From Chaos to Control: A Modern Approach to UAF Attack Detection

From Chaos to Control: A Modern Approach to UAF Attack Detection

Speakers: Mari, Product Security Researcher, Microsoft / Co-Director, University of Montreal

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=Hp8-_9MxAqc

Overview

Mari, a product security researcher at Microsoft and co-director at the University of Montreal, presented a three-year research project developing a novel dynamic detection method for use-after-free (UAF) vulnerabilities. The approach instruments target binaries using Frida, hooks all deallocation functions, scans thread stacks for dangling pointers, confirms their stability over time, and unwinds the stack to identify which functions own those pointers. The method was demonstrated against custom test binaries and Chromium, where it was scaled to monitor tens of thousands of free symbols simultaneously, with AI-generated HTML used to trigger deallocation behaviors.

This is original vulnerability research with a clear contribution: a detection methodology that is conceptually more targeted than fuzzing+ASan because it works from a known state (the free call) rather than requiring blind input generation to trigger the bug. The speaker was candid about a critical limitation discovered two years into the project -- the functions holding dangling pointers at free time are not necessarily the ones that will later dereference those pointers -- and presented a forward strategy using the angr symbolic execution framework to resolve this ownership transfer problem.

Background

▶ Watch: Introduction: three-year UAF detection research project (0:00)

Use-after-free vulnerabilities occur when an object is freed from memory but a pointer to that memory (a dangling pointer) continues to exist and is later used. If the freed memory is reallocated to a different object, the dangling pointer can be exploited to manipulate the new object -- for example, toggling a notification setting that now controls an is_admin flag, achieving privilege escalation without injecting any code.

UAF bugs are particularly difficult to detect for several reasons: no malicious payload is required (unlike code injection or code reuse attacks like ROP), the vulnerability can be time-dependent and state-dependent (the use and free may be in different threads), and the symbol space for deallocation is enormous -- in Chromium alone, the speaker identified over 46,000 functions that could trigger a free behavior, with the free symbol itself having different definitions across different DLLs.

The existing approaches have known limitations. Dynamic detection (fuzzing with tools like Microsoft OneFuzz or Google ClusterFuzz combined with ASan - Address Sanitizer) requires triggering the UAF to find it -- a circular problem that misses many instances. Hardware-assisted sanitizers are probabilistic and architecture-limited (Windows x86 user-land). Static analysis (SAST) detects only simple, obvious cases. Prevention via safer abstractions (smart pointers, security-by-design) is ideal but requires rewriting entire codebases -- Chromium, which is larger than the Linux kernel, makes this impractical, and it still depends on third-party code doing the same.

Bug bounties reflect the value: Chromium bug tracker screenshots showed rewards of $10,000 and $17,000 for UAF crash reports, with some UAF bugs earning hundreds of thousands of dollars.

Key Findings

▶ Watch: State of the art: fuzzing + ASan limitations and static analysis gaps (6:00)

The research produced a six-step detection pipeline, all steps successfully implemented:

1. Instrument the binary (using Frida for JavaScript injection into the target process)
2. Hook all deallocators (free, delete, class destructors, any function leading to object deallocation)
3. Scan all thread stacks for the freed address (dangling pointer identification)
4. Rescan after a delay to confirm stable UAF condition (filtering transient stack states)
5. Unwind the stack to resolve which function owns each dangling pointer (custom stack unwinder due to Frida limitations)
6. Trigger the owning function to attempt UAF exploitation (including using LLMs to generate trigger strategies)

The critical assumption flaw discovered after two years: the functions holding pointers when free is called are not necessarily the ones that will dereference those pointers later -- ownership can be transferred to other functions. True positives only occur when the logic that dereferences the dangling pointer already has a frame in the stack at the time of the free call.

The forward strategy uses the angr symbolic execution framework to confirm or deny execution paths from the free state that transfer pointer ownership. This converts the problem from a blind hunting problem to a constrained reachability problem with a well-defined starting state.

The research was tested on 15 UAF use case categories including error path frees, callbacks, container misuse, general dangling pointers, and global pointer cleanup, with successful detection across all categories.

On Chromium, the tool was scaled to monitor thousands of free symbols simultaneously, with AI-generated HTML/CSS files used to automatically trigger deallocation behavior across all test symbols. The speaker reported submitting one finding that was confirmed as a true positive by the Chromium team, though it had been independently reported in the same week.

Technical Deep Dive

▶ Watch: Ownership transfer problem: why angr is needed (14:00)

The implementation uses Frida for binary instrumentation, injecting JavaScript into target processes to hook deallocation functions. The tool presents a GUI interface that can list all Chromium subprocesses (GPU, network, renderer), launch Chromium with sandbox disabled (required for instrumentation -- sandboxed processes cannot be instrumented), and load symbols using regex matching to find all free-related symbols.

