Some Assembly Required: Weaponizing Chrome CVE-2023-2033 for RCE in Electron

The talk follows the development of a remote code execution exploit for CVE-2023-2033, a type confusion bug in Chrome's V8 JavaScript engine. The work began during a bug bounty engagement against an Electron desktop client running an outdated Chrome build, where a working proof of concept was needed to demonstrate real impact. No public full RCE exploit existed for this bug, so the research started from existing proof-of-concept code that provided V8 heap read, write and address-of primitives.

The speaker first had to make those primitives install reliably on a production Chrome build rather than a developer shell, which required adjusting the script and retrying it. The exploit then redirected a function's JIT code pointer into shellcode hidden inside float64 constants that the optimizing compiler emitted as immediate-load instructions. Getting longer payloads to run meant working around compiler optimizations that merged repeated shellcode chunks, and accounting for x86-64 instruction size changes that shifted the jump offsets. The final payload fetched and ran a remote shell script inside an unsandboxed renderer, and several parallel instances of the exploit were used to improve reliability.

The main takeaway is that a public browser proof of concept can be turned into a working exploit with substantial debugging, and that a renderer running without the Chrome sandbox gives an attacker far more room. The speaker reported the issue through a bug bounty program and received a critical payout, though the vendor's response focused on the cross-site scripting bug used to reach the vulnerable component.