I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.

▲

ranger_danger 6 hours ago | parent [-]

Seems to use OS-specific kernel syscall filtering facilities.

Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d...

Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...

▲

Genwald 6 hours ago | parent | next [-]

V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear.

https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...

	▲	insanitybit 5 hours ago \| parent [-]
		I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.

▲

r_lee 6 hours ago | parent | prev [-]

great link, thanks