ABUSING LIFTOFF ASSEMBLY AND EFFICIENTLY ESCAPING FROM SBX

Summary from the TLDR InfoSec newsletter

Chrome has implemented new mitigations to make it more difficult to exploit the v8 JavaScript engine. The "V8 Sandbox" project was developed as a way to isolate and protect v8. This document discusses Liftoff, v8's WebAssembly compiler, and highlights some interesting opcodes generated by Liftoff.