Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-38236] From Chrome renderer code exec to kernel with MSG_OOB

projectzero.google | vulnerability | CVE-2025-38236 | #linux | #privilege-escalation | #exploit | #kernel | #chrome | #cve-2025-38236 | #msg-oob

Summary

Write-up of CVE-2025-38236, a Linux kernel bug reachable from a compromised Chrome renderer via MSG_OOB socket handling, escalating renderer code execution into kernel privileges.
CVE
CVE-2025-38236
Published
Collected

original ↗

Related coverage

vulnerability · projectzero.google
Exploiting the Linux kernel via packet sockets
A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.
blog · projectzero.google
Exploiting Recursion in the Linux Kernel
A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.
blog · projectzero.google
MTE As Implemented, Part 3: The Kernel
Part 3 of the MTE As Implemented series, examining kernel-side support for Arm Memory Tagging Extension, its performance costs, and gaps observed in real implementations.
blog · projectzero.google
Exploiting null-dereferences in the Linux kernel
An examination of how null pointer dereferences in the Linux kernel can be turned into exploitable primitives under modern configurations, with examples and mitigations.
blog · projectzero.google
Taking a page from the kernel's book: A TLB issue in mremap()
This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.
blog · projectzero.google
Chrome OS exploit: one byte overflow and symlinks
A guest post detailing a Chrome OS exploit that combines a one-byte overflow with symlink tricks to escalate privileges, written by an external researcher.
back