Share some useful archives about browser exploitation.
I'm just starting to collect what I can found, and I'm only a starter in this area as well. Contributions are welcome.
- v8 github mirror(docs within)[github]
- on-stack replacement in v8[article] // multiple articles can be found within
- A tour of V8: Garbage Collection[article]
- A tour of V8: object representation[article]
- v8 fast properties[article]
- learning v8[github]
- Intro to Chrome’s V8 from an exploit development angle[article]
- Introduction to TurboFan[article]
- V8 / Chrome Architecture Reading List - For Vulnerability Researchers
- Mobile Pwn2Own Autumn 2013 - Chrome on Android - Exploit Writeup[article]
- Exploiting a V8 OOB write[article]
- Pointer Compression in V8[article]
- Exploiting the Math.expm1 typing bug in V8[article]
- Exploiting an Accidentally Discovered V8 RCE
- Escaping the Chrome Sandbox via an IndexedDB Race Condition[article]
- Exploiting CVE-2020-0041 - Part 1: Escaping the Chrome Sandbox[article]
- Cleanly Escaping the Chrome Sandbox[article]
- Escaping the Chrome Sandbox with RIDL[article]
- You Won't Believe what this One Line Change Did to the Chrome Sandbox[article]
- Microsoft Edge MemGC Internals[slides]
- The ECMA and the Chakra[slides]
- 2012 - Memory Corruption Exploitation In Internet Explorer[slides]
- 2013 - IE 0day Analysis And Exploit[slides]
- 2014 - Write Once, Pwn Anywhere[slides]
- 2014 - The Art of Leaks: The Return of Heap Feng Shui[slides]
- 2014 - IE 11 0day & Windows 8.1 Exploit[slides]
- 2014 - IE11 Sandbox Escapes Presentation[slides]
- 2015 - Spartan 0day & Exploit[slides]
- 2015 - 浏览器漏洞攻防对抗的艺术 Art of browser Vulnerability attack and defense (Chinese)[slides]
- 2016 - Look Mom, I don't use Shellcode[slides]
- 2016 - Windows 10 x64 edge 0day and exploit[slides]
- 2017 - 1-Day Browser & Kernel Exploitation[slides]
- 2017 - The Secret of ChakraCore: 10 Ways to Go Beyond the Edge[slides]
- 2017 - From Out of Memory to Remote Code Executio[slides]
- 2018 - Edge Inline Segment Use After Free (Chinese)
- 2017 - CROSS THE WALL-BYPASS ALL MODERN MITIGATIONS OF MICROSOFT EDGE[slides]
- Browser security mitigations against memory corruption vulnerabilities[references]
- Browsers and app specific security mitigation (Russian) part 1[article]
- Browsers and app specific security mitigation (Russian) part 2[article]
- Browsers and app specific security mitigation (Russian) part 3[article]
- JSC loves ES6[article] // multiple articles can be found within
- JavaScriptCore, the WebKit JS implementation[article]
- saelo's Pwn2Own 2018 Safari + macOS[exploit]
- WebKit & JSC Architecture Reading List - For Vulnerability Researchers