# P2P Interceptor Iterator Invalidation UAF

## Files

- `renderer_patch.diff` - Renderer-side patch simulating compromised renderer (creates P2P sockets via Mojo IPC directly)
- `poc.html` - Minimal HTML trigger page
- `poc_trigger.py` - Python orchestrator that launches Chrome, enables CDP network throttling, and waits for crash
- `asan_log.txt` - Complete ASAN trace including additional information section

## Reproduction Steps

1. Apply `renderer_patch.diff` to `content/renderer/render_frame_impl.cc`
2. Build ASAN-instrumented Chrome: `autoninja -C out/asan-release chrome`
3. Run: `python3 poc_trigger.py`

## Environment

- Chromium trunk (tested at HEAD)
- Linux x86_64, ASAN build
- Desktop out-of-process Network Service (default)
- Add `--enable-features=NetworkServiceInProcess` to match Android in-process config