Skip to content
KitploitKITPLOIT
StrumentiBlog
Invia
StrumentiBlog
Invia

Strumenti di Hacking, PenTest e Cybersecurity per il tuo Arsenale di Sicurezza!

Kitploit è una directory di strumenti di hacking, cybersecurity e pentesting. Scopri gli ultimi aggiornamenti dei progetti per trovare vulnerabilità, analizzare sistemi, automatizzare i test e rafforzare la tua sicurezza.

··Feed·Contatto·Privacy·© 2026 Kitploit

Directory degli strumenti

Categorie

Vedi tutte le categorie
Loading categories
CVE-2026-3909 — Proof-of-concept exploit per CVE-2026-3909, una vulnerabilità out-of-bounds in Chromium Skia, con patch e analisi del crash per un trigger affidabile in ambienti browser reali. | Kitploit
Strumenti/GitHubGitHub/jaf0rk/cve-2026-3909
Analisi delle VulnerabilitàExploitSfruttamento di Applicazioni WebFuzzingAnalisi di Binari
GitHubjaf0rk/cve-2026-3909

CVE-2026-3909

Proof-of-concept exploit per CVE-2026-3909, una vulnerabilità out-of-bounds in Chromium Skia, con patch e analisi del crash per un trigger affidabile in ambienti browser reali.

Vedi Repository
24 mesi faNon ancora revisionato

Più Popolari

Vedi tutti →

Scopri gli strumenti più utilizzati dalla nostra community.

Esplora tutti gli strumenti

Sfoglia la nostra collezione di strumenti

Vedi tutti gli strumenti →
Condividi

CVE-2026-3909 PoC per il Browser Chromium

Questo repository contiene una proof-of-concept (PoC) per CVE-2026-3909 che può essere attivata in modo affidabile nel browser Chromium.

Contesto

La correzione ufficiale di Skia per questa vulnerabilità includeva solo un caso di test dimostrativo semplificato:

  • Demo ufficiale: AtlasOobTest.cpp

Non può essere eseguita in un ambiente Chromium reale. La demo ufficiale è stata volutamente limitata e ha omesso le condizioni chiave di attivazione.
Questa PoC è basata sulla demo ufficiale ed è stata modificata per attivare la vulnerabilità in modo affidabile all'interno di un ambiente browser Chromium reale.

Patch incluse

Questa PoC consiste in modifiche ai seguenti file:

1. raster_implementation.cc.patch

Percorso: /src/gpu/command_buffer/client/raster_implementation.cc

2.

SkChromeRemoteGlyphCache.cpp.patch

Percorso: /src/third_party/skia/src/text/gpu/SkChromeRemoteGlyphCache.cpp

3. Altro

Oltre ai due file di patch esistenti, puoi anche aggiungere codice di debug all'interno della funzione DrawAtlas::hasID(). Questo ti consente di analizzare e osservare perché viene attivato l'abort.``` bool hasID(const skgpu::PlotLocator& plotLocator) { if (!plotLocator.isValid()) { return false; }

