Internet Explorer EPM Sandbox Escape CVE-2014-6350

Summary: Project Zero's James Forshaw disclosed three Internet Explorer Enhanced Protected Mode sandbox escapes in August 2014, all fixed in Microsoft's MS14-065 update, with CVE-2014-6350 stemming from weak permissions on the IE broker process that granted the sandboxed tab Read Memory access. Forshaw showed that reading the broker's memory exposed a per-process HMAC key and the Free-Threaded Marshaler's 16-byte per-process secret, enabling forged tokens and potential code execution against DCOM hosts when paired with a memory disclosure bug.
Bottom line: The escape hinged on a single design gap: the AppContainer access check ignored the integrity level, so a Low-integrity tab process obtained PROCESS_VM_READ on a Medium-integrity broker. For anyone still reasoning about sandbox boundaries, this is a reminder that one readable process secret can turn a memory disclosure into full code execution.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-6350
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026