When ‘int’ is the new ‘short’
Summary: Project Zero's Mark Brand found that Chrome's IOBuffer constructor takes an int for buffer_size while CertificateResourceHandler sums certificate chunks in a size_t content_length_, so a certificate declaring a length like 0x100001000 bytes gets truncated to 0x1000 when the buffer is allocated. The overflow occurs in the browser process, the trusted unsandboxed process, making it a potential single-bug full compromise reachable by a drive-by, with gzip encoding cutting the required payload to about 4 megabytes.
What's compelling: The bug sits in the unsandboxed browser process, where a single flaw can mean arbitrary code execution without a chain of exploits, and the 4-gigabyte out-of-bounds memcpy it triggers is a heap-corruption problem an attacker only has to solve once to make it reliable.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026