Operation_WizardOpium__2020__The_zero-day_exploits_of_Operation_WizardOpium_Securelist.pdf

This technical analysis of Operation WizardOpium describes a watering-hole campaign that chained a Chrome WebAudio use-after-free vulnerability (CVE-2019-13720) with a Win32k elevation-of-privilege zero-day (CVE-2019-1458) to escape the browser sandbox and execute a Reflective PE loader which deployed malware. The report walks through exploitation primitives (heap grooming, PartitionAlloc metadata manipulation, arbitrary read/write), WASM/JIT RWX abuse to place shellcode, and kernel exploitation techniques (SetWindowLongPtr abuse, Bitmap abuse, token theft) used for privilege escalation and persistence.