RC RANDOM CHAOS

sandbox-escape

5 posts

qBittorrent escaped its sandbox and owned the host
Article

qBittorrent escaped its sandbox and owned the host

A sandbox controls what code can do, not what code is. When qBittorrent escaped confinement, provenance was the control that was never applied.

 Chromium executes attacker code across every version
Article

Chromium executes attacker code across every version

A zero-day sandbox RCE hits all Chromium versions under active exploitation, with no confirmed fixed build and a single containment control shown ineffective.

 The sand was never boxed
Article

The sand was never boxed

A sandbox is a set of filters on named dimensions, not a boundary of execution. It matches references and never revalidates the capability they compose.

 The sandbox was never the hard part
Article

The sandbox was never the hard part

CVE-2026-40369 is a 12-byte Mojo IPC overflow in Chromium that converts renderer RCE into browser-process code execution on the host.

 Twelve bytes walked out of the sandbox
Article

Twelve bytes walked out of the sandbox

CVE-2026-40369 reduced a browser sandbox escape to twelve bytes. Analysis of what failed, why it failed, and what must change at the architecture layer.