BRW-CHROME-IPCPrivilege Escalation

Chromium Mojo IPC Confused-Deputy

Renderer asks the broker process for a privileged capability it shouldn't have — broker performs the action because IPC validation is missing.

§ Where this technique fits

BRW-CHROME-IPC is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

§ Dossiers chaining this technique

V8 type-confusion 1-day → renderer RCE
Public V8 type-confusion turned into a renderer pop. JS triggers JIT into mis-compiling a polymorphic site, addrof/fakeobj primitives, shellcode in a WASM RWX page.
step 6 / 7

§ What commonly comes next

01
Boot or Logon Autostart Execution
T1547 · Persistence
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

V8 type-confusion 1-day → renderer RCE

§ What commonly comes next