root@kitploit:~
    uint32_t plot = plotLocator.plotIndex();
    uint32_t page = plotLocator.pageIndex();
    // patch code
    printf("[*] POC plot idx: %x fNumPlots: %x\n", plot, fNumPlots);
    // origin code
    uint64_t plotGeneration = fPages[page].fPlotArray[plot]->genID();
    uint64_t locatorGeneration = plotLocator.genID();
    return plot < fNumPlots && page < fNumActivePages && plotGeneration == locatorGeneration;
}
root@kitploit:~
```bash
go install -v github.com/projectdiscovery/katana/cmd/katana@latest

Uso

root@kitploit:~
katana -h

Questo mostrerà l'aiuto per lo strumento. Ecco tutti gli switch supportati.

root@kitploit:~
Katana è un crawler web veloce basato su intestazioni scritto in Go.

USO:
   katana [comando]

COMANDI DISPONIBILI:
   completamento  genera lo script di completamento automatico per la shell specificata
   aiuto          Aiuto su qualsiasi comando
   versione       versione

FLAG:
   -aff, -campi-di-autenticazione stringa[]  campi di autenticazione opzionali
   -cs, -dimensione-crawl int                 numero massimo di richieste da crawler (predefinito 0)
   -ct, -tempo-crawl int                      durata massima del crawl in secondi (predefinito 0)
   -d, -profondità int                        profondità massima del crawl (predefinito 3)
   -ef, -filtro-estensione stringa[]          filtra le estensioni specificate
   -em, -modalità-estensione stringa          modalità di estensione (predefinito "blacklist")
   -e, -estensione stringa[]                  estensioni da filtrare
   -fs, -strategia-form stringa               strategia di estrazione dei moduli (predefinito "auto")
   -H, -intestazioni stringa[]                intestazioni personalizzate
   -hl, -limite-intestazioni int              numero massimo di intestazioni da estrarre (predefinito 100)
   -hs, -intestazioni                          abilita l'estrazione delle intestazioni
   -i, -ignora stringa[]                      ignora gli URL specificati
   -iq, -query-ignorata                        ignora le query negli URL
   -irr, -ignora-robots                        ignora i file robots.txt
   -jc, -crawl-javascript                      abilita il crawling dei file JavaScript
   -jsl, -limite-javascript int               numero massimo di file JavaScript da crawler (predefinito 100)
   -kf, -campi-conosciuti stringa[]           campi noti da estrarre
   -m, -modalità-crawl stringa                modalità di crawl (predefinito "crawl")
   -nc, -nessun-colore                        disabilita i colori nell'output
   -no, -nessun-output                        disabilita l'output
   -o, -output stringa                        file di output
   -p, -proxy stringa[]                       proxy HTTP/S da utilizzare
   -q, -query stringa[]                       query da aggiungere agli URL
   -rl, -limite-richieste int                 numero massimo di richieste al secondo (predefinito 150)
   -s, -strategia stringa                     strategia di crawl da utilizzare (predefinito "breadth-first")
   -sc, -campi-scope stringa[]                campi di scope da estrarre
   -silent                                    mostra solo i risultati
   -t, -timeout int                           timeout in secondi (predefinito 10)
   -u, -url stringa[]                         URL da crawler
   -v, -verbose                               mostra output dettagliato
   -version                                   mostra la versione

Esempi

Crawl di base

root@kitploit:~
katana -u https://example.com

Crawl con profondità personalizzata

root@kitploit:~
katana -u https://example.com -d 5

Crawl con timeout personalizzato

root@kitploit:~
katana -u https://example.com -t 15

Crawl con intestazioni personalizzate

root@kitploit:~
katana -u https://example.com -H "Authorization: Bearer token"

Crawl con proxy

root@kitploit:~
katana -u https://example.com -p http://127.0.0.1:8080

Crawl con estrazione di intestazioni

root@kitploit:~
katana -u https://example.com -hs

Crawl con estrazione di campi noti

root@kitploit:~
katana -u https://example.com -kf "api_key,api_token"

Crawl con estrazione di campi di scope

root@kitploit:~
katana -u https://example.com -sc "in_scope"

Crawl con estrazione di campi di autenticazione

root@kitploit:~
katana -u https://example.com -aff "auth_token"

Crawl con crawling JavaScript

root@kitploit:~
katana -u https://example.com -jc

Crawl con limite di richieste

root@kitploit:~
katana -u https://example.com -rl 100

Crawl con output su file

root@kitploit:~
katana -u https://example.com -o output.txt

Crawl con output silenzioso

root@kitploit:~
katana -u https://example.com -silent

Crawl con modalità verbose

root@kitploit:~
katana -u https://example.com -v

Crawl con strategia di crawl personalizzata

root@kitploit:~
katana -u https://example.com -s "depth-first"

Crawl con strategia di estrazione dei moduli personalizzata

root@kitploit:~
katana -u https://example.com -fs "regex"

Crawl con modalità di estensione personalizzata

root@kitploit:~
