HEXACON Researchers Explain Firefox Promise Exploit Leading to Renderer Code Execution
· 46:14 · Watch on YouTube ↗
Summary
Tao Yan and Edouard Bochin explain a six-year-old Firefox Promise.allSettled flaw and its exploitation through garbage collection and type confusion. Their Firefox 138 demo disabled the sandbox because the exploit was renderer-only.
Key points
- The researchers describe an out-of-bounds write in SpiderMonkey's Promise.allSettled implementation that they say had existed since its introduction in 2019.
- Custom promise callbacks expose the results array to JavaScript; trimming that array and invoking a retained rejection callback leaves an internal index stale.
- The initial write is constrained: the destination must contain undefined, and the written value is an internally created object reference.
- The exploit uses major and minor garbage collection to arrange adjacent objects and turn the constrained write into a use-after-free and type confusion.
- The researchers develop address-disclosure, fake-object and arbitrary memory read/write primitives, then use WebAssembly code and control-flow manipulation for renderer code execution.
- The live demonstration used Firefox 138 with its sandbox disabled. After several failed attempts, the presenters reported success; the talk did not demonstrate a sandbox escape or disclose patch status.
Article Details
- Topics
- [01:00] JavaScript promises and their browser attack surface
- [03:14] SpiderMonkey Promise.allSettled internals and the six-year-old bug
- [12:26] Finding recurring promise implementation errors across browsers
- [14:29] Triggering the constrained out-of-bounds write
- [18:34] Garbage collection, heap layout and conversion to exploitation primitives
- [37:39] WebAssembly-based renderer code execution
- [43:12] Firefox 138 live demonstration with the sandbox disabled
People
Edouard BochinResearcher and presenter identified in the video title; explains the promise vulnerability, renderer code execution approach and live demonstration.Tao YanResearcher and presenter identified in the video title; explains SpiderMonkey garbage collection and conversion of the constrained write into memory exploitation primitives.