Rapid7 Vulnerability & Exploit Database

Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE

Back to Search

Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE

Disclosed
04/13/2021
Created
05/01/2021

Description

This module exploits an issue in the V8 engine on x86_x64 builds of Google Chrome before 89.0.4389.128/90.0.4430.72 when handling XOR operations in JIT'd JavaScript code. Successful exploitation allows an attacker to execute arbitrary code within the context of the V8 process. As the V8 process is normally sandboxed in the default configuration of Google Chrome, the browser must be run with the --no-sandbox option for the payload to work correctly.

Author(s)

  • Bruno Keith (bkth_)
  • Niklas Baumstark (_niklasb)
  • Rajvardhan Agarwal (r4j0x00)
  • Grant Willcox (tekwizz123)

Architectures

x64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > show targets
    ...targets...
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > set TARGET < target-id >
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > show options
    ...show and set options...
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;