Cross-origin data disclosure in Google Chrome WebUI

This repository is a small standalone proof-of-concept for a stack buffer overflow in a custom Base64 decoder, identified in the README as CVE-2026-11105. It contains four files: a LICENSE, a README describing the issue and compilation steps, the vulnerable C source (base64_vuln.c), and a minimal Python helper script (exploit_base64_overflow.py). The core vulnerability is in base64_decode() in base64_vuln.c. The function decodes Base64 input into an output buffer but never checks whether outpos exceeds outlen before writing 1-3 bytes per 4-byte input chunk. In main(), decoded output is written into a fixed 8-byte stack buffer (smallbuf), while a much longer Base64 string is supplied, creating a straightforward stack overflow condition. Exploit capability is limited but real: the included Python script generates a long string of 'A' characters and pipes it into the compiled binary, serving as a local overflow trigger. However, the current C program does not actually read stdin, so the Python script is more demonstrative than fully integrated; the hardcoded call in main() is the actual trigger path present in code. The repository therefore demonstrates the vulnerable condition and a basic triggering method rather than a polished end-to-end exploit with control-flow hijacking, shellcode, or a reverse shell. There are no network indicators, remote URLs, IPs, or C2 endpoints in the code. The only fingerprintable execution target is the local binary path ./base64_vuln. Overall, this is a local proof-of-concept repository showing how unchecked output writes in a decoder can overflow a stack buffer and potentially lead to code execution if compiled without modern mitigations.