Ndays Are Also 0days: The Chromium Downstream RCE Window
Demonstrates transforming publicly patched Chromium N-day vulnerabilities into remote code execution 0-days across popular Electron and CEF desktop applications.
Summary
The Pervasiveness of Chromium in Downstream Software
Frameworks like Electron and Chromium Embedded Framework (CEF) embed Chromium into hundreds of popular desktop communication, gaming, and productivity applications.
The 14-Week Chromium Disclosure Window
Bohan Liu, Zheng Wang, and GuanCheng Li evaluate the 'RCE window period'—the multi-week delay between Google publicly disclosing a Chromium fix and downstream apps updating dependencies.
Transforming N-Day Flaws into 10+ Desktop RCE 0-Days
Demonstrating over 10 distinct zero-day exploits shows how unpatched downstream applications allow attackers to achieve remote code execution using publicly documented V8 and WebKit bugs.
Bypassing Application Sandboxes and Best Practices
The researchers demonstrate bypassing custom application sandboxes and provide actionable patch management guidance for desktop software developers.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Creator Stage·12 min
Richard Lawshae
Explores how unpatched software development kits from major chipset vendors perpetuate persistent vulnerabilities across millions of consumer IoT devices.