katana -u https://example.com -em "whitelist"

Crawl con filtro estensione

root@kitploit:~
katana -u https://example.com -ef "png,css"

Crawl con estensioni da filtrare

root@kitploit:~
katana -u https://example.com -e "php,asp"

Crawl con URL ignorati

root@kitploit:~
katana -u https://example.com -i "https://example.com/ignore"

Crawl con query ignorate

root@kitploit:~
katana -u https://example.com -iq

Crawl con robots.txt ignorato

root@kitploit:~
katana -u https://example.com -irr

Crawl con query aggiunte

root@kitploit:~
katana -u https://example.com -q "param=value"

Crawl con dimensione massima

root@kitploit:~
katana -u https://example.com -cs 100

Crawl con tempo massimo

root@kitploit:~
katana -u https://example.com -ct 60

Crawl con limite di intestazioni

root@kitploit:~
katana -u https://example.com -hl 50

Crawl con limite di JavaScript

root@kitploit:~
katana -u https://example.com -jsl 50

Crawl con nessun colore

root@kitploit:~
katana -u https://example.com -nc

Crawl con nessun output

root@kitploit:~
katana -u https://example.com -no

Crawl con più URL

root@kitploit:~
katana -u https://example.com,https://example.org

Crawl con più proxy

root@kitploit:~
katana -u https://example.com -p http://127.0.0.1:8080,http://127.0.0.1:8081

Crawl con più intestazioni

root@kitploit:~
katana -u https://example.com -H "Authorization: Bearer token" -H "X-Custom: value"

Crawl con più query

root@kitploit:~
katana -u https://example.com -q "param1=value1" -q "param2=value2"

Crawl con più estensioni da filtrare

root@kitploit:~
katana -u https://example.com -e "php,asp" -e "jsp"

Crawl con più URL ignorati

root@kitploit:~
katana -u https://example.com -i "https://example.com/ignore1" -i "https://example.com/ignore2"

Crawl con più campi noti

root@kitploit:~
katana -u https://example.com -kf "api_key,api_token" -kf "auth_token"

Crawl con più campi di scope

root@kitploit:~
katana -u https://example.com -sc "in_scope" -sc "out_of_scope"

Crawl con più campi di autenticazione

root@kitploit:~
katana -u https://example.com -aff "auth_token" -aff "session_id"

Crawl con più filtri estensione

root@kitploit:~
katana -u https://example.com -ef "png,css" -ef "jpg"

Crawl con più estensioni

root@kitploit:~
katana -u https://example.com -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL e proxy

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081

Crawl con più URL e intestazioni

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value"

Crawl con più URL e query

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2"

Crawl con più URL e estensioni da filtrare

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp"

Crawl con più URL e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -sc "in_scope" -sc "out_of_scope"

Crawl con più URL e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -aff "auth_token" -aff "session_id"

Crawl con più URL e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -ef "png,css" -ef "jpg"

Crawl con più URL e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, proxy e intestazioni

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value"

Crawl con più URL, proxy e query

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2"

Crawl con più URL, proxy e estensioni da filtrare

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp"

Crawl con più URL, proxy e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, proxy e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, proxy e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, proxy e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -aff "auth_token" -aff "session_id"

Crawl con più URL, proxy e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -ef "png,css" -ef "jpg"

Crawl con più URL, proxy e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, intestazioni e query

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -q "param1=value1" -q "param2=value2"

Crawl con più URL, intestazioni e estensioni da filtrare

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -e "php,asp" -e "jsp"

Crawl con più URL, intestazioni e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, intestazioni e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, intestazioni e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, intestazioni e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -aff "auth_token" -aff "session_id"

Crawl con più URL, intestazioni e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -ef "png,css" -ef "jpg"

Crawl con più URL, intestazioni e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -H "Authorization: Bearer token" -H "X-Custom: value" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, query e estensioni da filtrare

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -e "php,asp" -e "jsp"

Crawl con più URL, query e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, query e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, query e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, query e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -aff "auth_token" -aff "session_id"

