# Sandbox escape via privileged proxy

Sandboxed input reaching a privileged proxy that trusts URLs, messages, or class names without revalidation

_Area: Memory corruption and native code. Seen in 6 disclosed reports; 5 confirmed bounties, median $3,000, range $750-$36,000; latest 2025-10-18. Updated 2026-10-23._

## How it works
A sandboxed component (web page, extension, Blu-ray Java app) is meant to be contained. A privileged component in the same process or host — a DevTools frontend, an invocation proxy, an embedded browser — accepts input from the sandboxed side and acts on it without re-checking it. The assumption that breaks: "anything reaching this privileged path already passed the sandbox." It did not. The sandboxed side controls the URL, message, or object it hands over, so the privileged side becomes a bridge to native code. The clearest escape cases are [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-attacking-the-devtools.md)[E2](https://bugbountylibrary.com/r/h1%3A3104356.md).

## Where it shows up
- Privileged pages/frames loading URLs from attacker input (javascript:, redirects) [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-attacking-the-devtools.md)
- Channel messages from extension DevTools pages overwriting the stored extension origin used to build panel iframe URLs [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-attacking-the-devtools.md)
- Proxy/invocation layers validating only by class name or stack presence [E2](https://bugbountylibrary.com/r/h1%3A3104356.md)
- Embedded Chrome launched with `--remote-debugging-port` instead of `--remote-debugging-pipe` [E3](https://bugbountylibrary.com/r/h1%3A1274695.md)
- Old bundled Chromium/CEF with the sandbox disabled [E4](https://bugbountylibrary.com/r/h1%3A1974296.md)
- Electron `webPreferences` missing `sandbox: true`; new-window handlers [E5](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md)
- Sandbox/permission APIs that load native code (engines, FFI, dlopen) outside the addon loader [E6](https://bugbountylibrary.com/r/h1%3A2091137.md)

## How to review
Enumerate every path from sandboxed input to a privileged action. The invariant: the privileged side must independently validate the URL scheme, message origin, or object type — never rely on the caller's sandbox. Check that the set of things able to satisfy a trusted interface is closed: if a fix checks one class, list every class matching the same registration contract [E2](https://bugbountylibrary.com/r/h1%3A3104356.md). For embedded browsers, confirm the debug channel is a pipe, the sandbox is on, and the version is current [E3](https://bugbountylibrary.com/r/h1%3A1274695.md)[E4](https://bugbountylibrary.com/r/h1%3A1974296.md)[E5](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md). For permission models, enumerate every API that loads native code, not just the obvious addon loader [E6](https://bugbountylibrary.com/r/h1%3A2091137.md).

## Variants seen
- URL-scheme trust in DevTools/extension pages [E1](https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-attacking-the-devtools.md)
- Proxy call-stack check bypassed by an alternate registered class [E2](https://bugbountylibrary.com/r/h1%3A3104356.md)
- Debug port reachable from page JS [E3](https://bugbountylibrary.com/r/h1%3A1274695.md)
- Stale embedded engine plus disabled sandbox [E4](https://bugbountylibrary.com/r/h1%3A1974296.md)
- Embed XSS plus new-window sandbox escape [E5](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md)
- Permission model missing a native-code loader [E6](https://bugbountylibrary.com/r/h1%3A2091137.md)

## Impact and severity
Led to sandbox escape and native code execution, sometimes root or full RCE [E2](https://bugbountylibrary.com/r/h1%3A3104356.md)[E3](https://bugbountylibrary.com/r/h1%3A1274695.md)[E4](https://bugbountylibrary.com/r/h1%3A1974296.md)[E5](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md). Severity rises when the privileged side runs with elevated rights (passwordless sudo, writable startup files) [E4](https://bugbountylibrary.com/r/h1%3A1974296.md) or when the escape is one click from a link [E4](https://bugbountylibrary.com/r/h1%3A1974296.md)[E5](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-attacking-the-devtools.md
- E2: https://bugbountylibrary.com/r/h1%3A3104356.md
- E3: https://bugbountylibrary.com/r/h1%3A1274695.md
- E4: https://bugbountylibrary.com/r/h1%3A1974296.md
- E5: https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-discord-rce.md
- E6: https://bugbountylibrary.com/r/h1%3A2091137.md