All four major browsers take a stomping at Pwn2Own hacking competition

The annual Pwn2Own hacking competition wrapped up its 2015 event in Vancouver with another banner year, paying $442,000 for 21 critical bugs in all four major browsers, as well as Windows, Adobe Flash, and Adobe Reader.

The crowning achievement came Thursday as contestant Jung Hoon Lee, aka lokihardt, demonstrated an exploit that felled both the stable and beta versions of Chrome, the Google-developed browser that's famously hard to compromise. His hack started with a buffer overflow race condition in Chrome. To allow that attack to break past anti-exploit mechanisms such as the sandbox and address space layout randomization, it also targeted an information leak and a race condition in two Windows kernel drivers, an impressive feat that allowed the exploit to achieve full System access.

"With all of this, lokihardt managed to get the single biggest payout of the competition, not to mention the single biggest payout in Pwn2Own history: $75,000 USD for the Chrome bug, an extra $25,000 for the privilege escalation to SYSTEM, and another $10,000 from Google for hitting the beta version for a grand total of $110,000," Pwn2Own organizers wrote in a blog post published Thursday. "To put it another way, lokihardt earned roughly $916 a second for his two-minute demonstration."

Lee also hacked the 64-bit Internet Explorer 11 with a time-of-check to time-of-use exploit that achieved read/write privileges. To bypass Windows defenses, he unleashed a sandbox escape through privileged JavaScript injection. The hack earned him $65,000. Lee also took down Apple's Safari browser with a use-after-free exploit and a separate sandbox escape. That hack earned him $50,000 and brought his total winnings to $225,000. The contest ran Wednesday and Thursday concurrently with the CanSecWest security conference. Pwn2Own organizers have highlights from day one here.

In all, this year's Pwn2Own unearthed five bugs in Windows, four bugs in IE 11, three bugs in Mozilla Firefox, three bugs in Reader, three bugs in Flash, two bugs in Safari, and one bug in Chrome. To qualify, winning bugs must be previously unknown and have the ability to break through anti-exploit defenses.