Researchers have published the full technical details and exploit code for a critical remote code execution (RCE) vulnerability in Google Chrome’s V8 JavaScript engine. 

Tracked internally as a WebAssembly type canonicalization bug, the flaw stems from an improper nullability check in the CanonicalEqualityEqualValueType function introduced by commit 44171ac in Chrome M135 and above. 

This regression fails to distinguish between ref t0 and ref null t0, enabling an attacker to craft two recursive type groups that collide under the same MurmurHash64A hash value. 

By launching a birthday attack on the type canonicalization, the exploit achieves nullability confusion on indexed reference types, undermining core Wasm type safety guarantees.

A novel V8 sandbox bypass leverages JavaScript Promise Integration (JSPI) state-switching flaws introduced in M137. 

SSD Secure Disclosure stated that an attacker abuses an intra-state confusion in the secondary stack management logic to pivot execution between nested JS and Wasm stacks out of order. 

By skipping over inactive stacks and spraying attacker-controlled values into suspended frames, the exploit gains full stack control and builds a return-oriented programming chain to invoke VirtualProtect on a RWX shellcode buffer.

Chrome RCE Vulnerability Exploit 

The publicly released proof-of-concept comprises an HTML payload and accompanying JavaScript leveraging wasm-module-builder.js to generate bespoke Wasm types and functions. To deploy the exploit:

Then, navigate to http://127.0.0.1:8000/exp.html. Successful exploitation will spawn a Windows calc.exe process via a crafted ROP chain and RWX shellcode. The exploit script performs the following steps:

Enumerates two Wasm recursive type groups (t2null vs. t2nonnull) differing only in nullability, then uses a birthday attack across 2^32 MurmurHash64A values to locate a collision.

Casts a ref null t1 into ref t1, granting a sandboxed caged read/write primitive by abusing out-of-bounds access to a large ArrayBuffer.

Constructs nested promise-based Wasm exports to force stack switches, then exploits a missing SBX_CHECK in commit c6426203 to skip an inactive stack frame, yielding attacker-controlled execution context.

Sprays a retsled array of gadget addresses—pop rax; jmp rax, VirtualProtect thunk offsets, etc.—to mark shellcode memory as executable and jump into it.

Credit for the discovery and exploit goes to Seunghyun Lee (0x10n), winner of the Chrome RCE category at TyphoonPWN 2025. 

A patch has been committed to address the nullability regression, reintroduce strict SBX_CHECKs in JSPI, and restore robust type safety in the V8 engine. 

Users are strongly advised to update to Chrome M137.0.7151.57 (or later) as soon as possible to mitigate this critical RCE risk.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Google Chrome RCE Vulnerability Details Released Along with Exploit Code appeared first on Cyber Security News.

A publicly available proof-of-concept (PoC) exploit has been released for CVE-2025-32463, a local privilege escalation (LPE) flaw in the Sudo utility that can grant root access under specific configurations. 

Security researcher Rich Mirch is credited with identifying the weakness, while a functional PoC and usage guide have been published in an open GitHub repository, accelerating the urgency for patching across Linux environments that rely on Sudo’s chroot functionality. 

According to the project documentation, versions 1.9.14 through 1.9.17 are vulnerable, with fixes available in 1.9.17p1 and later. Systems running legacy builds prior to 1.9.14 are not impacted because the chroot feature did not exist in those releases.

Local Privilege Escalation Flaw (CVE-2025-32463)

The vulnerability resides in how Sudo handles chroot-related invocation paths and environment when executing commands with elevated privileges. 

Under certain conditions, a low-privileged user can exploit the chroot feature to pivot out of the constrained environment and execute commands as root. 

This turns a standard LPE scenario into full system compromise when Sudo policies permit chroot usage. 

The PoC demonstrates a straightforward exploitation flow: verify the target Sudo version, run the exploit script, and observe the effective UID/GID change to root. 

In testing screenshots, the user transitions from uid=1001 to uid=0 after executing the script, confirming successful escalation. 

The project explicitly categorizes the issue as “Local Privilege Escalation to Root via Sudo chroot in Linux,” emphasizing that weaponization hinges on local account access and specific Sudo configurations that enable chroot execution.

Mitigations

Immediate remediation is to upgrade Sudo to 1.9.17p1 or newer across affected hosts. Where upgrades must be staged, administrators should harden Sudoers policies to deny or tightly restrict use of chroot, and enforce least privilege. 

Mandatory access control frameworks such as AppArmor or SELinux can further constrain Sudo behavior and contain abuse paths during change windows. 

From a detection perspective, defenders should monitor for anomalous Sudo invocations referencing chroot or unusual working directories, correlate privilege transitions (uid changes to 0) from non-standard shells or paths, and alert on rapid “id → exploit → id” sequences commonly seen during exploitation tests.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post PoC Exploit Released for Sudo Vulnerability that Enables Attackers to Gain Root Access appeared first on Cyber Security News.

A critical use-after-free vulnerability, identified as CVE-2025-49844, has been discovered in Redis servers, enabling authenticated attackers to achieve remote code execution.

This high-severity flaw affects all versions of Redis that utilize the Lua scripting engine, presenting a significant threat to a wide range of deployments that rely on the popular in-memory data store.

The core of the issue lies in how Redis handles memory management within its Lua scripting component. An authenticated user with permissions to run Lua scripts can craft a malicious script to manipulate the server’s garbage collector.

This manipulation triggers a use-after-free condition, a memory corruption flaw where the application attempts to access memory after it has already been freed.

Vulnerability Details

A skilled attacker can exploit this condition to hijack the application’s execution flow, ultimately leading to the execution of arbitrary code on the server. This provides the attacker with control over the Redis instance and the underlying system.

The potential for remote code execution makes this a critical vulnerability. A successful exploit could allow an attacker to compromise the confidentiality, integrity, and availability of the data stored within the Redis database.

Attackers could steal sensitive information, modify or delete records, or cause a denial-of-service condition. Furthermore, a compromised Redis server can serve as a foothold for attackers to move laterally across a network, escalating their privileges and targeting other internal systems.

The flaw’s impact is widespread, as it affects all Redis versions that support Lua scripting, a feature that has been integral to the platform for many years.

Mitigations

While organizations await a formal security patch, a robust workaround is available to mitigate the risk. Administrators are strongly advised to prevent users from executing Lua scripts, which is the primary attack vector.

This can be implemented by modifying Redis Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands. By blocking these commands, any attempt to run a malicious script will be denied, effectively neutralizing the threat.

This workaround provides an immediate defense without needing to update the redis-server executable and should be prioritized for all production environments.

The issue was responsibly disclosed by researchers Benny Isaacs, Nir Brakha, and Sagi Tzadik of Wiz, who collaborated with Trend Micro’s Zero Day Initiative.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Redis Server Vulnerability use-after-free Vulnerability Enables Remote Code Execution appeared first on Cyber Security News.