Dan Guido

Thanks to the efforts from a few dedicated members of Trail of Bits (@withzombies, scott, and others), I have real info to share.

First off, it's a garden variety use-after-free, not a heap overflow, and it affects the SVG parser Firefox.

MWR published research in this area years ago in WebKit, and it appears that Firefox is lagging a few years behind. https://labs.mwrinfosecurity.com/blog/mwr-labs-pwn2own-2013-write-up-webkit-exploit/ …

As far as exploit techniques, this is a routine UAF that heap sprays a controlled object to kick off a ROP chain. Pwn2Own 2012-level tech.

The controlled object eventually gives them RW access to memory, then its game over.

This is not an advanced exploit. If you want to see one of those, check out Pegasus which had to deal with code signing and JIT pages.

This type of exploit is much harder to write in Chrome and Edge due to memory partitioning, an exploit mitigation that Firefox lacks.

If you thought this exploit was from MSF, it's not. MSF has 8 Firefox exploits, none of them match this new one.