browser-exploitation

Name: browser-exploitation
Author: hypnguyen1209

320stars55forks

How to install browser-exploitation?

hypnguyen1209/offensive-claude/browser-exploitation

$npx -y skills add hypnguyen1209/offensive-claude --skill browser-exploitation

Installs into the current project.

Summary

Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains

Files · 1

View on GitHub

SKILL.md

1	# Browser & Client-Side Exploitation
2
3	Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.
4
5	## When to Activate
6
7	- A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become `addrof`/`fakeobj` and an in-renderer arbitrary R/W.
8	- An in-renderer R/W exists but is trapped inside the V8 heap sandbox (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.
9	- A renderer is fully compromised and you need to escape the OS sandbox via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).
10	- Auditing or exploiting an Electron / CEF / WebView2 app: `contextIsolation`/`nodeIntegration`/`sandbox` misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.
11	- Assembling a 1-click drive-by RCE chain (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.
12	- Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.
13
14	## Technique Map
15
16	\| Technique \| ATT&CK \| CWE \| Reference \| Script \|
17	\|-----------\|--------\|-----\|-----------\|--------\|
18	\| JIT type confusion (TurboFan/Maglev/Turboshaft) \| T1203 \| CWE-843 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
19	\| Element-kind confusion -> addrof/fakeobj \| T1203 \| CWE-843 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
20	\| OOB read/write on JSArray/TypedArray \| T1203 \| CWE-787 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
21	\| In-renderer arbitrary R/W (fake TypedArray) \| T1203 \| CWE-787 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
22	\| V8 heap-sandbox escape via raw Wasm pointer \| T1203 \| CWE-787 \| references/v8-sandbox-escape.md \| scripts/sandbox_escape.js \|
23	\| Trusted Pointer Table / WasmExportedFunctionData abuse \| T1203 \| CWE-843 \| references/v8-sandbox-escape.md \| scripts/sandbox_escape.js \|
24	\| Code/exec via Wasm JIT region pivot \| T1203 \| CWE-94 \| references/v8-sandbox-escape.md \| scripts/sandbox_escape.js \|
25	\| Mojo IPC handle-confusion sandbox escape \| T1203 \| CWE-269 \| references/renderer-to-browser-escape.md \| scripts/mojo_fuzz_harness.py \|
26	\| GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) \| T1203 \| CWE-416 \| references/renderer-to-browser-escape.md \| scripts/mojo_fuzz_harness.py \|
27	\| Mojo interface fuzzing for broker bugs \| T1203 \| CWE-20 \| references/renderer-to-browser-escape.md \| scripts/mojo_fuzz_harness.py \|
28	\| Electron contextIsolation/IPC bridge RCE \| T1059.007 \| CWE-1188 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
29	\| nodeIntegration / webviewTag preload abuse \| T1059.007 \| CWE-829 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
30	\| ASAR integrity / fuse / V8 snapshot tamper \| T1574.002 \| CWE-345 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
31	\| XSS/open-redirect -> Electron RCE \| T1189 \| CWE-79 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
32	\| 1-click drive-by chain delivery \| T1189 \| CWE-693 \| references/clientside-rce-chains.md \| scripts/chain_server.py \|
33	\| Cross-engine (JSC/WebKit) primitive

People who liked this also viewed

6 picks

Type

browser-exploitation

320stars55forks

View on GitHub

How to install browser-exploitation?

hypnguyen1209/offensive-claude/browser-exploitation

$npx -y skills add hypnguyen1209/offensive-claude --skill browser-exploitation

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Browser & Client-Side Exploitation
2
3	Turn a single client-side bug into full host compromise. The modern browser is a chain target: a JS-engine bug yields an in-renderer arbitrary read/write, the V8 heap sandbox must be escaped to get a native R/W, then a second logic/memory bug in a privileged process (browser broker, GPU) escapes the OS sandbox. Electron and embedded webviews collapse several of these steps. Every cluster pairs the offensive primitive with renderer-crash/IPC telemetry, Sigma/EDR detection, and cleanup OPSEC.
4
5	## When to Activate
6
7	- A V8/JavaScriptCore bug (type confusion, OOB, UAF, JIT mis-speculation) must become `addrof`/`fakeobj` and an in-renderer arbitrary R/W.
8	- An in-renderer R/W exists but is trapped inside the V8 heap sandbox (pointer compression) and needs a trusted-pointer / Wasm-object escape to native memory.
9	- A renderer is fully compromised and you need to escape the OS sandbox via Mojo IPC handle/logic bugs or the GPU process (Dawn/WebGPU, ANGLE).
10	- Auditing or exploiting an Electron / CEF / WebView2 app: `contextIsolation`/`nodeIntegration`/`sandbox` misconfig, preload-bridge & IPC abuse, ASAR/fuse/snapshot tampering.
11	- Assembling a 1-click drive-by RCE chain (renderer → sandbox escape → host) for an authorized red-team delivery, or doing cross-engine (Safari/JSC) work.
12	- Patch-diffing a Chrome/V8/WebKit security release to build an n-day client-side exploit.
13
14	## Technique Map
15
16	\| Technique \| ATT&CK \| CWE \| Reference \| Script \|
17	\|-----------\|--------\|-----\|-----------\|--------\|
18	\| JIT type confusion (TurboFan/Maglev/Turboshaft) \| T1203 \| CWE-843 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
19	\| Element-kind confusion -> addrof/fakeobj \| T1203 \| CWE-843 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
20	\| OOB read/write on JSArray/TypedArray \| T1203 \| CWE-787 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
21	\| In-renderer arbitrary R/W (fake TypedArray) \| T1203 \| CWE-787 \| references/v8-jit-typeconfusion.md \| scripts/v8_typer.js \|
22	\| V8 heap-sandbox escape via raw Wasm pointer \| T1203 \| CWE-787 \| references/v8-sandbox-escape.md \| scripts/sandbox_escape.js \|
23	\| Trusted Pointer Table / WasmExportedFunctionData abuse \| T1203 \| CWE-843 \| references/v8-sandbox-escape.md \| scripts/sandbox_escape.js \|
24	\| Code/exec via Wasm JIT region pivot \| T1203 \| CWE-94 \| references/v8-sandbox-escape.md \| scripts/sandbox_escape.js \|
25	\| Mojo IPC handle-confusion sandbox escape \| T1203 \| CWE-269 \| references/renderer-to-browser-escape.md \| scripts/mojo_fuzz_harness.py \|
26	\| GPU-process UAF/OOB (Dawn/WebGPU, ANGLE) \| T1203 \| CWE-416 \| references/renderer-to-browser-escape.md \| scripts/mojo_fuzz_harness.py \|
27	\| Mojo interface fuzzing for broker bugs \| T1203 \| CWE-20 \| references/renderer-to-browser-escape.md \| scripts/mojo_fuzz_harness.py \|
28	\| Electron contextIsolation/IPC bridge RCE \| T1059.007 \| CWE-1188 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
29	\| nodeIntegration / webviewTag preload abuse \| T1059.007 \| CWE-829 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
30	\| ASAR integrity / fuse / V8 snapshot tamper \| T1574.002 \| CWE-345 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
31	\| XSS/open-redirect -> Electron RCE \| T1189 \| CWE-79 \| references/electron-webview-rce.md \| scripts/electron_audit.py \|
32	\| 1-click drive-by chain delivery \| T1189 \| CWE-693 \| references/clientside-rce-chains.md \| scripts/chain_server.py \|
33	\| Cross-engine (JSC/WebKit) primitive

People who liked this also viewed

6 picks

Type