---
name: browser-engine-security
domain: browser
triggers:
  languages:    [c, cpp, rust, javascript]
  frameworks:   [v8, spidermonkey, jsc, blink, gecko, webkit, chromium]
  asset_types:  [browser, engine, jit, renderer, sandbox]
tools:          [domato, fuzzilli, jsfunfuzz, rr, gdb, lldb]
severity_focus: [P1, P2]
---

# Browser Engine Security

## When to load
V8, SpiderMonkey, JavaScriptCore, WebKit, Blink, Servo source trees;
WebAssembly runtimes; PDF renderers shipped inside browsers.

## Bug classes that pay (Pwn2Own / Chrome VRP / TCC tier)
1. **JIT type confusion** — speculative type narrowing wrong; e.g. range
   analysis assumes int but value is double. Triggered by complex
   array/typed-array interplay.
2. **OOB in JIT'd code** — bounds-check elimination over-aggressive;
   `arr[length-1]` with `length` = 0 turns into negative index.
3. **Use-after-free in DOM** — node removed during a callback while parent
   iteration holds a raw pointer.
4. **Renderer → sandbox escape** — IPC message handler trusts
   renderer-controlled enum; Mojo interface allowing file path traversal.
5. **WebAssembly engine** — JIT for SIMD / GC proposals, structural
   typing bugs in the new GC opcodes.
6. **PDF / image parser** — PDFium, libwebp, libavif — these alone have
   produced $100K+ Chrome bounties.
7. **Site-isolation bypass** — confused-deputy in process model, leaks of
   cross-origin secrets via timing or cache.

## Methodology
1. **Read the recent fix landings** — Chromium `chromium/src` repo,
   `master` branch commits with `[security]` or `Fixed:` referencing
   `crbug.com/<id>`. Public 14 weeks after fix; unpublished bugs leave
   patterns visible.
2. **Re-fuzz the patched function** — use Fuzzilli with the patched
   binary; you're hunting for the *next* bug in the same area.
3. **Differential fuzzing** — V8 vs JSC vs SpiderMonkey on the same
   corpus; output divergence = bug.
4. **Focus the fuzzer on the proposal under active development** —
   intl, Temporal, GC, JSPI, ShadowRealm. New code = least audited.
5. **Symbolic execution on JIT IR** — pin specific operations
   (`Int32Add`, `LoadElement`) with manticore-style constraints.

## Exploitation pattern (modern V8)
- **AddrOf primitive** via leaked pointer in TypedArray length confusion.
- **Arbitrary read/write** by faking a JSArray with crafted map.
- **Code execution** by overwriting WebAssembly RWX page (post-V8 21,
   need pivot via builtin trampoline or RWX in the JIT compiler).
- **Sandbox escape** via separate Mojo bug — chain is required for the
   $100K+ payouts.

## Reporting
Chrome VRP: file via `g.co/vulnz`, attach minimal repro `<200 LOC>`,
include exact commit hash you tested against, ASAN log, and a sentence
on the security boundary crossed.