Chrome OS exploit: one byte overflow and symlinks
Summary: An external researcher describes a Chrome OS exploit reported to Chrome VRP in September, built on a one-byte overflow in the c-ares DNS library reached through an HTTP proxy in shill, the network manager that runs as root. The exploit uses WebRTC's TURN protocol to place a trailing escaped dot in a Host header, scans localhost ports by timing connections, and grooms dlmalloc across six stages to turn the single-byte overwrite into overlapping chunks, leak libc pointers, and overwrite a BindState callback to run system() as root.
Why it matters: A one-byte overflow in a DNS library, reached from JavaScript through a root-running network daemon, was enough to go from renderer to root in a single step - and the writeup notes an attacker who gains root on Chrome OS loses those privileges on reboot.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026