Crawl con più URL, query e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -ef "png,css" -ef "jpg"

Crawl con più URL, query e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -q "param1=value1" -q "param2=value2" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, estensioni da filtrare e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, estensioni da filtrare e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, estensioni da filtrare e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, estensioni da filtrare e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -aff "auth_token" -aff "session_id"

Crawl con più URL, estensioni da filtrare e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -ef "png,css" -ef "jpg"

Crawl con più URL, estensioni da filtrare e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, URL ignorati e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -i "https://example.com/ignore1" -i "https://example.org/ignore2" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, URL ignorati e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -i "https://example.com/ignore1" -i "https://example.org/ignore2" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, URL ignorati e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -i "https://example.com/ignore1" -i "https://example.org/ignore2" -aff "auth_token" -aff "session_id"

Crawl con più URL, URL ignorati e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -i "https://example.com/ignore1" -i "https://example.org/ignore2" -ef "png,css" -ef "jpg"

Crawl con più URL, URL ignorati e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -i "https://example.com/ignore1" -i "https://example.org/ignore2" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, campi noti e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -kf "api_key,api_token" -kf "auth_token" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, campi noti e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -kf "api_key,api_token" -kf "auth_token" -aff "auth_token" -aff "session_id"

Crawl con più URL, campi noti e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -kf "api_key,api_token" -kf "auth_token" -ef "png,css" -ef "jpg"

Crawl con più URL, campi noti e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -kf "api_key,api_token" -kf "auth_token" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, campi di scope e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -sc "in_scope" -sc "out_of_scope" -aff "auth_token" -aff "session_id"

Crawl con più URL, campi di scope e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -sc "in_scope" -sc "out_of_scope" -ef "png,css" -ef "jpg"

Crawl con più URL, campi di scope e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -sc "in_scope" -sc "out_of_scope" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, campi di autenticazione e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -aff "auth_token" -aff "session_id" -ef "png,css" -ef "jpg"

Crawl con più URL, campi di autenticazione e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -aff "auth_token" -aff "session_id" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, filtri estensione e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -ef "png,css" -ef "jpg" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, proxy, intestazioni e query

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -q "param1=value1" -q "param2=value2"

Crawl con più URL, proxy, intestazioni e estensioni da filtrare

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -e "php,asp" -e "jsp"

Crawl con più URL, proxy, intestazioni e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, proxy, intestazioni e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, proxy, intestazioni e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, proxy, intestazioni e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -aff "auth_token" -aff "session_id"

Crawl con più URL, proxy, intestazioni e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -ef "png,css" -ef "jpg"

Crawl con più URL, proxy, intestazioni e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -H "Authorization: Bearer token" -H "X-Custom: value" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, proxy, query e estensioni da filtrare

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -e "php,asp" -e "jsp"

Crawl con più URL, proxy, query e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, proxy, query e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, proxy, query e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, proxy, query e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -aff "auth_token" -aff "session_id"

Crawl con più URL, proxy, query e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -ef "png,css" -ef "jpg"

Crawl con più URL, proxy, query e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -q "param1=value1" -q "param2=value2" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, proxy, estensioni da filtrare e URL ignorati

