In-the-Wild Series: Chrome Exploits
Summary: Project Zero's third post in a six-part series details Chrome exploits used in a watering hole attack discovered in early 2020, all targeting JIT compiler bugs in V8, Chrome's JavaScript engine. Three of the four issues were independently discovered by external researchers and reported to Chrome, two of which came with full renderer exploits, and one was still being exploited as a 0-day when the exploit server was found.
Bottom line: The attacker built multiple exploits per bug, including a Chrome 37-58 exploit covering almost three years of browser versions and a second, smaller exploit the server preferred for Chrome 47-58, showing a development process that treats reliability as a first-class problem.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026