Escaping the Chrome Sandbox with RIDL
Summary: Project Zero guest author Stephen Röttger demonstrated that RIDL and other MDS hardware vulnerabilities can leak Mojo port names across process boundaries, letting a compromised Chrome renderer send messages to privileged IPC interfaces and read arbitrary local files or execute a .bat file outside the sandbox on Windows. The exploits targeted a Linux build on a Xeon Gold 6154 (MFBDS) and Windows on a Core i7-7600U (TAA), and at the time of writing Apple and Microsoft were working on a fix with the Chrome security team.
What's compelling: The attack still requires a renderer compromise first, but the mitigation is operational: unless microcode is current and hyper-threading is disabled or a group scheduler is used, a second thread on the same physical core can still leak data from internal CPU buffers.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026