Use-after-free in Google Chrome Storage

This repository is a small proof-of-concept exploit support repo for CVE-2025-11460, a Chromium IndexedDB use-after-free that can be triggered from a malicious webpage and reaches the unsandboxed browser process via Mojo IPC. The repo does not contain a complete standalone exploit webpage in the provided snapshot; instead, it contains supporting scripts and source patches used to prepare a vulnerable/instrumented Chromium build for exploitation and demonstration. Repository structure: README.md explains the vulnerability, exploitation concept, and reproduction workflow. disable_aslr.py is a Python utility that modifies a Windows PE executable to clear the ASLR bit and writes a new .noaslr executable, improving exploit reliability. copy_mojo_js_bindings.py recursively copies mojo_bindings.js and generated .mojom.js files from a Chromium build tree into a PoC web directory so the browser-side exploit page can use Mojo JS interfaces. renderer.patch changes Blink's IndexedDB deleteDatabase() path to force force_close=true, likely making the vulnerable race easier to trigger deterministically. v8.patch is the most security-relevant code artifact: it adds a global JavaScript object named POCHelper to V8 with helper methods getBaseOf, readBits, and writeBits, enabling direct module base discovery and arbitrary memory read/write from JavaScript in a custom build. Main exploit capability: the intended chain is browser/web-based exploitation of an IndexedDB UAF to gain code execution in the browser process. The included V8 patch effectively supplies post-corruption primitives for memory access, making the PoC operational rather than a pure crash reproducer. The README states the demonstrated result is spawning cmd and calc on Windows. Because the actual HTML/JS trigger is not present here, this repo is best understood as exploit-enablement infrastructure and patch set for a custom Chromium build rather than a turnkey public exploit. Notable observables and targets: the only explicit network endpoint is a locally hosted PoC at http://localhost:1337 served with python -m http.server 1337. The exploit targets Chromium/Chrome on Windows, requires MojoJS to be enabled, and depends on local files such as chrome.exe/chrome.noaslr.exe and copied Mojo JS bindings. No external C2, hardcoded remote IPs, or exfiltration endpoints are present.