Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Racing MIDI messages in Chrome

projectzero.google | blog | #linux | #use-after-free | #macos | #chrome | #midi | #chromeos

Summary

A guest post from Chrome Security describing a severe use-after-free in Chrome's browser process on Linux, Chrome OS and OS X, triggerable directly from the web without breaking the sandbox.
Published
Collected

original ↗

Related coverage

vulnerability · projectzero.google
From Chrome renderer code exec to kernel with MSG_OOB
Write-up of CVE-2025-38236, a Linux kernel bug reachable from a compromised Chrome renderer via MSG_OOB socket handling, escalating renderer code execution into kernel privileges.
blog · projectzero.google
Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages
Part one of a macOS audio series: building a fuzzer for CoreAudio by sending Mach messages, covering the attack surface, harness design, and early results.
blog · projectzero.google
Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst
A practical recipe for fuzzing macOS kernel extensions in userspace by combining IDA-assisted harnessing with TinyInst, lowering the cost of finding driver bugs.
blog · projectzero.google
MTE As Implemented, Part 3: The Kernel
Part 3 of the MTE As Implemented series, examining kernel-side support for Arm Memory Tagging Extension, its performance costs, and gaps observed in real implementations.
blog · projectzero.google
Exploiting null-dereferences in the Linux kernel
An examination of how null pointer dereferences in the Linux kernel can be turned into exploitable primitives under modern configurations, with examples and mitigations.
blog · projectzero.google
Escaping the Chrome Sandbox with RIDL
Guest blog post by Stephen Röttger
back