LTMEAT [Flood]
Ashton Davies

GitHub Discussion

An alternative method of the LTMEAT exploit based on Alternate Method #1 that hangs and refreshes admin-installed extensions naturally without debug URLs. This version of the LTMEAT exploit is also known as the LTVegan exploit.

Folder Setup

Methods

Generate & Import Folder (Automated, Recommended)

Background Page URL:
chrome-extension:/// _generated_background_page.html manifest.json

Detecting extensions...

Generate Folder


Setup Folder (Manual)
Navigate to chrome://bookmarks.
Add a new folder to your bookmarks bar.
In the folder, add the extension settings URL of the extension you want to freeze and disable.
chrome://extensions/?id=[extensionid]
Paste a page of the extension into the folder such as the generated background or manifest page many times. There must be enough to make browser loading very slow but not crash it entirely.

Performing the Exploit

Instructions

1. Close or disable any extra tabs, windows, or extensions to free resources during this process, for the proper result of the exploit.
2. Open the folder that you created in a brand new window. This can be done from its context menu.
3. When tabs begin to respond, close the new window.
4. Open the folder in a brand new window again. This should be done quickly after the window has been closed. The pages should hang automatically, similar to duplicating the tabs from hanged ones in the original methods of the LTMEAT exploit.
5. Toggle and flip the Allow access to file URLs switch in the extension settings page to refresh the extension. If the switch is not available for your extension or the extension does not control web traffic, you may be able to skip this step of the exploit.
6. Close the new window.

If the effect does not persist, there may not be enough pages to open from the folder in your bookmarks bar.

This method of the LTMEAT exploit may not work permanently for some filtering extensions, depending on how they are built to run in Chrome.

Extensions with Manifest V3 are not compatible with any version of the LTMEAT exploit.