Since the introduction of the Chrome sandbox, there's been a need for exploit writers to break out of this sandbox. Over time the technologies used to implement the sandbox have evolved, and the technologies used to exploit sandbox vulnerabilities have also evolved. The current IPC mechanism used to implement sandbox broker functionality is called Mojo, and this talk is about the different ways that an attacker can turn a strong renderer vulnerability into the ability to send arbitrary IPC messages to break out of the sandbox.
The Chromium codebase includes bindings into v8 called MojoJS, which are used to implement privileged pages and are not available to a normal website. After our 2019 blog post described an easy way to re-enable these bindings, there was a significant increase in the number of reported Mojo vulnerabilities. This talk will explore the state of Chrome sandbox exploitation techniques in 2021, discussing the various methods that have been used to interact with Mojo interfaces in the exploits that we've seen, and the pros and cons of those approaches.
Mark Brand and Sergei Glazunov are software engineers at Google's Project Zero team, which aims to reduce harm caused by targeted attacks on the Internet. Their current focus is on web browser security.
