> b. Can you launch attack on other local network resources from within the compromised sandbox – read insecure filesystems, make tcp sockets to local resources

> b. Can you launch attack on other local network resources from within the compromised sandbox – read insecure filesystems, make tcp sockets to local resources etc – these are not prevented by OS sandboxing capabilities that Chrome depends on. Huh? Chrome on Linux uses a network namespace to remove all networking from the renderer process, and then uses seccomp to forbid most system calls, and can very easily prevent e.g. opening new sockets with that. https://chromium.googlesource.com/chromiumos/docs/+/HEAD/sandboxing.md https://chromium.googlesource.com/chromiumos/docs/+/HEAD/san... https://blog.chromium.org/2012/11/a-safer-playground-for-your-linux-and.html https://blog.chromium.org/2012/11/a-safer-playground-for-you... https://blog.cr0.org/2012/09/introducing-chromes-next-generation.html https://blog.cr0.org/2012/09/introducing-chromes-next-genera...