CVE-2024-6778 PoC — Google Chrome 安全漏洞

Source

https://github.com/ading2210/CVE-2024-6778-POC

Associated Vulnerability

Title: Google Chrome 安全漏洞 (CVE-2024-6778)
Description:Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

Description

A POC exploit for CVE-2024-5836 and CVE-2024-6778, allowing for a sandbox escape from a Chrome extension.

Readme

#  CVE-2024-5836 / CVE-2024-6778 

This repository contains proof of concept exploits for [CVE-2024-5836](https://nvd.nist.gov/vuln/detail/CVE-2024-5836) and [CVE-2024-6778](https://nvd.nist.gov/vuln/detail/CVE-2024-6778), which are vulnerabilities within the Chromium web browser which allowed for a sandbox escape from a browser extension. To run these, you must be on a version of Chromium older than `126.0.6478.54`.

Write up: https://ading.dev/blog/posts/chrome_sandbox_escape.html

Bug report: https://issues.chromium.org/issues/338248595

Both the `CVE-2024-5386` and `CVE-2024-6778` directories contains a POC Chrome extension that is able to execute arbitrary JS on privileged WebUI pages. `CVE-2024-5386` relies on a race condition and is fairly unreliable, while `CVE-2024-6778` does not.

The `sandbox-escape` directory contains the full exploit chain, using `CVE-2024-6778` to gain code execution in `chrome://policy`, which leads to a sandbox escape by setting the legacy browser support policies. 

This repository is licensed under the MIT license.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →