Re:What a one line change did to the Chrome sandbox
by tiraniddo on Thursday April 23, 2020 @08:11AM
(#22955073)
Basically my PoC works exactly the same from Chrome GPU as FF Content Level 5 [1] there was no additional hardening. It was also easier to test as FF doesn't enable the Microsoft DLL signing mitigation should I could just do a direct CreateRemoteThread -> LoadLibrary without messing with KnownDlls.
[1] https://wiki.mozilla.org/Security/Sandbox