CVE-2026-8571
Overview
Background
- Seatbelt profile
sandbox/policy/mac/gpu.sbis the macOS sandbox policy constraining what the Chrome GPU process may do.- `com.apple.lsd.modifydb`
- a Launch Services Mach service that can modify the per-user Launch Services database (e.g. default URL-scheme handlers).
Root Cause Analysis
The pre-fix GPU profile granted the GPU process mach-lookup access to (global-name "com.apple.lsd.modifydb") at sandbox/policy/mac/gpu.sb:28, among other Launch Services names in the same allow mach-lookup block (:15-40). It also granted broad (allow file-read* file-write* ...) over the Darwin user cache/home/temp directories at sandbox/policy/mac/gpu.sb:122-126. Together these let a GPU process both write files under user-writable directories — including extended attributes, because the wildcard file-write* subsumes file-write-xattr — and talk to the Launch Services modify-database service. The advisory records this as insufficient policy enforcement in GPU: capabilities broader than the GPU process requires.
The fix tightens the policy by deleting the com.apple.lsd.modifydb grant (diff removes line 28) and by narrowing the file-write grant from file-write* to the explicit tokens file-write-data file-write-create file-write-owner file-write-unlink, which drops file-write-xattr and file-write-mode. This is a pure restriction — it removes capabilities and adds none.
com.apple.lsd.modifydb Mach service and the wildcard file-write* (which includes xattr writes) — and the fix removes the service grant and replaces the wildcard with a minimal set of write tokens.Attack Path
- Compromise the GPU process An attacker first gains code execution inside the GPU process by some other means. (inferred — not shown in the material.)
- Write and de-quarantine a bundle
Using the pre-fix broad
file-write*grant on the user cache directory (gpu.sb:122-126), the process writes an app bundle and clears its quarantine attribute via an xattr write. (inferred — reporter’s claim.) - Register a URL handler
Using the
com.apple.lsd.modifydbgrant (gpu.sb:28), the process alters the Launch Services database to claim a URL scheme. (inferred — reporter’s claim.) - Trigger execution outside the sandbox A later navigation to that scheme launches the attacker’s handler outside the GPU sandbox. (inferred.)
Impact Assessment
Files Changed
sandbox/policy/mac/gpu.sb
Audit Directions
- Overbroad sandbox tokensAudit
.sbprofiles for wildcard grants likefile-write*and prefer explicit minimal tokens where xattr/mode writes are not required. - Legacy Mach-service grantsReview Mach
global-nameallowances (e.g. Launch Servicesmodifydb) for grants added years earlier that are no longer needed.
Patch
From 7082f06110390405f1ecd750a783101b40e8fbfa Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Tue, 17 Mar 2026 16:03:31 -0700
Subject: [PATCH] Tighten macOS GPU sandbox restrictions
These were added back in 2018 and don't seem to be necessary
anymore.
Changes suggested by mark <at> advert.com.au
Fixed: 491422244
Change-Id: Ie7c37352b0b9fbb324611eb247bae9b4ab4ad467
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7671372
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1600856}
---
diff --git a/sandbox/policy/mac/gpu.sb b/sandbox/policy/mac/gpu.sb
index 9d98e44..9269f4f2c 100644
--- a/sandbox/policy/mac/gpu.sb
+++ b/sandbox/policy/mac/gpu.sb
@@ -25,7 +25,6 @@
(global-name "com.apple.cvmsServ")
(global-name "com.apple.gpumemd.source")
(global-name "com.apple.lsd.mapdb")
- (global-name "com.apple.lsd.modifydb")
(global-name "com.apple.powerlog.plxpclogger.xpc")
(global-name "com.apple.PowerManagement.control")
(global-name "com.apple.SecurityServer")
@@ -119,7 +118,10 @@
)
; crbug.com/980134
-(allow file-read* file-write*
+; Restrict file-write to data/create/unlink only — the GPU process does not need
+; file-write-xattr or file-write-mode.
+; TODO(crbug.com/491422244): Remove file-write-owner needed by WebNN.
