Tags: chromium pwn sbx 

Rating:

Unitialized read triggered by invalid buffer enum in BigBuffer for wreck type. Spray Ozymandias, and free them, and trigger the bug to leak tokens to be able to trigger Visage backdoor.

Original writeup (https://www.willsroot.io/2021/07/redpwnctf-2021-chromium-sbx-tasks.html).