3. Exploit Chain

1. Signal Interception: Intercepts signals from JavaScript in the demo/ environment by hooking V8Console::Debug, securely extracting the second-stage Shellcode from an ArrayBuffer.
2. Vulnerability Trigger: Hooks OnAcceptRelayedMessage and constructs a spoofed relay request (Message ID: 0x69) to obtain a high-privileged handle via CVE-2025-2783.
3. Thread Hijacking:
   • Suspends the target high-privileged thread.
   • Forcibly modifies the register state using SetThreadContext.
   • Sequentially calls VirtualAlloc, ReadProcessMemory, and CreateThread within the target context to execute the Shellcode.

4. Build & Demonstration

Core Library Construction (src/)

Since the code deeply depends on Chromium's internal ipcz and mojo libraries, it is highly recommended to integrate the src/ directory into the Chromium source tree and build it using GN and Ninja to ensure all internal dependencies are correctly linked.

Full-Chain Demo (demo/)

1. Compatibility: Currently tested only on Chrome v128; due to the nature of the exploit, it is only applicable to Windows systems.
2. Preparation: Ensure the binary artifacts from src/ are ready (pre-compiled payload.bin and shellcode.bin are already provided in the demo/ directory).
3. Execution: Run python -m http.server in the demo/ directory, then navigate to http://127.0.0.1:8000/exp.html in the browser.
4. Result: The demonstration script will automatically load the binary payload and execute the predefined Shellcode on the system.

5. References

• Chromium Issue 405143032
• Chromium Issue 381696874
• Minhook

6. Disclaimer

This repository is for academic and security research purposes only. The author is not responsible for any losses or legal liabilities caused by the use of this code. Please conduct tests only in authorized environments.