Escaping the Chrome Sandbox with RIDL

A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.

After discovering a collection of possible sandbox escape vulnerabilities in Chrome, it seemed worthwhile to exploit one of these issues as a full-chain exploit together with a renderer vulnerability to get a better understanding of the mechanics required for a modern Chrome exploit. Considering the available bugs, the most likely appeared to be issue 1755, a use-after-free with parallels to classic Javascript engine callback bugs. This is a good candidate because of the high level of control the attacker has both over the lifetime of the free’d object, and over the timing of the later use of the object.

A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.

Part two of a Google Project Zero pwn4fun series, detailing how a Safari compromise escalated from the renderer sandbox to full system access on OS X.

A Google Project Zero rundown of sandbox escape and privilege escalation bugs in Mac OS X and iOS fixed by Apple in OS X 10.9.5 and iOS 8.

A Google Project Zero publication of details on Mac OS X and iPhone sandbox escape bugs after Apple shipped fixes.