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -i "https://example.com/ignore1" -i "https://example.org/ignore2"

Crawl con più URL, proxy, estensioni da filtrare e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, proxy, estensioni da filtrare e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, proxy, estensioni da filtrare e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -aff "auth_token" -aff "session_id"

Crawl con più URL, proxy, estensioni da filtrare e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -ef "png,css" -ef "jpg"

Crawl con più URL, proxy, estensioni da filtrare e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, proxy, URL ignorati e campi noti

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -i "https://example.com/ignore1" -i "https://example.org/ignore2" -kf "api_key,api_token" -kf "auth_token"

Crawl con più URL, proxy, URL ignorati e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -i "https://example.com/ignore1" -i "https://example.org/ignore2" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, proxy, URL ignorati e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -i "https://example.com/ignore1" -i "https://example.org/ignore2" -aff "auth_token" -aff "session_id"

Crawl con più URL, proxy, URL ignorati e filtri estensione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -i "https://example.com/ignore1" -i "https://example.org/ignore2" -ef "png,css" -ef "jpg"

Crawl con più URL, proxy, URL ignorati e estensioni

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -i "https://example.com/ignore1" -i "https://example.org/ignore2" -e "php,asp" -e "jsp" -e "aspx"

Crawl con più URL, proxy, campi noti e campi di scope

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -kf "api_key,api_token" -kf "auth_token" -sc "in_scope" -sc "out_of_scope"

Crawl con più URL, proxy, campi noti e campi di autenticazione

root@kitploit:~
katana -u https://example.com,https://example.org -p http://127.0.0.1:8080,http://127.0.0.1:8081 -kf "api_key,api_token" -kf "auth_token" -aff "auth_token" -aff "session_id"

Crawl con più URL, proxy,```

[*] POC plot idx: 1f fNumPlots: 10

root@kitploit:~
## Git log
Chromium:```
commit e00a64ead1abef9447943efede7bc26362ac3797 (HEAD -> 146.0.7680.71, tag: 146.0.7680.71)
Author: Roger McFarlane <[email protected]>
Date:   Mon Mar 9 12:52:01 2026 -0700

    [M146-desktop-respin] Make LimitedLayerEntropyCostTracker time-aware.
    
    This change modifies the LimitedLayerEntropyCostTracker to account for
    the entropy cost of studies that are active at a specific evaluation
    time. The evaluation time is passed to the tracker's constructor and is
    used to check against the study's filter dates and Google web visibility
    dates.
    
    The current time for entropy evaluation is sourced from
    VariationsIdsProvider.
    
    (cherry picked from commit 2ec2c50b47686def251947a2675a207863803cac)
    
    Bug: 490248046, 490432663
    Change-Id: I3174730f35b037d533bf10b2b1d0531e3781acfe
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7639358
    Reviewed-by: Alexei Svitkine <[email protected]>
    Commit-Queue: Alexei Svitkine <[email protected]>
    Cr-Original-Commit-Position: refs/heads/main@{#1595543}
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7637760
    Bot-Commit: Rubber Stamper <[email protected]>
    Cr-Commit-Position: refs/branch-heads/7680_65@{#23}
    Cr-Branched-From: efe36a9d42443b4091a5be1be21e93ceff9b7a5e-refs/branch-heads/7680@{#1898}
    Cr-Branched-From: 76b7d80e5cda23fe6537eed26d68c92e995c7f39-refs/heads/main@{#1582197}

Argomenti di build```

Set build arguments here. See gn help buildargs.

is_official_build = false is_debug = true
symbol_level = 2 v8_symbol_level = 2 blink_symbol_level = 2 is_component_build = false
proprietary_codecs = true
ffmpeg_branding = "Chrome"
v8_enable_sandbox = true dcheck_always_on = true optimize_webui = true target_os = "linux" target_cpu = "x64"

root@kitploit:~
## Utilizzo

1. Applica i due file di patch a una versione vulnerabile di Chromium.
2. Apri il browser `chrome <path>/trigger.html`

## Interruzione```
gen/third_party/libc++/src/include/__memory/unique_ptr.h:578: libc++ Hardening assertion __checker_.__in_bounds<deleter_type>(std::__to_address(__ptr_), __i) failed: unique_ptr<T[]>::operator[](https://github.com/jaf0rk/cve-2026-3909/blob/HEAD/index): index out of range
Received signal 6

#0 0x5ee6abc4b669 base::debug::CollectStackTrace() [../../base/debug/stack_trace_posix.cc:1048:7]
#1 0x5ee6abc1674a base::debug::StackTrace::StackTrace() [../../base/debug/stack_trace.cc:280:20]
#2 0x5ee6abc166b5 base::debug::StackTrace::StackTrace() [../../base/debug/stack_trace.cc:275:28]
#3 0x5ee6abc4aed9 base::debug::(anonymous namespace)::StackDumpSignalHandler() [../../base/debug/stack_trace_posix.cc:483:3]
#4 0x79f1d4a45330 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x4532f)
#5 0x79f1d4a9eb2c pthread_kill
#6 0x79f1d4a4527e gsignal
#7 0x79f1d4a288ff abort
