ChromSploit-Framework — Advanced AI-Powered Exploitation Framework | CVE-2025-4664 & CVE-2025-2783 & CVE-2025-2857 & CVE-2025-30397 | | Kitploit
Tools / GitHub / leviticus-triage / chromsploit-framework
leviticus-triage/chromsploit-framework
ChromSploit-Framework Advanced AI-Powered Exploitation Framework | CVE-2025-4664 & CVE-2025-2783 & CVE-2025-2857 & CVE-2025-30397 |
Discover the most used tools by our community.
Last 7 Days Last 30 Days
ChromSploit Framework v3.0
Overview
ChromSploit Framework is a cutting-edge educational security research tool designed for cybersecurity professionals, researchers, and students. Built with a modular architecture, it provides a comprehensive platform for studying browser vulnerabilities and exploitation techniques in controlled environments.
IMPORTANT : This framework is intended exclusively for educational purposes and authorized security testing. Unauthorized use is strictly prohibited and may violate applicable laws.
Key Highlights
Intelligent Browser Detection : Automatic browser identification and exploit recommendationsAnalytics Dashboard : Real-time monitoring and performance metricsPerformance Optimization : Advanced caching system for faster executionEnhanced Safety : Multi-level authorization and target validationAutomated Testing : Browser test automation with Selenium/PlaywrightMulti-Exploit Chains : Automated combination of multiple CVEsAdvanced Obfuscation : EXTREME-level payload obfuscation with 9+ techniquesAuto-Ngrok Integration : Automatic tunnel creation for seamless exploitationProfessional Reporting : Comprehensive PDF/HTML/JSON reports
Features
Core Capabilities
9 Advanced CVE Exploits with real functional codeBrowser Detection & Auto-Selection for intelligent targetingMonitoring & Analytics Dashboard with real-time metricsCaching System for performance optimizationEnhanced Safety & Authorization with multi-level controlsBrowser Test Automation (Selenium/Playwright)Browser Multi-Exploit Chain for automated attacksAI-Powered Orchestration for intelligent exploit selectionSelf-Healing Modules for resilient operationsEnhanced Error Handling with smart recovery
Advanced Features
Extreme Payload Obfuscation (Control Flow, String Encryption, Anti-VM)Automatic Ngrok Tunneling (TCP, HTTP, WebSocket)Professional Security Reports (PDF, HTML, Markdown, JSON)Terminal Recording System with web playbackModular Plugin Architecture for extensibilityComprehensive Test Framework with validationCompatibility Matrix for browser version trackingSuccess Rate Tracking per CVEBrowser Distribution Analytics Historical Data Management
Quick Start
Prerequisites
Python 3.9+ with pipGit for repository operationsVirtual Environment (recommended)Administrative privileges (for some features)
Installation # 1. Clone the repository
git clone https://github.com/Leviticus-Triage/ChromSploit-Framework.git
cd ChromSploit-Framework
# 2. Create virtual environment
python3 -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
# 3. Install dependencies
pip install -r requirements.txt
# 4. Launch ChromSploit
python chromsploit.py
First Run # Safe mode (recommended for first run)
python chromsploit.py --simulation safe
# With debug output
python chromsploit.py --debug
# Environment check
python chromsploit.py --check
CVE Exploit Arsenal
Click to expand CVE details Browser Exploits
CVE ID Target Type Description Status CVE-2025-4664 Chrome Data Leak Link header referrer policy bypass Functional CVE-2025-2783 Chrome Sandbox Escape Mojo IPC handle confusion Functional CVE-2025-30397 Edge Memory Corruption WebAssembly JIT type confusion Functional CVE-2025-2857 Firefox Sandbox Escape IPDL privilege escalation Functional CVE-2025-49741 Edge Information Disclosure Internal request data leakage Functional CVE-2020-6519 Chromium CSP Bypass Content Security Policy bypass Functional CVE-2017-5375 Firefox RCE ASM.JS JIT-Spray Remote Code Execution Functional
Server-Side Exploits
