CVE-2024-8193 PoC — Google Chrome 安全漏洞

Source

https://github.com/HyHy100/Chrome-Skia-CVE-2024-8193

Associated Vulnerability

Title:Google Chrome 安全漏洞 (CVE-2024-8193)
Description:Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Description

  PoC for a Chrome integer overflow -> OOB write vulnerability I reported to Google in Skia.

Readme

Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html

Steps to reproduce:
1. Apply the `chromium.diff` patch to chromium.
2. Run `genskpic.py` to generate `drawable_picture.skp.hh`, then move the generated file to `src/gpu/command_buffer/client`.
3. Build and start the browser.
4. Open `index.html` to trigger PoC.
5. GPU process will crash.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!