{"uuid": "80bb5d22-58f0-4b2d-a981-2a2deb0759f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21224", "type": "seen", "source": "https://t.me/hacking_Attack/18949", "content": "Black Hat Ethical Hacking\nBugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop them\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bugs in Chrome\u2019s JavaScript engine can lead to powerful exploits. This project aims to stop themPost Views: 45 \nReading Time: 1 Minute\nA new project hopes to beef up the security of V8, a part of the Chrome browser that most users aren\u2019t aware of but that hackers increasingly see as a juicy target.\nJavaScript makes the web go around and Google has had to patch multiple\u00a0zero-day or previously unknown flaws\u00a0in Chrome\u2019s V8 JavaScript engine this year. In April, Google admitted a high severity bug in V8 tracked as CVE-2021-21224\u00a0was being exploited in the wild. \n\nChrome has over two billion users, so when zero-day exploits strike Chrome, it\u2019s a big deal. V8, an open source Google project, is a powerful JavaScript engine for Chrome that\u2019s helped advance the web and web applications. V8 also powers the server-side runtime Node.js. \n\nNow Samuel Gro\u00df, a member of the Google Project Zero security researchers team, has detailed a V8 sandbox proposal\u00a0to help protect its memory from nastier bugs in the engine using virtual machine and sandboxing technologies. \n\n\u201cV8 bugs typically allow for the construction of unusually powerful exploits. Furthermore, these bugs are unlikely to be mitigated by memory safe languages or upcoming hardware-assisted security features such as MTE or CFI,\u201d explains Gro\u00df, referring to security technologies like Microsoft\u2019s Control-flow integrity (CFI) and Intel\u2019s control-flow enforcement technologies (CET). \n\n\u201d As a result, V8 is especially attractive for real-world attackers.\u201d\nSee Also: Hackers used never-before-seen wiper in recent attack on Iranian train system Gro\u00df\u2019s comments suggest that even adopting a memory-safe language like Rust\u00a0\u2014 which Google has adopted for new Android code\u00a0\u2014 wouldn\u2019t immediately solve the security problems faced by V8, which is written in C++. \nHe also outlines the broad design objectives but, signaling the size of the project, stresses that this sandbox project is in its infancy\u00a0and that there are some big hurdles to overcome. But V8 is a Google-led open source project and given that V8 has been the source of security vulnerabilities in Chrome, there is a chance that member of GPZ\u2019s proposal could make it across the line.\n\nThe issues affect how browser software interacts with hardware beyond the operating system and aims to prevent future flaws in V8 from corrupting a computer\u2019s memory outside of the V8 heap. This would allow an attacker to execute malicious code. \nSee Also: Offensive Security Tool: Ruler One consideration for the additional security protections for V8 is the impact on hardware performance. Gro\u00df estimates his proposal would cause an overhead of about \u201c1% overall on real-world workloads\u201d. \n\nGro\u00df explains the problem with V8 that stems from JIT compilers that can be used trick a machine into emitting machine code that corrupts memory at runtime. \n\n\u201cMany V8 vulnerabilities exploited by real-world attackers are effectively 2nd order vulnerabilities: the root-cause is often a logic issue in one of the JIT compilers, which can then be exploited to generate vulnerable machine code (e.g. code that is missing a runtime safety check). The generated code can then in turn be exploited to cause memory corruption at runtime.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker He also highlights the shortcomings of the latest security technologies, including hardware-based mitigations, that will make [...]", "creation_timestamp": "2026-09-01T20:02:29.918654Z"}