In-Console-Able
Summary: Project Zero's James Forshaw described an unfixed Windows 8.1 bug in which the condrv.sys console driver calls ZwCreateUserProcess with the PROCESS_BREAKAWAY_JOB flag, letting a process escape a restrictive job object such as the one Chrome uses to limit renderers to a single process. Because the driver dispatches the call as if from kernel mode, file security checks and the SeTcbPrivilege check are bypassed, and Microsoft declined to fix the issue.
Key Takeaway: Chrome's renderer job object is meant to block child process creation in the kernel, and this bug lets a renderer break out of it - a building block in a sandbox escape chain that the OS vendor chose to leave in place.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026