#8 0x5ee6c330842e std::__Cr::__libcpp_verbose_abort()
#9 0x5ee69655008d std::__Cr::unique_ptr<>::operator[]() [gen/third_party/libc++/src/include/__memory/unique_ptr.h:577:5]
#10 0x5ee6ad4ed963 GrDrawOpAtlas::hasID() [../../third_party/skia/src/gpu/ganesh/GrDrawOpAtlas.h:130:35]
#11 0x5ee6ad577e0b GrAtlasManager::hasGlyph() [../../third_party/skia/src/gpu/ganesh/text/GrAtlasManager.cpp:54:36]        // Abort in here
#12 0x5ee6ad5790b7 sktext::gpu::GlyphVector::regenerateAtlasForGanesh() [../../third_party/skia/src/gpu/ganesh/text/GrAtlasManager.cpp:320:32]
#13 0x5ee6ad48060e skgpu::ganesh::AtlasTextOp::onPrepareDraws()::$_0::operator()() [../../third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:532:28]
#14 0x5ee6ad4805ba std::__Cr::__invoke<>() [gen/third_party/libc++/src/include/__type_traits/invoke.h:90:27]
#15 0x5ee6ad48055d std::__Cr::__invoke_void_return_wrapper<>::__call<>() [gen/third_party/libc++/src/include/__type_traits/invoke.h:342:12]
#16 0x5ee6ad48050d std::__Cr::__invoke_r<>() [gen/third_party/libc++/src/include/__type_traits/invoke.h:356:10]
#17 0x5ee6ad4804a3 std::__Cr::__function::__policy_func<>::__call_func<>() [gen/third_party/libc++/src/include/__functional/function.h:443:12]
#18 0x5ee6ad5ddc1b std::__Cr::__function::__policy_func<>::operator()() [gen/third_party/libc++/src/include/__functional/function.h:502:12]
#19 0x5ee6ad5ddbbb std::__Cr::function<>::operator()() [gen/third_party/libc++/src/include/__functional/function.h:754:10]
#20 0x5ee6ad5d6c08 (anonymous namespace)::DirectMaskSubRun::regenerateAtlas() [../../third_party/skia/src/text/gpu/SubRunContainer.cpp:672:16]
#21 0x5ee6ad47f60d skgpu::ganesh::AtlasTextOp::onPrepareDraws() [../../third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:538:50]
#22 0x5ee6ad4b6129 GrMeshDrawOp::onPrepare() [../../third_party/skia/src/gpu/ganesh/ops/GrMeshDrawOp.cpp:27:61]
#23 0x5ee6ad4b7234 GrOp::prepare() [../../third_party/skia/src/gpu/ganesh/ops/GrOp.cpp:59:11]
#24 0x5ee6ad4d43a3 skgpu::ganesh::OpsTask::onPrepare() [../../third_party/skia/src/gpu/ganesh/ops/OpsTask.cpp:548:27]
#25 0x5ee6ad37e5dd GrRenderTask::prepare() [../../third_party/skia/src/gpu/ganesh/GrRenderTask.cpp:111:11]
#26 0x5ee6ad320e43 GrDrawingManager::executeRenderTasks() [../../third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:266:21]
#27 0x5ee6ad31fca0 GrDrawingManager::flush() [../../third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:209:34]
#28 0x5ee6ad3217f7 GrDrawingManager::flushSurfaces() [../../third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:540:27]
#29 0x5ee6ad31c252 GrDirectContextPriv::flushSurfaces() [../../third_party/skia/src/gpu/ganesh/GrDirectContextPriv.cpp:92:47]
#30 0x5ee6ad2da828 GrDirectContextPriv::flushSurface() [../../third_party/skia/src/gpu/ganesh/GrDirectContextPriv.h:106:22]
#31 0x5ee6ad2d5d2b GrDirectContext::flush() [../../third_party/skia/src/gpu/ganesh/GrDirectContext.cpp:520:25]
#32 0x5ee6ad52d6be skgpu::ganesh::Flush() [../../third_party/skia/src/gpu/ganesh/surface/SkSurface_Ganesh.cpp:759:45]
#33 0x5ee6b2de1d86 gpu::SharedContextState::FlushWriteAccess() [../../gpu/command_buffer/service/shared_context_state.cc:899:9]
#34 0x5ee6b2fc974d gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM() [../../gpu/command_buffer/service/raster_decoder.cc:3108:30]
#35 0x5ee6b2fc720c gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM() [../../gpu/command_buffer/service/raster_decoder_autogen.h:151:3]
#36 0x5ee6b2fdbda0 gpu::raster::RasterDecoderImpl::DoCommandsImpl<>() [../../gpu/command_buffer/service/raster_decoder.cc:1535:18]
#37 0x5ee6b2fcb03e gpu::raster::RasterDecoderImpl::DoCommands() [../../gpu/command_buffer/service/raster_decoder.cc:1597:12]
#38 0x5ee69ff67c00 gpu::CommandBufferService::Flush() [../../gpu/command_buffer/service/command_buffer_service.cc:267:35]
#39 0x5ee6b294071f gpu::CommandBufferStub::OnAsyncFlush() [../../gpu/ipc/service/command_buffer_stub.cc:504:22]
#40 0x5ee6b29401ed gpu::CommandBufferStub::ExecuteDeferredRequest() [../../gpu/ipc/service/command_buffer_stub.cc:173:7]
#41 0x5ee6b295fe51 gpu::GpuChannel::ExecuteDeferredRequest() [../../gpu/ipc/service/gpu_channel.cc:833:13]
#42 0x5ee6b296c5a0 base::internal::DecayedFunctorTraits<>::Invoke<>() [../../base/functional/bind_internal.h:740:12]
#43 0x5ee6b296c4cf base::internal::InvokeHelper<>::MakeItSo<>() [../../base/functional/bind_internal.h:956:5]
#44 0x5ee6b296c425 base::internal::Invoker<>::RunImpl<>() [../../base/functional/bind_internal.h:1069:14]
#45 0x5ee6b296c361 base::internal::Invoker<>::RunOnce() [../../base/functional/bind_internal.h:982:12]
#46 0x5ee69ffa4e24 base::OnceCallback<>::Run() [../../base/functional/callback.h:155:12]
#47 0x5ee69ffa4cb5 base::internal::DecayedFunctorTraits<>::Invoke<>() [../../base/functional/bind_internal.h:815:49]
#48 0x5ee69ffa4c4f base::internal::InvokeHelper<>::MakeItSo<>() [../../base/functional/bind_internal.h:932:12]
#49 0x5ee69ffa4bfd base::internal::Invoker<>::RunImpl<>() [../../base/functional/bind_internal.h:1069:14]
