Did the “Man With No Name” Feel Insecure?

Summary: Project Zero's James Forshaw documented CVE-2014-3196, a Chrome for Windows bug fixed in M38 where unnamed shared memory sections carry no security descriptor, letting a compromised renderer call DuplicateHandle to regain write access to a section shared read-only. Chrome used that read-only sharing for extension scripts between renderers, so a compromised renderer could modify the shared memory and execute arbitrary JavaScript in any rendered page, including more-privileged chrome:// pages.
What's compelling: The flaw was not a full sandbox escape but the first link in a chain, and Forshaw notes it may matter more once site isolation is enabled by default in Chrome - the OS primitive your sandbox depends on can be the thing that fails.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-3196
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026