Non-mobile link: https://googleprojectzero.blogspot.com/2020/06/ff-sandbox-es...
FF Sandbox Escape
11–20 of 26 posts
Re: FF Sandbox Escape
#12It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?
Re: FF Sandbox Escape
#13It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?
I guess it depends on how you define "exploit." I'd personally consider bypassing the sandbox an exploit, even though it's not a full chain.
Re: FF Sandbox Escape
#14"Sandbox Escape" sounded like something fun but alas
Re: FF Sandbox Escape
#15Meh...escape must mean something different at Google
Re: FF Sandbox Escape
#16It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?
In the end the sandbox is there to provide some limited security even in presence of other vulnerabilities.
So I would say it's a security critical bug a sandbox escape and a building blog for an exploit but not a exploit by itself.
Anyway it's sill a security vulnerability.
Re: FF Sandbox Escape
#17Meh...escape must mean something different at Google
What do you mean?
Re: FF Sandbox Escape
#18It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?
All the big browser attacks require exploit chains, and this is a component for creating an exploit chain. The best exploit chains can go all the way from a web page's JS to complete root access (this was achieved on Chromebooks at one point in the last couple years, using webassembly as one of the hops in the chain)
Re: FF Sandbox Escape
#19Off topic, does Firefox depend on Chromium code?
> As I’m a Chromium committer as well as an owner of the Windows sandbox I realized I might be better placed to fix this than Mozilla who relied on our code.
Re: FF Sandbox Escape
#20Off topic, does Firefox depend on Chromium code? > As I’m a Chromium committer as well as an owner of the Windows sandbox I realized I might be better placed to fix this than Mozilla who relied on our code.
I know they use the v8 regex engine: https://hacks.mozilla.org/2020/06/a-new-regexp-engine-in-spi...