Get the latest tech news
A privilege escalation from Chrome extensions (2023)
What's the worst thing a Chrome extension could do to you?
A good example of a sandbox escape is this bug reported by David Erceg, where insufficiently validated functions in chrome.debugger were abused to run code on chrome://downloads and open an exe on Windows. I think this type of bug is really interesting because it shows that vulnerabilities don't always come from simple mistakes; sometimes, decade-long design choices in massive and complex projects like Chrome/ChromeOS can be exploited in creative ways. It's pure chance that I managed to find this bug--the main part of which had been lying undetected for years--only a month or so after the introduction of new code that made it even more critical.
Or read this on Hacker News
