VM Escape via Chrome and VMware: Six‑CVE Attack Chain

The article explains a real‑world VM‑escape attack demonstrated by a Korean security firm, where a user clicks a malicious link in Chrome running inside a VMware virtual machine and the host physical machine becomes compromised.

The attack chain consists of six CVEs: CVE-2023-3079: Chrome V8 JavaScript engine remote code execution. CVE-2023-21674: Privilege escalation out of Chromium sandbox. CVE-2023-29360: Windows kernel driver vulnerability granting system‑level rights. CVE-2023-34044: Information‑gathering vulnerability exposing VM internals. CVE-2023-20869: Exploits shared Bluetooth device channel to trigger a host buffer overflow. CVE-2023-36802: Another Windows kernel driver flaw that gives the attacker highest privileges on the host.

By sequentially exploiting these flaws, the attacker obtains high privileges inside the VM, extracts sensitive VM data, and finally executes code on the host, demonstrating how a simple click can lead to a full APT‑style compromise.