Security Group Claims to Have Subverted Google Chrome’s Sandbox
Summary: VUPEN Security, a French research firm, announced it had defeated Google Chrome's sandbox on Chrome v.11.0.696.65 running Windows 7 SP1 (x64), using two chained vulnerabilities: one to bypass ASLR/DEP and run a payload inside the sandbox, and a second to escape the sandbox and execute code at Medium integrity. VUPEN said it would not share details with Google, only with government customers, and Google spokesman Jay Nancarrow said the company could not verify the claim because no information had been provided.
What you should know: A working Chrome sandbox escape reportedly took two vulnerabilities rather than one, and the firm that found it says it will sell the details only to government buyers while acknowledging no mitigation exists for everyone else.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026