Chrome, Brave, Opera, Vivaldi, Blisk and even Microsoft Edge are at risk of security. Because of Windows 10. It sounds incredible, but it is: a single line of code contained in the operating system renders the sandboxes used by Chromium-based browsers useless.
Researcher James Forshaw of Project Zero, the Google team that searches for security-related bugs in apps and operating systems. Forshaw was able to carry out several tests, with different methods, at the end of which he always managed to make the sandbox useless where Chromium-based browsers. This means that if a hacker learns of this bug (which Google will keep secret until Microsoft releases the security patch) they could execute malicious code via a website open in the browser. This bug, at the moment, does not have a patch yet.
How the sandbox works
A sandbox is basically a container where an application runs or a site opens that executes code to interact with the user. Inside this container, which has no openings to the outside, even a dangerous site or app is neutralized because, not being able to access external and additional resources in addition to those assigned to the sandbox itself, in fact they cannot take the control of anything. Most software that uses sandboxes, including Chromium-based browsers, do nothing more than rely on sandboxing methods provided by the operating system. If the OS sandbox has a hole, then the browser has a hole as well. And that's exactly what James Forshaw found out about Windows 10.
Because the sandbox doesn't work on Windows 10
Forshaw found that a single change to a single line of code introduced inWindows 10 latest update has changed the way they come managed sandbox tokens. Tokens, in essence, are the security keys that are assigned to the browser to ensure that the application can only access certain assigned resources. The problem lies precisely in these restricted tokens which, managed in the new way, actually allow an application to get out of the sandbox. Microsoft has been warned of this problem, but hasn't released a patch yet nor has it issued an official statement on how to behave in the meantime.
Windows 10 puts the security of Chrome and other browsers at risk
