4 ms·

Seems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#The-integri

Seems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...

r_lee 1mo ago
great link, thanks
Genwald 1mo ago
V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear. https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...
- insanitybit 1mo ago
  I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.