent V8's sandbox architecture. Understanding pointer compression mechanisms and their weaknesses is critical for developing reliable exploits that can escape the renderer process and achieve full browser compromise.
How does browser-exploitation-v8 explain renderer RCE via ArrayBuffer?
browser-exploitation-v8 demonstrates how to achieve renderer RCE by corrupting ArrayBuffer backing stores through type confusion and memory corruption primitives. By manipulating ArrayBuffer objects, attackers can gain arbitrary read/write access, which can then be leveraged to execute shellcode and compromise the renderer process.
What WebAssembly exploitation methods are covered in browser-exploitation-v8?
browser-exploitation-v8 teaches how to exploit WASM memory corruption to create RWX pages for shellcode execution in Chrome. By combining V8 memory corruption primitives with WebAssembly capabilities, attackers can bypass code execution restrictions and achieve full renderer compromise.
Does browser-exploitation-v8 cover Chrome IPC and Mojo exploitation?
browser-exploitation-v8 includes coverage of Chrome IPC and Mojo exploitation for full browser process compromise. This represents advanced attack surface beyond the renderer, enabling attackers to escalate from sandbox escape to complete browser takeover through inter-process communication vulnerabilities.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Browser / V8 Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier.
0. RELATED ROUTING
- sandbox-escape-techniques — Chrome renderer sandbox escape via IPC/Mojo
- heap-exploitation — general heap concepts applicable to V8 heap
-
stack-overflow-and-rop — ROP concepts for native code execution after V8 escape
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/browser-exploitation-v8/SKILL.md
skills/browser-exploitation-v8/V8_EXPLOITATION_PATTERNS.md