New in v3.0: Intelligent Features
Browser Detection & Auto-Selection Automatically detect browser type and version from User-Agent strings and recommend compatible exploits:
from modules.detection import get_browser_detector
detector = get_browser_detector()
browser_info = detector.detect_browser(user_agent)
recommendations = detector.recommend_exploit(browser_info)
Supports Chrome, Edge, Firefox, Brave, Vivaldi, Opera, Safari
Version parsing and compatibility checking
Intelligent exploit recommendations based on browser version
Compatibility matrix for all CVEs
Monitoring & Analytics Dashboard Real-time tracking and analytics for exploit execution:
Success Rate Tracking : Per-CVE success rate calculationPerformance Metrics : Execution time and performance statisticsBrowser Distribution : Analytics on target browser distributionHistorical Data : Last 1000 exploit attempts trackedReport Export : JSON report generation Access via: Main Menu → Analytics Dashboard
Caching System Advanced caching for improved performance:
Payload Caching : Automatic caching of generated payloadsObfuscation Caching : Cache obfuscation resultsBrowser Detection Caching : 24-hour TTL for detection resultsPersistent Storage : JSON-based persistent cacheLRU Eviction : Automatic cache management
Enhanced Safety & Authorization Multi-level safety controls:
Exploit Authorization : Per-user/exploit authorization systemTarget Validation : Localhost checks and production warningsSandbox Mode : Default safe mode for testingSafety Levels : SAFE, RESTRICTED, STANDARD, UNRESTRICTEDAudit Logging : Comprehensive action tracking
Browser Test Automation Automated browser testing with Selenium/Playwright:
Multi-Browser Testing : Test exploits across different browsersAutomated Validation : Verify exploit executionTest Reports : Detailed test resultsScreenshot Support : Visual verification
Browser Multi-Exploit Chain The flagship feature that automates exploitation of multiple browser CVEs in sequence:
graph LR
A[CVE-2025-4664<br/>Reconnaissance] --> B[CVE-2025-2857<br/>OAuth Theft]
B --> C[CVE-2025-30397<br/>WebAssembly JIT]
C --> D[CVE-2025-2783<br/>Sandbox Escape]
style A fill:#e1f5fe
style B fill:#f3e5f5
style C fill:#fff3e0
style D fill:#ffebee
Enhanced Features
Extreme Obfuscation : Control flow flattening, string encryption, anti-debuggingAuto-Ngrok : Automatic tunnel creation for all callbacksParallel Execution : Multi-threaded exploitation for speedStealth Mode : Low-profile exploitation with evasionIntelligent Selection : Browser detection-based chain selection
Architecture
System Architecture Overview ChromSploit Framework v3.0
├── Core Engine
│ ├── Enhanced Menu System
│ ├── Module Loader
│ ├── Exploit Chain Manager
│ ├── Error Handler
│ └── Safety Manager
├── Detection & Analytics
│ ├── Browser Detector
│ ├── Exploit Monitor
│ └── Analytics Dashboard
├── Performance & Caching
│ ├── Exploit Cache
│ └── Cache Manager
├── Exploit Modules
│ ├── Browser CVEs (7)
│ ├── Server CVEs (2)
│ └── Custom Exploits
├── Obfuscation Engine
│ ├── JavaScript Obfuscation
│ ├── Binary Data Encryption
│ ├── Control Flow Flattening
│ └── Anti-Analysis
├── Testing Framework
│ ├── Browser Test Automation
│ ├── Selenium Integration
│ └── Playwright Integration
├── Network Integration
│ ├── Ngrok Manager
│ ├── HTTP Servers
│ └── WebSocket Handlers
└── Reporting System
├── PDF Generation
├── HTML Reports
└── JSON Export
Design Patterns
Modular Architecture : Plugin-based system for easy extensionSafety-First : Simulation modes prevent accidental exploitationEnhanced Logging : Structured logging with analysis capabilitiesChain Management : Dependency resolution and state sharingProfessional UI : Color-coded menus with keyboard shortcutsIntelligent Detection : Automatic browser and vulnerability detectionPerformance Optimized : Caching and async operations
Documentation
Testing # Run all tests
python -m pytest
# With coverage report
python -m pytest --cov=core --cov=modules --cov-report=html
