Linux Core Flaw Bypasses Chrome Sandbox Security

Security researchers from Google recently uncovered a Linux vulnerability (CVE-2025-38236) that allows for escalating privileges within the system. This vulnerability enables attackers to bypass the Sandbox isolation mechanism utilized in Google Chrome, potentially reaching the kernel level code while running code within the Chrome rendering process, such as in the case of another Chrome vulnerability being exploited.

The issue affects Linux kernel versions from 6.9 onwards and has been resolved in the updates to Linux versions 6.1.143, 6.6.96, 6.12.36, and 6.15.5. A detailed proof-of-concept example is available for demonstration purposes. The inclusion of the MSG_OOB (“out-of-band”) flag allowed an extra byte to be appended to transmitted data, readable by the recipient before the rest of the data is received.

An initiative was proposed last year to classify MSG_OOB as outdated and not widely used, as it is only utilized in Oracle products. In the context of the Chrome Sandbox exploit, UNIX system calls such as Send() and Recv() were exploited due to the lack of separate filtration of the MSG_OOB flag along with other options.

The MSG_OOB error led to a use-after-free vulnerability, allowing attackers to access memory after its release by executing a specific sequence of system calls. Google has since addressed this issue to prevent further exploitation of the vulnerability.