Escaping the Chrome Sandbox Through DevTools

This blog post discusses the discovery of two vulnerabilities, CVE-2024-6778 and CVE-2024-5836, in the Chromium web browser that allow a malicious Chrome extension to escape the browser's sandbox and execute shell commands on a user's PC. The author received a $20,000 reward from Google for reporting these vulnerabilities. The Chromium sandbox is designed to isolate untrusted code, limiting its access to the system. However, the author identified a flaw in the WebUI mechanism, specifically in the chrome://policy/test page, which was intended for testing enterprise policies. By exploiting an undocumented feature, the author was able to set arbitrary user policies without proper validation, effectively bypassing the sandbox. This vulnerability could allow an attacker to execute commands that could lead to full control over the operating system, rather than just stealing sensitive information. The author explains the technical details of how the exploit works, including the role of private APIs and the lack of necessary checks in the code. The findings highlight significant security risks associated with the Chrome browser's handling of enterprise policies and the potential for malicious extensions to exploit these weaknesses.

- Two critical vulnerabilities in Chromium allow sandbox escape via malicious extensions.

- The author received a $20,000 reward from Google for reporting the vulnerabilities.

- The exploit involves bypassing validation on the chrome://policy/test page.

- Attackers could execute arbitrary commands, compromising the entire operating system.

- The findings emphasize the need for improved security measures in Chromium's policy handling.