Stack scanning works by capturing the address passed as a parameter to the hooked free function, then iterating through all thread stacks searching for that address. Stack estimation limits the unwinding depth (e.g., 100 frames maximum) to prevent infinite recursion. The custom stack unwinder operates on 32-bit architectures because publicly available documentation for 64-bit Windows stack unwinding is virtually nonexistent (the speaker noted only one document on the planet discusses this for Windows). Despite being a Microsoft employee with access to internal documentation, the speaker deliberately used only publicly available information.

The stack unwinder has limitations: it sometimes cannot resolve the name of the deallocator caller, which the speaker attributed to Frida limitations. More capable public stack unwinders exist, but calling libraries like libunwind from Frida's injected JavaScript presents integration challenges.

For Chromium-scale testing, the tool uses a database to log each symbol's quest: the symbol name, the process it was analyzed in, the HTML/CSS code used to trigger the free, and the detection results. The 46,000+ symbols identified via keyword search represent a lower bound -- the speaker estimated at least 100,000 symbols in Chromium could lead to object deallocation.

The angr integration (work in progress) aims to solve the ownership transfer problem. Given the well-defined state at the moment of the free call (known function, known context), angr would perform constrained symbolic execution to confirm or deny reachable execution paths that transfer the dangling pointer to other logic. This is more tractable than general symbolic execution because the starting state is fully defined.

Demo / Proof of Concept

▶ Watch: Demo: dangling pointer detection on test binary with Frida (18:00)

The speaker showed two demos. The first demonstrated the full pipeline on a custom test binary: hooking the free function, scanning stacks, identifying two dangling pointers, confirming stable UAF condition, and unwinding the stack to identify the owning functions (reported as "argument of the deallocator caller or local variable of main").

The second demo targeted Chromium, showing the GUI selecting the networking subprocess, using regex to find free symbols, adding multiple symbols for simultaneous monitoring, and instrumenting all Chromium subprocesses at once. The speaker showed the AI-generated HTML files used to trigger deallocation behavior, noting that some HTML successfully triggered the free while others did not -- an area for improvement.

Screenshots of potential Chromium findings were shown with function names redacted to avoid disclosing potentially exploitable information. The speaker confirmed one submission to Chromium's bug tracker was a true positive but had been independently reported the same week.

Defensive Implications

▶ Watch: AI-generated HTML to trigger free behavior and Chromium results (26:00)

This research has direct implications for browser security teams and any organization maintaining large C/C++ codebases. The methodology is language-independent and does not require debugging symbols for the target program -- only the debugging symbols for the DLLs containing the free definitions are needed.

The tool is planned for open-source release, potentially before the angr improvements are complete, to invite community contribution to reducing false positive and false negative rates. For security teams performing vulnerability research on their own products, this approach provides a more targeted alternative to fuzzing: rather than generating random inputs hoping to trigger a UAF, it starts from the known state of a free call and works forward to identify exploitable conditions.

The sandboxing limitation (inability to instrument sandboxed processes via Frida) is acknowledged but not critical for detection purposes, as UAFs in unsandboxed processes are typically more valuable. The speaker noted that UAFs have been reported even in sandboxed Chromium processes, and those in unsandboxed processes carry higher bounty values.

Key Takeaways

• A novel UAF detection method that hooks deallocators, scans thread stacks for dangling pointers, confirms stability, and unwinds the stack to identify owning functions -- all six pipeline steps successfully implemented
• The critical insight after two years: pointer ownership can transfer after the free call, meaning the stack-present functions at free time are not necessarily the future dereferencers; angr symbolic execution is being integrated to solve this
• Chromium has 46,000+ functions that trigger free behavior, and the tool scales to monitor thousands simultaneously using AI-generated HTML/CSS to trigger deallocation
• The method is language-independent and requires only debugging symbols for the libraries containing free definitions, not for the target binary itself
• One Chromium finding was confirmed as a true positive; hundreds more are in triage with potential CVEs pending
• The tool will be open-sourced to enable community contribution to false positive/negative reduction

About the Speaker(s)

Mari is a product security researcher at Microsoft and co-director at the University of Montreal. His prior research includes cyber-physical system security for nuclear reactors, smart grids, and aircraft. This UAF detection project has been a three-year personal research effort. He mentioned planning to open-source the tool and expressed interest in collaborating with the angr team to improve the symbolic execution integration. This was his first BSides conference.