evilqr

Evil QR Kit de herramientas que demuestra otro enfoque de un ataque QRLJacking, permitiendo realizar la toma de control remota de cuentas mediante phishing de códigos QR de inicio de sesión. Consiste en una extensión de navegador utilizada por el atacante para extraer el código QR de inicio de...

sonar.js

sonar.js Un framework para identificar y lanzar exploits contra hosts de la red interna. Funciona mediante enumeración de IPs por WebRTC, escaneo de hosts por WebSocket y fingerprinting de recursos externos. ¿Cómo funciona? Al cargar el payload sonar.js en un navegador web moderno ocurrirá lo...

CVE-2021-30551

CVE-2021-30551 My exp for chrome V8 CVE-2021-30551 You can found your chrome version by chrome://version or go to http://whatsmyuseragent.org/ You can set up a webserver locally using python like: python3 -m http.server 8080 And the test it by accessing http://127.0.0.1:8080 reference google...

CVE-2026-71189

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2023-21674

First in-the-wild 0-day of 2023 🔥 CVE-2023-21674 is a vulnerability in Windows Advanced Local Procedure Call ALPC that could lead to a browser sandbox escape and allow attackers to gain SYSTEM privileges discovered by Avast kd !analyze -v Bugcheck Analysis PAGEFAULTINNONPAGEDAREA 50 Invalid syste...

trape

trape estable v2.0 Rastreador de personas en Internet: Aprende a rastrear el mundo para evitar ser rastreado. Trape es una herramienta de análisis e investigación OSINT que permite a las personas rastrear y ejecutar ataques inteligentes de ingeniería social en tiempo real. Fue creada con el...

EvilSelenium

EvilSelenium EvilSelenium 是一个新项目，旨在武器化 Selenium 以滥用基于 Chromium 的浏览器。当前功能包括： 窃取已保存的凭据（通过自动填充） 窃取 Cookie 对网站进行截图 导出 Gmail/O365 邮件 导出 WhatsApp 消息 下载并外传文件 向 GitHub 添加 SSH 密钥 或者扩展现有功能以满足您的需求（例如，从用户的 GDrive/OneDrive 下载文件）。 注意 1. 运行此工具时，它会终止任何现有的浏览器进程，以便能够使用包含密码和活动会话的用户浏览器配置文件。 2...

CVE-2026-102326

A flaw was found in chromium-browser. A type confusion vulnerability in the V8 JavaScript engine allows a remote attacker to execute arbitrary code inside the browser sandbox. An attacker could exploit this flaw by convincing a user to open a specially crafted HTML page...

CVE-2026-102316

A flaw was found in chromium-browser. A use-after-free issue in the Views framework allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a specially crafted HTML page. Exploitation of this vulnerability occurs when the application...

CVE-2026-102313

A flaw was found in chromium-browser. An uninitialized resource in the ANGLE Almost Native Graphics Layer Engine component leads to information disclosure. A remote attacker can exploit this vulnerability by convincing a user to open a crafted HTML page, enabling the attacker to read memory outsi...

CVE-2026-102306

A flaw was found in chromium-browser's Bluetooth component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This triggers a use-after-free condition—where the application accesses memory that has already been deallocated—potentially...

slipstream

NAT Slipstreaming NAT Slipstreaming permite a un atacante acceder remotamente a cualquier servicio TCP/UDP vinculado a cualquier sistema detrás del NAT de la víctima, evitando el NAT/cortafuegos de la víctima control remoto arbitrario de agujeros en el cortafuegos, simplemente con que la víctima...

CVE-2026-95319

A flaw was found in chromium-browser. A use-after-free memory corruption flaw in the printing component allows a remote attacker who has already compromised the renderer process to escape the browser sandbox and potentially execute arbitrary code on the host system. To exploit this vulnerability,...

CVE-2026-95298

A flaw was found in chromium-browser. A use-after-free vulnerability, where memory is improperly accessed after being released, exists within the browser process. A local attacker can exploit this flaw through specific user interface UI interactions to potentially execute arbitrary code outside t...

CVE-2026-95286

A flaw was found in chromium-browser. A type confusion vulnerability—where data is processed using an incompatible data type—exists in the browser's Bindings component. A remote attacker can exploit this flaw by enticing a user to view a specially crafted HTML page, leading to arbitrary code...

CVE-2026-95278

A flaw was found in chromium-browser. Due to missing authorization in the WakeLock component, a remote attacker who has already compromised the browser's renderer process can bypass system access restrictions. An attacker could exploit this vulnerability by convincing a user to open a specially...

CVE-2026-95308

A flaw was found in chromium-browser. An integer overflow in the Metrics component allows a remote attacker who has already compromised the renderer process to read memory outside the security sandbox. By convincing a user to visit a crafted HTML page, the attacker can exploit this issue to acces...

CVE-2026-95371

A flaw was found in chromium-browser. A missing authorization check in the Views component allows a remote attacker who has compromised the renderer process to spoof user interface UI elements. By tricking a user into visiting a crafted web page, the attacker can display deceptive interface...

CVE-2026-95366

A flaw was found in chromium-browser. A remote attacker with control over a compromised renderer process could exploit a use-after-free condition in the Core component by loading a crafted HTML page. Successful exploitation allows the attacker to bypass the web origin policy, weakening the securi...

CVE-2026-95364

A flaw was found in chromium-browser. Due to improper input validation in the password management component, a remote attacker can spoof user interface UI elements by enticing a user to visit a crafted HTML page. Successful exploitation can allow an attacker to display deceptive interface prompts...