Time Table

Browser security is hard, especially with the sharpest minds all on the same target. Years of mitigations have made a modern Chromium full chain one of the toughest exploits: a memory-corruption bug in V8 or Blink, a V8 Sandbox bypass to own the renderer, then another in Mojo IPC or the kernel to break out.

But what if we skip all that and go straight for its privileged process?

In this talk, we throw out memory-corruption bugs and take on Chromium’s security model with pure logic alone. All inside the browser process. We found ~20 logic bugs, chained into three attacks: several UXSS at once, a 0-click arbitrary file read, and the Microsoft Edge full chain from Pwn2Own 2026. We’ll cover revived and new attack surfaces, island-hopping between privileged origins, the renderer/browser trust boundary, and how AI helped.

Not all bugs are born equal: some look unexploitable, even like features. But chained the right way, even the most harmless one becomes a vital link in the great escape.