All browsers hacked at Pwn2Own competition

During the second day of the Pwn2Own hacking competition Thursday, Security researchers demonstrated zero-day exploits against Google Chrome, Microsoft Internet Explorer, Apple Safari, Mozilla Firefox and Adobe Flash Player. Prizes totaled $450,000.

French vulnerability research firm Vupen took down Google Chrome. They first exploited a use-after-free vulnerability that affects both the WebKit and Blink rendering engines. From there, it was easy to bypass Chrome’s sandbox protection.

On the first day of the competition, the same group hacked Internet Explorer 11, Firefox, Flash Player and Adobe Reader.


Hacker George Hotz demonstrated a remote code execution exploit against Firefox.

Thursday, Sebastian Apelt and Andreas Schmidt successfully hacked Microsoft Internet Explorer.

Liang Chen, of the Chinese Keen Team, demonstrated a successful hack against Apple Safari. They then went on to demonstrate a remote code execution exploit for Adobe Flash Player.

The total contest payout was a whopping $850,000, not including charitable donations or the value of the test laptops.