The Fundamentals of Browser Exploitation

A Self-Paced, Asynchronous Security Training developed by RET2 Systems

Next Session Starting: June 1st, 2026

Asynchronous Training Details

Asynchronous Training Format

This is a self-guided and self-paced training.

Students are given access to our training platform which hosts course materials and facilitates access to training VMs. There are no scheduled livestreams or video sessions; rather students progress through a series of modules and exercises at their own pace.

Instructors and subject matter experts from RET2 will be available for questions and course-assistance via a private discord server (shared with other students in the session), on-platform messaging, or over email. We are also happy to accommodate other methods of assistance upon request.

Course Description

Web browsers are among the most utilized consumer facing software products on the planet. As the ubiquitous gateway to the internet, browsers introduce significant risk to the integrity of personal computing devices. In the race to protect users while advancing web technology, premiere browsers have become increasingly complex targets to compromise.

Over the course of this training, students will receive a thorough introduction to the fundamental concepts of vulnerability research as it pertains to modern web browsers. This includes identifying, evaluating, and weaponizing a range of vulnerability patterns via the exploitation of patched, real-world vulnerabilities as well as custom-written, demonstrative examples. Through this, students will experience the end-to-end process of developing memory corruption based exploits against web browsers.

This course will focus specifically on Google Chrome and Apple Safari.

Learning Outcomes

• Identify contemporary vulnerability patterns in web browsers
• Develop an understanding of target-specific exploit techniques
• Weaponize a diverse selection of real-world vulnerabilities
• Execute renderer-only attacks to hijack user sessions
• Clone, build, and debug properly versioned browser engines
• Learn tooling for vulnerability discovery against massive codebases
• Become familiar with the architecture of modern web browsers
• Build an in-depth understanding of browser internals and JavaScript engines
• Obtain a high-level overview of browser sandboxing

Prerequisites

This is an advanced training that assumes familiarity with contemporary vulnerability research topics.

• Familiar with modern exploitation subjects (DEP, ASLR, ROP)
• Good working-knowledge of C++ and JavaScript
• Experience with assembly-level debugging; recommended familiarity with x86-64
• Linux command line proficiency

Syllabus

Module 1 - Browser Architecture

Learn the architecture of Browser and JavaScript engines

• Breaking down modern browser architectures, major components
• Setting up a browser research environment, building, debugging
• Introduction to JavaScript / DOM for Vulnerability Research
• JavaScript + DOM interaction, "legacy" browser vulnerability patterns
• JavaScript Engine Design
• V8 (Chromium) and JavaScriptCore (WebKit) Engine Internals
• JavaScript Garbage Collection

Module 2 - JavaScript Engine Vulnerabilities

Exploring V8 and JavaScriptCore engine internals

• JavaScript Vulnerability Patterns
• Anatomy of a JavaScript Engine Exploit
• Building Arbitrary R/W Primitives from JS vulnerabilities
• Building Arbitrary Code Execution Primitives
• V8 and JSC JIT Overwrite Exercises

Module 3 - JavaScript Execution and JIT Compilation

Identify and exploit JIT based vulnerabilities

• Overview of JIT compiler pipelines
• JIT debugging and tools
• Optimizations and typing
• Type cache and speculation
• Overwriting JIT structures
• JIT vulnerability classes, contemporary exploits

Module 4 - Exploit Engineering

The exploit formula behind every browser vulnerability

• Browser-Specific Exploit Mitigations
• Renderer-Only Attacks (SOP Bypass)
• Overview of Browser Sandboxing
• Overview of Web-Browser Fuzzing Strategies
• Chrome N-Day Exercise

Feature Showcase

Training VM

Each user receives their own, personal cloud-hosted Training Virtual Machine. This VM can be started, stopped, and configured directly from the training platform.

Integrated Exercises

Exercises are interspersed throughout the written materials to encourage learning-by-doing. These exercises are integrated into the Training VM and can be launched and debugged with one-line commands.

Prebuilt Engines

Multiple prebuilt, pre-patched, and pre-configured engines allow you to focus on learning browser-exploitation. No fighting compilers and manual patch-diffing required!