browser-exploitation

name	browser-exploitation
description	Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains
metadata	{"type":"offensive","phase":"exploitation","tools":"d8, gdb-gef, pwndbg, lldb, WinDbg, IDA, Frida, jsvu, asar, electronegativity, Wireshark, mojo-tools","mitre":["T1203","T1189","T1059.007","T1068","T1055","T1574"]}
kill_chain	{"phase":["weaponize","deliver","exploit"],"step":[2,3,4],"attck_tactics":["TA0042","TA0001","TA0002","TA0004"],"attck_techniques":["T1203","T1189","T1059.007","T1068","T1055.012","T1574.002"]}
depends_on	["recon-osint","vulnerability-analysis","exploit-development","reverse-engineering"]
feeds_into	["initial-access","edr-evasion","shellcode-dev","privesc-windows","privesc-linux","red-team-ops"]
inputs	["target_browser_versions","vulnerability_list","crash_corpus","electron_app_build","attack_surface_map"]
outputs	["renderer_rw_primitive","sandbox_escape_poc","clientside_rce_chain","exploit_poc","finding_record"]
references	["references/v8-jit-typeconfusion.md","references/v8-sandbox-escape.md","references/renderer-to-browser-escape.md","references/electron-webview-rce.md","references/clientside-rce-chains.md"]
scripts	["scripts/v8_typer.js","scripts/sandbox_escape.js","scripts/mojo_fuzz_harness.py","scripts/electron_audit.py","scripts/chain_server.py","scripts/d8_debug.sh"]

Browser & Client-Side Exploitation

Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.

When to Activate

• A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become addrof/fakeobj and an in-renderer arbitrary R/W.
• An in-renderer R/W exists but is trapped inside the V8 heap sandbox (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.
• A renderer is fully compromised and you need to escape the OS sandbox via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).
• Auditing or exploiting an Electron / CEF / WebView2 app: contextIsolation/nodeIntegration/sandbox misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.
• Assembling a 1-click drive-by RCE chain (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.
• Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
JIT type confusion (TurboFan/Maglev/Turboshaft)	T1203	CWE-843	references/v8-jit-typeconfusion.md	scripts/v8_typer.js
Element-kind confusion -> addrof/fakeobj	T1203	CWE-843	references/v8-jit-typeconfusion.md	scripts/v8_typer.js
OOB read/write on JSArray/TypedArray	T1203	CWE-787	references/v8-jit-typeconfusion.md	scripts/v8_typer.js
In-renderer arbitrary R/W (fake TypedArray)	T1203	CWE-787	references/v8-jit-typeconfusion.md	scripts/v8_typer.js
V8 heap-sandbox escape via raw Wasm pointer