3 ms·
Exploits have broken out of the sandbox before using OS-level security holes. The sandbox is not anywhere near 100% effective. If you feel safe using Flash in C
by scurvy 11y ago
Exploits have broken out of the sandbox before using OS-level security holes. The sandbox is not anywhere near 100% effective. If you feel safe using Flash in Chrome because of the sandbox, you might want to re-evaluate.
- georgerobinson 11y agoCan you expand as that? Did they break out via the service runtime, or through an implementation defect in the validator? I recall that Chris Rohlf presented an implementation defect in one of the two at a Black Hat conference some years back, but the sandboxing is otherwise solid.
- scurvy 11y agoThey don't go into detail, but Google confirms you can break out of the sandbox by coupling a Flash exploit with an OS exploit. http://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-teams-flash-zero-day/ http://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-te...