🛡️ Security

Sandbox Escape

A second-stage exploit that breaks out of a restricted process, such as a browser renderer, into the more privileged browser process or the operating system. In-the-wild browser attacks usually chain a JavaScript-engine bug with a sandbox escape, which is why a renderer-only bug is rated as scope unchanged in CVSS.

📚 Deep Dive

Learn Article

How V8 Type Confusion Bugs Turn JavaScript Into Memory Corruption

Why V8's optimizing compilers keep producing type confusion bugs, how one becomes addrof and fakeobj primitives, and where the renderer sandbox actually stops an attacker.

intermediate 6 min read

Back to Glossary