Breaking the Chain
Summary: Google Project Zero's James Forshaw developed a Win32k system call lockdown mitigation for Chrome on Windows, shipping by default in Chrome M54 on Windows 10 after roughly two years of architectural work including replacing GDI-based font code with DirectWrite. The mitigation ended up blocking the sandbox escape of an exploit chain being used in the wild, and required brokering HDCP-related Win32k calls so DRM-protected video and Widevine content would still play.
Bottom line: The Hacking Team breach in July 2015 exposed an unfixed Chrome exploit chaining a Flash RCE to a Win32k sandbox escape, and Project Zero notes 31 Win32k issues from a single research project alone - the attack surface a sandbox leaves open is where real exploit chains finish.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026