Chrome Mojo Message Validation Bypass

During a Mojo IPC method call, there are multiple stages of validation and deserialization that take place. These assume that the contents of the message cannot be modified during the deserialization process, but the new core_ipcz implementation returns message contents directly in shared memory.

bypass call chrome deserialization implementation ipc memory message process validation