Interesting to see a sandbox escape that doesn't involve a kernel exploit (unlike the attack against Chrome users that leveraged a Windows kernel vuln). I wonde

Interesting to see a sandbox escape that doesn't involve a kernel exploit (unlike the attack against Chrome users that leveraged a Windows kernel vuln). I wonder if seccomp has pushed things to the point where the boundary between broker and child is the softer spot. More evidence to that being that the attack on Chrome didn't work on Win10, which has a sort of similar mitigation. Perhaps in particular for Firefox, which has had the sandbox for less time? Would love to hear some expert opinions. I can't derive much from this since I don't personally see any trends.