+(allow file-read* file-write-data file-write-create file-write-owner file-write-unlink
(subpath (param darwin-user-cache-dir))
(subpath (param darwin-user-dir))
(subpath (param darwin-user-temp-dir))
Original Bug Report
GPU sandbox escape on macOS via lsd.modifydb > RCE
Steps to reproduce the problem
Tested on 147.0.7704.0
patch -p1 < poc.diffgn gen out/Default --args='is_debug=false' && autoninja -C out/Default content_shellout/Default/Content\ Shell.app/Contents/MacOS/Content\ Shell "data:text/html,<h1>trigger</h1>"- Wait a few seconds for the GPU process to register the handler, then quit content_shell.
- Trigger mailto: from terminal, Chrome, or any app:
open "mailto:test@example.com" - Observe:
~/Desktop/gpu_escape_poc.txtis created and TextEdit opens. The file containsuname -aanduptimeoutput, proving code execution outside the GPU sandbox.
Problem Description
The GPU sandbox policy (sandbox/policy/mac/gpu.sb line 28) grants com.apple.lsd.modifydb Mach service access. This is GPU-only, not granted to renderer, audio, or utility sandboxes.
Combined with the GPU sandbox’s file-write permission to DARWIN_USER_CACHE_DIR (gpu.sb lines 122-126), a compromised GPU process can:
- Resolve
DARWIN_USER_CACHE_DIRviaconfstr(_CS_DARWIN_USER_CACHE_DIR) - Write a
.appbundle there (sandbox permits file-write) - Strip quarantine xattr via
removexattr()(permitted becausegpu.sbgrantsfile-write*to this directory, which includesfile-write-xattr) - Call
LSRegisterURLto register the app with Launch Services - Call
LSSetDefaultHandlerForURLSchemeto claimmailto:(andchickennuggets://) - When Chrome loads a page with
window.location = "mailto:...", Chrome dispatches to the OS, which launches the hijacked handler outside the sandbox
The PoC demonstrates this from inside HandleRasterCHROMIUM in gpu/command_buffer/service/raster_decoder.cc, reachable from a compromised renderer via GPU command buffer IPC. The payload writes a file to ~/Desktop/gpu_escape_poc.txt and opens TextEdit.
The mailto: hijack is particularly impactful: every website with a “contact us” or “email” link uses mailto:, and the hijack is system-wide (affects Chrome, Safari, Slack, and every other application). window.location = "mailto:..." fires automatically on page load with zero user interaction.
Additional Comments
- Content Shell does not dispatch external protocol navigations. In Chrome,
window.location = "mailto:..."will trigger the RCE. com.apple.lsd.modifydbwas added in f92299c (2019-04-24, bug 871280): “macOS V2 Sandbox: Allow lsd.modifydb in GPU v2 sandbox.” Present for ~7 years across all Chrome releases since Chrome 76.
Summary
GPU sandbox escape on macOS via lsd.modifydb > RCE
Custom Questions
Type of crash:
no crash, clean sandbox escape.
Crash state:
No crash reports available as we are working within the GPU sandbox policy (sandbox/policy/mac/gpu.sb line 28).
output of ~/Desktop/gpu_escape_poc.txt:
Darwin Macbook.local 25.3.0 Darwin Kernel Version 25.3.0: Wed Jan 28 20:53:31 PST 2026; root:xnu-12377.81.4~5/RELEASE_ARM64_T8122 x86_64
0:16 up 21 days, 3:17, 18 users, load averages: 1.99 1.71 1.81
Reporter credit:
Mark Blaszczyk
Additional Data
Category: Security
Chrome Channel: Stable
Regression: N/A \
- https://chromium.googlesource.com/chromium/src/+/f92299c
- https://issuetracker.google.com/issues/871280
- https://source.chromium.org/chromium/chromium/src/+/main:gpu/command_buffer/service/raster_decoder.cc;l=3036
- https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/gpu.sb;l=122
- https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/gpu.sb;l=28