You Won't Believe what this One Line Change Did to the Chrome Sandbox

Summary: Project Zero's James Forshaw found that a one-line change in Windows 10 1903's SepFilterToken kernel function, which copied the Parent Token ID directly from the old token instead of assigning a new one, broke the sibling-token check that Chromium's Restricted Token sandbox relied on. He used the flaw to build a chain escaping the GPU process sandbox on Chrome/Edge and the default content sandbox in Firefox, and Microsoft fixed it in April 2020 as CVE-2020-0981.
What you should know: The sandbox's core guarantee rested on Windows kernel behavior the Chromium team does not control, and a single altered line silently invalidated it across Chrome, Edge and Firefox - a reminder that your browser isolation inherits the security of the OS beneath it.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-0981
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026