XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days | XBOW

What it is

XBOW's account of a Chrome full chain: three independent bugs that together take a user from an ordinary web page to remote takeover of a Windows machine. It is a vendor narrative. The technical detail on the three bugs is in a separate companion post by Brendan Dolan-Gavitt, which the page does not reproduce. The page gives no CVE ids or Chrome version numbers.

How it works

Chrome is layered, so one bug only compromises a web page. A full chain needs a bug for each layer between the page and the machine. XBOW built its chain as three independent parts, each with an alternative. Google said it already knew one bug in the first chain, so XBOW swapped in a backup. The replacement was built in Las Vegas between Sunday, August 2, and Friday, August 7, drawing on the earlier work.

Division of labor, per the page:

• Agents: searched Chrome's source, tested ideas, built proofs of concept, and wrote the earliest exploit drafts.
• Humans: set strategy, chose where to look, checked the agents' work, and redirected them.

What to do

• Chrome users: keep Chrome current. All three bugs are fixed. Chrome updates itself, but a fix only takes effect after the browser is relaunched, so restart it whenever the Update button appears.
• Software owners: assume your applications are exploitable and test them before someone else does. Plan for attacks that get through anyway, since no one finds every vulnerability.

Caveats

• The page names no fixed Chrome version, so you can't verify a patch level from it.
• The claims that agents could find each bug alone within a year, and that the work used to take six months or more, are XBOW's own assertions. The six-month figure comes from an unnamed intelligence-agency veteran.
• The page ends with a pitch: XBOW is building an autonomous testing product for compiled software and is recruiting design partners.