Exploiting the Undefined: PWNing Firefox by Settling its Promises

No ratings

Presented at Hexacon 2025 by

Tao Yan

Bochin

Some vulnerabilities remain deeply hidden within systems for years. Sometimes, even when discovered, they are considered unexploitable due to their restrictive primitives. This presentation discusses a unique exploit targeting Firefox that was demonstrated at Pwn2Own Berlin 2025, showcasing how deeply hidden and seemingly unexploitable vulnerabilities can be transformed into reliable exploits through innovative exploitation techniques. We’ll explore how connecting similar implementation issues for the JavaScript (JS) Promise specification across different browsers revealed a six-year-old Firefox vulnerability. This approach can be extended to other JS specifications to uncover further hidden vulnerabilities. We’ll also present a novel technique for exploiting undefined fields in SpiderMonkey JS engine objects to creatively convert a highly restricted out-of-bounds write (OOBW) primitive into a use-after-free (UAF), ultimately achieving type confusion for more powerful exploitation primitives. Furthermore, we’ll detail state-of-the-art heap grooming and garbage collection manipulation techniques specifically tailored for SpiderMonkey heaps. In addition to all that, we’ll introduce a novel, universal method for faking arbitrary objects in SpiderMonkey without requiring object shape addresses to be leaked, a technique with broad applicability across SpiderMonkey-based exploits.