#50 0x5ee69ffa4b99 base::internal::Invoker<>::RunOnce() [../../base/functional/bind_internal.h:982:12]
#51 0x5ee695d021ec base::OnceCallback<>::Run() [../../base/functional/callback.h:155:12]
#52 0x5ee69ff767e0 gpu::Scheduler::ExecuteSequence() [../../gpu/command_buffer/service/scheduler.cc:707:29]
#53 0x5ee69ff7540b gpu::Scheduler::RunNextTask() [../../gpu/command_buffer/service/scheduler.cc:625:3]
#54 0x5ee69ff7b253 base::internal::DecayedFunctorTraits<>::Invoke<>() [../../base/functional/bind_internal.h:740:12]
#55 0x5ee69ff7b1d1 base::internal::InvokeHelper<>::MakeItSo<>() [../../base/functional/bind_internal.h:932:12]
#56 0x5ee69ff7b15d base::internal::Invoker<>::RunImpl<>() [../../base/functional/bind_internal.h:1069:14]
#57 0x5ee69ff7b0e9 base::internal::Invoker<>::RunOnce() [../../base/functional/bind_internal.h:982:12]
#58 0x5ee695d021ec base::OnceCallback<>::Run() [../../base/functional/callback.h:155:12]
#59 0x5ee6abab2eee base::TaskAnnotator::RunTaskImpl() [../../base/task/common/task_annotator.cc:229:34]
#60 0x5ee6abb214c8 base::TaskAnnotator::RunTask<>() [../../base/task/common/task_annotator.h:112:5]
#61 0x5ee6abb20f5e base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl() [../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:472:23]
#62 0x5ee6abb205ca base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() [../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:346:40]
#63 0x5ee6abb21193 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork()
#64 0x5ee6ab98e268 base::MessagePumpDefault::Run() [../../base/message_loop/message_pump_default.cc:42:55]
#65 0x5ee6abb21b67 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run() [../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647:12]
#66 0x5ee6aba4a7bb base::RunLoop::Run() [../../base/run_loop.cc:135:14]
#67 0x5ee6b4863046 content::GpuMain() [../../content/gpu/gpu_main.cc:479:14]
#68 0x5ee6a828dff7 content::RunZygote() [../../content/app/content_main_runner_impl.cc:664:14]
#69 0x5ee6a828e879 content::RunOtherNamedProcessTypeMain() [../../content/app/content_main_runner_impl.cc:771:12]
#70 0x5ee6a828fe8b content::ContentMainRunnerImpl::Run() [../../content/app/content_main_runner_impl.cc:1147:10]
#71 0x5ee6a828c1d7 content::RunContentProcess() [../../content/app/content_main.cc:358:36]
#72 0x5ee6a828c6e6 content::ContentMain() [../../content/app/content_main.cc:371:10]
#73 0x5ee69540c460 ChromeMain [../../chrome/app/chrome_main.cc:191:12]
#74 0x5ee69540c112 main
#75 0x79f1d4a2a1ca (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9)
#76 0x79f1d4a2a28b __libc_start_main
#77 0x5ee69540c02a _start
  r8: 000000000000005d  r9: 0000000000000000 r10: 0000000000000008 r11: 0000000000000246
 r12: 0000000000000006 r13: 0000000000000000 r14: 0000000000000016 r15: 000079f1d5aa2000
  di: 0000000000177a3a  si: 0000000000177a3a  bp: 00007ffc58951cb0  bx: 0000000000177a3a
  dx: 0000000000000006  ax: 0000000000000000  cx: 000079f1d4a9eb2c  sp: 00007ffc58951c70
  ip: 000079f1d4a9eb2c efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000

Crash

Questo può essere mandato in crash solo su Windows. Su Linux, a causa del meccanismo di hardening di libc++, causerà solo un abort.``` Received fatal exception EXCEPTION_ACCESS_VIOLATION chrome!GrDrawOpAtlas::setLastUseToken [0x7fff681452d7+117] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrDrawOpAtlas.h:150) chrome!GrAtlasManager::addGlyphToBulkAndSetUseToken [0x7fff68146702+d2] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/text/GrAtlasManager.cpp:259) chrome!sktext::gpu::GlyphVector::regenerateAtlasForGanesh [0x7fff68146cc4+334] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/text/GrAtlasManager.cpp:315) chrome!std::__Cr::__function::__policy_func<std::__Cr::tuple<bool,int> (sktext::gpu::GlyphVector *, int, int, skgpu::MaskFormat, int)>::__call_func<lambda at ..\..\third_party\skia\src\gpu\ganesh\ops\AtlasTextOp.cpp:527:35'> [0x7fff69ba5f2e+3e] (/home/xxxxxx/*****/google/chrome/chromium/src/third_party/libc++/src/include/__functional/function.h:444) chrome!anonymous namespace'::DirectMaskSubRun::regenerateAtlas [0x7fff663a6b64+44] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/text/gpu/SubRunContainer.cpp:674) chrome!skgpu::ganesh::AtlasTextOp::onPrepareDraws [0x7fff69ba5340+690] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/ops/AtlasTextOp.cpp:541) chrome!GrOp::prepare [0x7fff6b57450e+11e] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/ops/GrOp.cpp:60) chrome!skgpu::ganesh::OpsTask::onPrepare [0x7fff69baf42c+37c] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/ops/OpsTask.cpp:549) chrome!GrRenderTask::prepare [0x7fff69ba1b97+67] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrRenderTask.cpp:111) chrome!GrDrawingManager::executeRenderTasks [0x7fff6813f387+67] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:266) chrome!GrDrawingManager::flush [0x7fff6813ed2c+88c] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:208) chrome!GrDrawingManager::flushSurfaces [0x7fff6813f798+b8] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrDrawingManager.cpp:540) chrome!GrDirectContextPriv::flushSurfaces [0x7fff6815020d+1ad] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrDirectContextPriv.cpp:92) chrome!GrDirectContext::flush [0x7fff663df260+a0] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/GrDirectContext.cpp:520) chrome!skgpu::ganesh::Flush [0x7fff6812f190+40] (/home/xxxxxx//google/chrome/chromium/src/third_party/skia/src/gpu/ganesh/surface/SkSurface_Ganesh.cpp:759) chrome!gpu::SharedContextState::FlushWriteAccess [0x7fff669b24f1+d1] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/shared_context_state.cc:896) chrome!gpu::raster::RasterDecoderImpl::DoEndRasterCHROMIUM [0x7fff6ba14238+e8] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/raster_decoder.cc:3112) chrome!gpu::raster::RasterDecoderImpl::HandleEndRasterCHROMIUM [0x7fff6ba128e9+9] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/raster_decoder_autogen.h:152) chrome!gpu::raster::RasterDecoderImpl::DoCommandsImpl<0> [0x7fff6ba1584e+10e] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/raster_decoder.cc:1535) chrome!gpu::CommandBufferService::Flush [0x7fff60f5533d+1ed] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/command_buffer_service.cc:267) chrome!gpu::CommandBufferStub::OnAsyncFlush [0x7fff669bbc85+155] (/home/xxxxxx//google/chrome/chromium/src/gpu/ipc/service/command_buffer_stub.cc:505) chrome!gpu::CommandBufferStub::ExecuteDeferredRequest [0x7fff669bb6f7+167] (/home/xxxxxx//google/chrome/chromium/src/gpu/ipc/service/command_buffer_stub.cc:173) chrome!gpu::GpuChannel::ExecuteDeferredRequest [0x7fff68773fe4+114] (/home/xxxxxx//google/chrome/chromium/src/gpu/ipc/service/gpu_channel.cc:836) chrome!base::internal::Invoker<base::internal::FunctorTraits<void (optimization_guide::HintsManager::*&&)(base::OnceCallback<void ()>, const optimization_guide::proto::Hint *) const,base::WeakPtr<optimization_guide::HintsManager> &&,base::OnceCallback<void ()> & [0x7fff62ab2ce5+75] (/home/xxxxxx//google/chrome/chromium/src/base/functional/bind_internal.h:982) chrome!base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,base::internal::BindState<0,1,1,base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,base::internal: [0x7fff60f69a8c+5c] (/home/xxxxxx//google/chrome/chromium/src/base/functional/bind_internal.h:982) chrome!gpu::Scheduler::ExecuteSequence [0x7fff60f5bba3+363] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/scheduler.cc:707) chrome!gpu::Scheduler::RunNextTask [0x7fff60f5b123+133] (/home/xxxxxx//google/chrome/chromium/src/gpu/command_buffer/service/scheduler.cc:629) chrome!base::TaskAnnotator::RunTaskImpl [0x7fff661316ac+20c] (/home/xxxxxx//google/chrome/chromium/src/base/task/common/task_annotator.cc:229) chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl [0x7fff67f84681+461] (/home/xxxxxx//google/chrome/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:472) chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork [0x7fff67f84074+b4] (/home/xxxxxx//google/chrome/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:348) chrome!base::MessagePumpDefault::Run [0x7fff67f9b42b+fb] (/home/xxxxxx//google/chrome/chromium/src/base/message_loop/message_pump_default.cc:43) chrome!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run [0x7fff67f84f68+188] (/home/xxxxxx//google/chrome/chromium/src/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:647) chrome!base::RunLoop::Run [0x7fff66154c5e+1fe] (/home/xxxxxx//google/chrome/chromium/src/base/run_loop.cc:137) chrome!content::GpuMain [0x7fff674095e8+6a8] (/home/xxxxxx//google/chrome/chromium/src/content/gpu/gpu_main.cc:480) chrome!content::RunOtherNamedProcessTypeMain [0x7fff64f1484f+2cf] (/home/xxxxxx//google/chrome/chromium/src/content/app/content_main_runner_impl.cc:762) chrome!content::ContentMainRunnerImpl::Run [0x7fff64f157a2+312] (/home/xxxxxx//google/chrome/chromium/src/content/app/content_main_runner_impl.cc:1147) chrome!content::RunContentProcess [0x7fff64f1066b+59b] (/home/xxxxxx//google/chrome/chromium/src/content/app/content_main.cc:358) chrome!content::ContentMain [0x7fff64f108b8+88] (/home/xxxxxx//google/chrome/chromium/src/content/app/content_main.cc:371) chrome!ChromeMain [0x7fff5fc612d9+2a9] (/home/xxxxxx//google/chrome/chromium/src/chrome/app/chrome_main.cc:191) chrome!MainDllLoader::Launch [0x7ff6d40c23b6+3a6] (/home/xxxxxx//google/chrome/chromium/src/chrome/app/main_dll_loader_win.cc:204) chrome!wWinMain [0x7ff6d40c16f5+6d5] (/home/xxxxxx//google/chrome/chromium/src/chrome/app/chrome_exe_main_win.cc:351) chrome!__scrt_common_main_seh [0x7ff6d42b52b2+106] (D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288) KERNEL32!BaseThreadInitThunk [0x7fffe26d7374+14] ntdll!RtlUserThreadStart [0x7fffe389cc91+21]

root@kitploit:~
## Approccio con Versione Stabile
Nella versione stabile di Chromium, applicare direttamente le patch potrebbe non essere fattibile o desiderabile.
Invece, puoi riscrivere la logica della patch come funzioni hook per intercettare e modificare le funzioni di elaborazione rilevanti in fase di esecuzione.
Scarica lo strumento