Rajvardhan Agarwal, a security researcher from India, has released in public a proof-of-concept exploits code for a flaw that has been detected very recently and that impacts Google Chrome, Microsoft Edge, and many other browsers that are Chromium-based such as Opera, Brave, etc. The PoC code on GitHub has been uploaded by the researchers and also announced that it is available on Twitter. The Record claimed that the PoC code released by the security experts was the same one that was abused by the security duo- Bruno Keith and Niklas Baumstark of Dataflow at the time of the Pwn2Own 2021 hacking contest. These two security experts got as much as $100,000 to demonstrate an exploit from Chrome and Microsoft Edge web browsers.

The team used a Type Mismatch bug to exploit the Chrome renderer and Microsoft Edge. Same exploit for both browsers. They earn $100,000 total and 10 Master of Pwn points mentions the post published on the official site of the competition.

The Chrome security team was explicitly informed about this bug with the required details by two security experts to get it patched without any public exposure. Although Google did address the vulnerability, Agarwal made a reverse engineering of the patch developed by the tech giant. The Indian researchers analyzed the changes introduced to the component of the Chromium open-source browser project, the V8 JavaScript engine, and understood how the original exploit was working.

The PoC HTML file and JavaScript file associated with it can exploit the security vulnerability after it is loaded in a Chromium-based browser. This may launch the Windows calculator app as well. It is also important to note that the exploit requires it to be linked with another vulnerability that can permit it to escape protections of Chrome’s sandbox. It seems that Agarwal could quickly put together the PoC by reverse-engineering the patch. This patch is pushed by Google’s Chromium team to the open-source component post where the data of the vulnerability was exchanged with the firm.

Getting popped with our own bugs wasn't on my bingo card for 2021," Baumstark posted on Twitter. "Not sure it was too smart of Google to add that regression test right away

The worrying news, in this case, is that the patch is not yet implemented into official releases of the major browsers that are Chromium-based, entailing Chrome and Edge that stay vulnerable to the attack.