<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: developing-browser-exploits
description: >-
  Develop browser exploits targeting JavaScript engine vulnerabilities in V8, SpiderMonkey, and JavaScriptCore including JIT compiler bugs, type confusion, and sandbox escape techniques.
domain: cybersecurity
subdomain: exploit-development
tags:
  - browser-exploit
  - v8
  - spidermonkey
  - jit
  - type-confusion
  - sandbox-escape
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1189", "T1203"]
  frameworks: ["MITRE ATT&CK", "Metasploit"]
  tools: ["d8", "js", "jsc", "gdb", "python3"]
---

# Developing Browser Exploits

## Overview

Browser exploits target JavaScript engines (V8, SpiderMonkey, JavaScriptCore)
and renderer processes to achieve code execution through drive-by attacks. Modern
browser exploitation requires JIT bug primitives, type confusion, and multi-stage
sandbox escape chains.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `d8 (V8 shell)` | Security tooling |
| `js (SpiderMonkey shell)` | Security tooling |
| `gdb with pwndbg` | Security tooling |
| Browser source builds (debug mode) for target engine | Environment requirement |
| Understanding of JIT compilation, garbage collection, typed arrays | Environment requirement |
| Isolated VM for exploit testing — never test on host browser | Environment requirement |

## Workflow

### Step 1: Engine Bug Analysis

```bash
# Build V8 in debug mode for analysis
git clone https://chromium.googlesource.com/v8/v8.git
cd v8 && gclient sync
tools/dev/gm.py x64.debug

# Run PoC in debug shell with verbose output
./out/x64.debug/d8 --trace-turbo --trace-gc poc.js

# Analyze crash with GDB
gdb -ex "run poc.js" -ex "bt" -ex "info registers" ./out/x64.debug/d8
```

### Step 2: Primitive Development

```javascript
// Type confusion to build addrof/fakeobj primitives
// Target: JIT optimization bug in V8

function addrof(obj) {
    // Exploit type confusion to leak object address
    let arr = [1.1, 2.2, 3.3];
    // Trigger JIT with type feedback pollution
    arr[0] = obj;  // After confusion, reads float bits as address
    return arr[0];
}

function fakeobj(addr) {
    // Reverse primitive: interpret address as object reference
    let arr = [1.1, 2.2, 3.3];
    arr[0] = addr;  // After confusion, float bits become object pointer
    return arr[0];
}

// Build arbitrary read/write from primitives
let oob_arr = new Float64Array(0x100);
// Use fakeobj to create overlapping ArrayBuffer for R/W
```

### Step 3: Sandbox Escape Analysis

```bash
# Map Mojo IPC surface for Chromium sandbox escape
grep -rn "mojo::.*Interface" chromium/src/content/browser/ --include="*.h" | head -20

# Identify privileged IPC endpoints
node scripts/agent.js analyze-mojo --chromium-src /path/to/chromium

# Build exploit chain: renderer RCE -> IPC -> broker escape
node scripts/agent.js chain --renderer-exploit poc.js --target-ipc BlobRegistry
```

### Step 4: Exploit Packaging

```bash
# Host exploit via HTTP for drive-by delivery testing
python3 -m http.server 8080 --directory exploit_www/

# Generate Metasploit browser exploit module
node scripts/agent.js msf-module --exploit poc.js --target chrome --version 120
```

## Detection

```yaml
title: Browser Exploits Detection
id: a1c73c97-b059-4552-bfb5-ef67855ad887
status: experimental
description: Detects suspicious activity related to developing browser exploits techniques in exploit development context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*developing*browser*"
  condition: selection
level: critical
tags:
  - attack.t1189
  - attack.t1203
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Browser Exploits Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1189, T1203 |

## Verification

- [ ] Bug primitive confirmed in debug build (addrof/fakeobj or equivalent)
- [ ] Arbitrary read/write achieved from type confusion
- [ ] Exploit tested against specific browser version in isolated VM
- [ ] Sandbox escape chain documented (if applicable)
- [ ] Detection signatures for network delivery and post-exploitation

## References

- [V8 Source](https://v8.dev/) — Chrome JavaScript engine
- [Google Project Zero Blog](https://googleprojectzero.blogspot.com/) — Browser vulnerability research
- [browser.engineering](https://browser.engineering/) — Browser internals reference
