Sandboxed remote code execution in Google Chrome ANGLE on Mac

This repository is a small, self-contained browser exploit research PoC for CVE-2026-9999 targeting Google Chrome/Chromium on macOS. It contains two files: a README with setup and testing guidance, and a single HTML file that serves as the actual harness. The exploit is not a full remote code execution chain or sandbox escape; instead, it is a hypothesis-driven WebGL2 crash-hunting harness intended to exercise the ANGLE Metal backend with crafted shaders in order to reproduce sandboxed code-execution-related instability or GPU-process crashes. The main exploit file, cve-2026-9999-poc.html, is a standalone HTML/JavaScript page with no external dependencies. On load, it fingerprints the browser via navigator.userAgent to determine whether the target is Chrome on macOS and whether the version is below the fixed build 148.0.7778.216. It creates a WebGL2 context and registers a webglcontextlost handler, treating context loss as a likely GPU-process crash or hang. The harness includes two primary capabilities: (1) curated trigger execution and (2) token-level GLSL fuzzing. The curated trigger set contains eight fragment shader patterns designed to stress historically fragile shader translation/state-validation paths: out-of-bounds constant indexing, dynamic matrix indexing, integer overflow behavior, extreme loop unrolling, arrays-of-arrays, discard/swizzle interactions, macro expansion edge cases, and a large uniform buffer object declaration. Each trigger is compiled, linked, used, drawn, and followed by readPixels to force shader/program validation and execution. The fuzzer generates randomized fragment shaders by assembling statement templates and replacing placeholders with edge-case numeric values, loop counts, indices, masks, array lengths, and swizzle patterns. It repeatedly compiles and executes these shaders in a tight asynchronous loop. If execution fails or the context is lost, the harness logs the event and stores the candidate crashing shader in localStorage for later minimization and triage. There are no hardcoded C2 endpoints, reverse shells, or post-exploitation payloads. The code does not attempt persistence, privilege escalation, or data exfiltration. Its purpose is limited to local browser-side triggering and crash discovery. Because it requires a user to open a crafted HTML page in a vulnerable browser, the attack vector is browser/web-based. Overall maturity is best classified as POC: it is a functional research harness for vulnerability reproduction/hunting, but not a weaponized exploit chain.

This repository is a small Python proof-of-concept/demo for CVE-2026-9999, a serverless event injection vulnerability leading to path traversal and insecure file write, culminating in code execution on the next function invocation. The repo contains two code files: vulnerable_serverless.py, which implements a simulated AWS Lambda-like HTTP runtime, and exploit_event_injection.py, which sends a crafted POST request to abuse the flaw. The vulnerable runtime listens on port 8000 and processes JSON POST bodies as events. If event.source == 'storage', it reads event['object']['key'], joins it with FUNCTION_DIR (/tmp/function), normalizes the path, and writes attacker-supplied code to the resulting path without validating that the resolved path remains inside the intended directory. This enables traversal-based overwrite of handler.py. For non-storage events, the runtime imports handler and executes handler.handler(event), thereby running the attacker-written code. The exploit script performs two stages: first, it sends a malicious storage event to http://127.0.0.1:8000 with object.key set to ../../../tmp/function/handler.py and code containing a replacement Python handler that runs os.popen('id').read(); second, it sends a normal invocation event to trigger execution of the overwritten handler and prints the returned command output. The exploit is operational but basic: it uses a hardcoded payload and local demo endpoint rather than a generalized framework or configurable target set.