victorns69/cve-2024-12381Exploit for Chrome V8 type confusion (CVE-2024-12381) with JSPI sandbox bypass, delivering RCE via a Flask server that fingerprints browsers and serves payloads to vulnerable versions.
CVE-2024-12381 is a WebAssembly type canonicalization vulnerability in Chrome's V8 engine where CanonicalEquality::EqualValueType() fails to account for nullability in indexed reference types. Combined with a JSPI-based V8 sandbox bypass (CVE-2024-12692), this allows remote code execution.
The server extracts the Chrome version from the User-Agent and fingerprints the browser. Vulnerable browsers are automatically redirected to the exploit payload, while patched browsers see a normal-looking dashboard.
pip install flaskpython server.py 8080This source code is provided inside OSAI course material.