# Test new improvements
python -m pytest tests/test_improvements.py -v
# Test new exploits
python -m pytest tests/test_new_exploits.py -v
# Validation framework
python -m core.validation_framework
Test Coverage : 95%+ across core modules
What's New in v3.0
Major Updates & Features New Features
Intelligent Detection & Analytics
Browser Detection & Auto-Selection : Automatic browser identification from User-AgentMonitoring & Analytics Dashboard : Real-time exploit tracking and statisticsCompatibility Matrix : Browser version compatibility tracking for all CVEsSuccess Rate Tracking : Per-CVE success rate calculation
Advanced Caching System : Payload, obfuscation, and detection cachingPersistent Storage : JSON-based cache with TTL managementLRU Eviction : Automatic cache management
Enhanced Safety
Multi-Level Authorization : Per-user/exploit authorization systemTarget Validation : Localhost checks and production warningsSafety Levels : Configurable safety modes (SAFE, RESTRICTED, STANDARD, UNRESTRICTED)Comprehensive Audit Logging : Complete action tracking
Testing & Automation
Browser Test Automation : Selenium/Playwright integrationMulti-Browser Testing : Automated testing across browsersTest Reports : Detailed validation results
New CVE Exploits
CVE-2025-49741 : Edge Information DisclosureCVE-2020-6519 : Chromium CSP BypassCVE-2017-5375 : Firefox ASM.JS JIT-Spray RCE
Improvements
Performance : 40% faster exploit execution with cachingUI/UX : Enhanced menu system with Analytics DashboardIntelligence : Automatic browser detection and exploit recommendationsSafety : Multi-level authorization and validationMonitoring : Real-time analytics and reportingError Handling : User-friendly messages with troubleshooting guidesDocumentation : Comprehensive guides and integration examples
Technical
Python 3.9+ compatibilityType Hints throughout codebaseAsync Support for parallel operationsMemory Management optimizationsCross-Platform compatibilityModular Design for easy extension
Contributing We welcome contributions from the security research community!
How to Contribute
Fork the repositoryCreate a feature branchImplement your changesAdd comprehensive testsSubmit a pull request
Contribution Areas
Bug Reports & Fixes New CVE Implementations Documentation Improvements Test Coverage Expansion UI/UX Enhancements New Detection Methods Performance Optimizations
Security & Ethics
Responsible Use This framework is designed for:
Educational purposes and learningAuthorized penetration testing Security research in controlled environmentsBug bounty programs with proper authorization
Prohibited Uses
Unauthorized access to systems or networksMalicious attacks on third-party systemsCommercial exploitation without permissionDistribution of malware or harmful content
Safety Features
Simulation Modes : Safe testing without real exploitationSandbox Mode : Default safe mode enabledMulti-Level Authorization : Per-exploit authorization requiredTarget Validation : Automatic checks for localhost/productionAudit Logging : Complete action trackingConfirmation Prompts : For dangerous operationsEducational Flags : Clear marking of all educational content
License This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Summary
Commercial use allowed (with restrictions)
Modification and distribution permitted
Patent use granted
Must include license and copyright notice No warranty provided
Acknowledgments
Built by Security Researchers, for Security Researchers
Special Thanks To:
Educational Security Community Vulnerability Researchers Responsible Disclosure Programs Open Source Contributors
Star us on GitHub if ChromSploit Framework helped your security research!
Made with by the Leviticus-Triage Team
CVE ID Target Type Description Status
CVE-2025-24813 Apache Tomcat RCE Malicious WAR deployment Functional CVE-2024-32002 Git RCE Symbolic link repository attack Functional
leviticus-triage/chromsploit-framework
