> In Fuschia's case it will be like that but the exploitation either gives you access to that driver's capabilities, or simply that driver is giving out handles

> In Fuschia's case it will be like that but the exploitation either gives you access to that driver's capabilities, or simply that driver is giving out handles with permissions insufficiently removed from them Yes, and then you would have to own a component in some route that received the driver exposed capability. Either way, the tight sandoxing and compartmentalization of functionality make things difficult. There's an example of analysis here: https://blog.quarkslab.com/playing-around-with-the-fuchsia-operating-system.html https://blog.quarkslab.com/playing-around-with-the-fuchsia-o...