Virtually Unlimited Memory: Escaping the Chrome Sandbox

Summary: Google Project Zero's Mark Brand documented a full Chrome exploit chain that combined a renderer bug, CVE-2019-5782 in the v8 typer, with a use-after-free in the FileWriter interface of the FileSystem API to escape the Chrome sandbox on 64-bit Windows Chrome 71.0.3578.98. The escape relied on enabling Mojo IPC bindings from JavaScript, then abusing a base::Unretained reference in FileWriterImpl::Write that could be freed while an asynchronous GetInternalUUID call was still pending.
Bottom line: The chain worked because a privileged browser-process object was held by an unchecked reference that the renderer could outlive, so a single renderer compromise plus a lifetime bug was enough to reach brokered file writes outside the sandbox.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5782
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026