3 ms·

Yes, it can be exploited, just inside the sandbox. I'm pretty sure this is why the write-up is always so careful to say "read/write inside the Chrome sandbox."

by bri3d 3y ago

Yes, it can be exploited, just inside the sandbox. I'm pretty sure this is why the write-up is always so careful to say "read/write inside the Chrome sandbox." With the chain that's documented, you basically end up with full R/W/X control inside of the sandbox process, so what you can do is highly platform and version specific. For example, IIRC you used to be able to unmask Tor and many VPN and proxy users from inside of the sandbox using either JavaScript or native networking APIs. It's my recollection that this is less true on newer Windows versions, but I don't keep up with Chrome sandbox protection that well. Presumably Exodus also have a sandbox escape that didn't get burned so they didn't include it in the writeup.

throwitaway1123 3y ago
> Presumably Exodus also have a sandbox escape that didn't get burned so they didn't include it in the writeup. I certainly hope not. I know these zero day exploits tend to be used almost exclusively against high profile politicians and journalists, but the threat still tempts me to just disable the JIT altogether (and maybe WASM too).