FF Sandbox Escape (CVE-2020-12388)

Summary: Project Zero's James Forshaw documented a Firefox sandbox escape (CVE-2020-12388) in which one Level 5 content process could open another for full access, because the sandbox's Default DACL granted full access to the Current User, SYSTEM, and RESTRICTED SIDs. The exploit relied on a window at process startup when a privileged impersonation token (USER_RESTRICTED_SAME_ACCESS) is active before LowerToken is called, and Firefox spawns new content processes regularly, including on new tabs. The fix, a per-process random SID added as a restricted SID and to a locked-down Default DACL, shipped in Firefox 76 and Chromium M83.
Bottom line: The mitigation is opt-in: if Chrome or other Chromium-based software such as Electron is unpatched, a compromised Firefox content process can kill Chrome's GPU process and hijack the replacement to escape. Niklas Baumstark had reported the same cross-process access a year earlier, and the suggested fix stalled then because it broke DirectWrite caching, audio playback, and performance.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-12388
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026