---
id: 8646
title: "FF Sandbox Escape (CVE-2020-12388)"
cve: CVE-2020-12388
source_domain: projectzero.google
source_url: "https://projectzero.google/2020/06/ff-sandbox-escape-cve-2020-12388.html"
published_at: "2020-06-17T00:00:00Z"
tags: ["rce", "firefox", "sandbox-escape", "windows", "cve", "project-zero"]
phying_url: "https://phying.com/item/8646"
lang: en
---

# FF Sandbox Escape (CVE-2020-12388)

## Summary

By James Forshaw, Project Zero In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.

## Intelligence Metadata

- **Sources:** projectzero.google
- **CVE:** CVE-2020-12388
- **Published:** 2020-06-17T00:00:00Z
- **Original:** https://projectzero.google/2020/06/ff-sandbox-escape-cve-2020-12388.html
- **Phying News:** https://phying.com/item/8646