Chromium Exploit Development Toolkit

A toolkit for weaponizing Chromium vulnerabilities into reliable, cross-platform, full-chain exploits.

Overview

This project provides a set of powerful helper scripts but requires you to bring your own vulnerabilities. You are responsible for implementing minimal exploitation primitives, and the toolkit handles everything else.

A custom exploit chain relies on the main.js script file, which lets you selectively include your vulnerabilities alongside the toolkit’s helper scripts:

// Exploit settings
let loglevel = 5;
let run_in_worker = false;


// Exploit chain
async function main() {
    // Common helpers
    await include("kit/common/convert.js");
    await include("kit/common/dom.js");
    await include("kit/common/stability.js");
    await include("kit/common/v8-utils.js");
    await include("kit/common/versions.js");
    await include("kit/common/wasm-module-builder.js");

    // Symbols database for your exploit chain
    await include("vulns/symbols.js");

    // Early fingerprinting
    await include("kit/fingerprint/d8.js");
    await include("kit/fingerprint/useragent.js");

    // Your initial V8 memory corruption
    // This should craft addrOf() & fakeObj() primitives
    await include("vulns/memcor/your-code.js");

    // Bootstrap stage-2 primitives & gain memory read/write inside the V8 SBX
    await include("kit/v8/cage.js");

    // Your V8 sandbox escape
    // This should craft arbRead() & arbWrite() primitives AND leak some pointers
    await include("vulns/v8sbx/your-code.js");

    // Utils to manipulate the renderer memory
    await include("kit/v8/memory.js");

    // Achieve code execution (automatically select the best method based on the leaked pointers)
    await include("kit/v8/rwx/egghunt.js");
    await include("kit/v8/rwx/isolate.js");
    await include("kit/v8/rwx/partitionalloc.js");
    await include("kit/v8/rwx/wasmrwx.js");
    await include("kit/v8/rwx.js");

    // Bootstrap stage-3 primitives & provide generic shellcodes
    await include("kit/shellcodes/x64.js");
    await include("kit/shellcodes/x64-win.js");
    await include("kit/shellcodes/x64-linux.js");

    // Precise fingerprinting
    await include("kit/fingerprint/win.js");
    await include("kit/fingerprint/linux.js");

    // Enable MojoJS and other protected flags
    await include("kit/renderer/mojo.js");

    // Your sandbox escape
    await include("vulns/sbx/your-code.js");
}


/*
    Other customizable features are implemented here
    (logging, clean exit handling, exploit reloading, scripts execution context...)
    ...
*/

Read the documentation for a comprehensive overview of available features.

A testing webpage is provided in index.html. It prints logs, handles crashes and allows the main script to include files from the project's subfolders. You can run it locally using python3 server.py, then browse to http://localhost:8000.

The monitor.html webpage provides a simple interface to monitor and test exploits remotely. It displays remote hosts, exploit logs, and error statistics. It also allows sending commands to remote hosts, including exploit reloads and a stress-test mode.

For early exploit development, you can also run the main exploit script in d8: d8.exe main.js.

Once an exploit chain is ready, tools are provided to automate various tasks:

• build.py for building the exploit into a single script
• download.py for downloading specific Google Chrome releases
• symbols.py for automated PDB parsing
• & more!

Public exploits

Some exploits for public vulnerabilities are provided to showcase the toolkit's features:

V8 memory corruption

Vulnerability	Affected versions (Chrome Stable)	Details
CVE-2024-7971	<= 127	WASM type confusion during ParallelMove in Liftoff
CVE-2025-0291	128 - 131 (< 131.0.6778.264, vulnerable component shipped via Finch)	Type confusion in Turboshaft's WasmGCTypeAnalyzer on single-block loops
CVE-2025-2135	133 - 134 (< 134.0.6998.88)	Type confusion on aliasing objects in TransitionElementsKindOrCheckMap
CVE-2025-5419	<= 136 (Finch kill-switch from 133)	Out-of-bounds memory access because of invalid store-store elimination on dynamic indexes

V8 sandbox escape

Vulnerability	Affected versions (Chrome Stable)	Details
352689356	<= 131	WASM function signature confusion in non-inlined TurboFan call_ref
379140430	<= 132	Signature type confusion in WasmToJsWrapper tier-up with in-sandbox Tuple2 corruption
395659804	<= 134	Arbitrary code execution via OSR DeoptimizationData confusion
421403261	134 - 137 (< 137.0.7151.119, x64 only)	Signature hash i32/i64 collision in Liftoff

Browser sandbox escape

Vulnerability	Affected versions (Chrome Stable)	Details
CVE-2024-11114	94 - 130 (Windows only)	Mouse can be controlled using the startDragging() Mojo IPC interface to run downloaded files and escape the sandbox

Demo

A demonstration exploit chain is provided in the default main.js. It relies on the following vulnerabilities:

• CVE-2025-0291
• Issue 379140430
• CVE-2024-11114
• DLL hijacking in putty.exe (use putty.exe v0.68 & hijack winspool.drv to bypass Windows SmartScreen — exploit resources here)

This exploit chain works out-of-the-box on any Chrome 130 stable and extended releases up to 130.0.6723.160. It can be easily extended to M128, M129 and M131 (< 131.0.6778.264) by adding symbols.

demo.mp4

Exploits can also be tested remotely from the monitoring webpage:

Disclaimer

This toolkit is intended strictly for security research. On its own, it does not provide any material to exploit undisclosed vulnerabilities in the Chromium project. Use of this toolkit for malicious purposes is solely your responsibility.

Public releases are licensed under the GNU AGPLv3 terms. Specifically, the trading of private exploits based on this toolkit is not permitted under these terms. Previous commits made before the first public release may be unlicensed and are protected by default copyright laws.

This project includes third-party licensed components: see here for details.