Type Confusion in Google Chrome V8

This repository contains a fully functional exploit for CVE-2023-6702, a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The exploit targets Chrome versions prior to 120.0.6099.109 and achieves remote code execution in the renderer process. The repository includes several files: - README.md: Provides a detailed technical write-up of the vulnerability, exploitation strategy, and references to related research and patches. - exploit.html: The main exploit file, containing JavaScript code that leverages the vulnerability to gain arbitrary read/write primitives, leak addresses, and execute a ROP chain to run arbitrary system commands (e.g., launching xcalc via /bin/bash). - fake_frame.js: Contains helper code for constructing fake async stack frames, used as part of the exploitation process. - index.html: Orchestrates the attack by creating multiple iframes that load the exploit, simulating a real-world attack scenario where a user visits a malicious web page. - poc.js: A minimal proof-of-concept script demonstrating the initial trigger of the vulnerability. The exploit is operational and demonstrates a full chain from vulnerability trigger to code execution. The attack vector is via the browser, requiring the victim to visit a malicious web page. The exploit is highly technical, leveraging advanced JavaScript and V8 internals, and is suitable for researchers or red teamers. The payload is customizable but, as provided, launches a system command on the target. The repository does not use any exploit frameworks and is a standalone exploit.