RCE Exploit for Google Chrome/Chromium for Sale

For informational purposes only.

Vulnerability Type: Remote Code Execution (RCE) / Sandbox Escape Vulnerable Versions: Google Chrome/Chromium versions 154–156 Privileges Gained: SYSTEM Price: $10,000

The author claims to be selling an exploit for Chromium-based browsers that allows remote execution of arbitrary code, bypasses the browser’s isolation mechanisms (Sandbox Escape), and can potentially grant SYSTEM-level privileges on Windows 10 and 11 operating systems.

According to the seller, a successful attack requires only that the victim visit a specially crafted web page or download malicious content. The exploit uses an exploit chain that includes code execution within the browser’s rendering process (Renderer RCE) and subsequent sandbox escape via the Mojo/IPC mechanism. No additional user interaction is required.

The author claims that the tool is compatible with Google Chrome/Chromium versions 154–156 and has been tested on Windows 10 22H2, as well as Windows 11 23H2, 24H2, and 25H2. It is claimed that the tool can execute malicious code directly in RAM without needing to write files to disk. The chain uses JavaScript and native shellcode, and also includes a core component for communicating with the command-and-control (C2) server.