PatchGap
Chrome · GPU

CVE-2026-8571

Logic Error in GPU
Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in GPU
DescriptionInsufficient policy enforcement in GPU
ComponentGPU
Bug ClassLogic Error
Tracker491422244
Fix commit7082f0611039 (chromium/src) +4/-2
CISA KEVNot listed
CreditedMark Blaszczyk
Disclosed2026-05-12

Files Changed

  • sandbox/policy/mac/gpu.sb

Patch

view commit
From 7082f06110390405f1ecd750a783101b40e8fbfa Mon Sep 17 00:00:00 2001
From: Dale Curtis <dalecurtis@chromium.org>
Date: Tue, 17 Mar 2026 16:03:31 -0700
Subject: [PATCH] Tighten macOS GPU sandbox restrictions

These were added back in 2018 and don't seem to be necessary
anymore.

Changes suggested by mark <at> advert.com.au

Fixed: 491422244
Change-Id: Ie7c37352b0b9fbb324611eb247bae9b4ab4ad467
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7671372
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1600856}
---

diff --git a/sandbox/policy/mac/gpu.sb b/sandbox/policy/mac/gpu.sb
index 9d98e44..9269f4f2c 100644
--- a/sandbox/policy/mac/gpu.sb
+++ b/sandbox/policy/mac/gpu.sb
@@ -25,7 +25,6 @@
   (global-name "com.apple.cvmsServ")
   (global-name "com.apple.gpumemd.source")
   (global-name "com.apple.lsd.mapdb")
-  (global-name "com.apple.lsd.modifydb")
   (global-name "com.apple.powerlog.plxpclogger.xpc")
   (global-name "com.apple.PowerManagement.control")
   (global-name "com.apple.SecurityServer")
@@ -119,7 +118,10 @@
 )
 
 ; crbug.com/980134
-(allow file-read* file-write*
+; Restrict file-write to data/create/unlink only — the GPU process does not need
+; file-write-xattr or file-write-mode.
+; TODO(crbug.com/491422244): Remove file-write-owner needed by WebNN.
+(allow file-read* file-write-data file-write-create file-write-owner file-write-unlink
   (subpath (param darwin-user-cache-dir))
   (subpath (param darwin-user-dir))
   (subpath (param darwin-user-temp-dir))
Loading diff…

Original Bug Report

reported by ma...@advert.com.au

GPU sandbox escape on macOS via lsd.modifydb > RCE

Steps to reproduce the problem

Tested on 147.0.7704.0

  1. patch -p1 < poc.diff
  2. gn gen out/Default --args='is_debug=false' && autoninja -C out/Default content_shell
  3. out/Default/Content\ Shell.app/Contents/MacOS/Content\ Shell "data:text/html,<h1>trigger</h1>"
  4. Wait a few seconds for the GPU process to register the handler, then quit content_shell.
  5. Trigger mailto: from terminal, Chrome, or any app: open "mailto:test@example.com"
  6. Observe: ~/Desktop/gpu_escape_poc.txt is created and TextEdit opens. The file contains uname -a and uptime output, proving code execution outside the GPU sandbox.

Problem Description

The GPU sandbox policy (sandbox/policy/mac/gpu.sb line 28) grants com.apple.lsd.modifydb Mach service access. This is GPU-only, not granted to renderer, audio, or utility sandboxes.

Combined with the GPU sandbox’s file-write permission to DARWIN_USER_CACHE_DIR (gpu.sb lines 122-126), a compromised GPU process can:

  1. Resolve DARWIN_USER_CACHE_DIR via confstr(_CS_DARWIN_USER_CACHE_DIR)
  2. Write a .app bundle there (sandbox permits file-write)
  3. Strip quarantine xattr via removexattr() (permitted because gpu.sb grants file-write* to this directory, which includes file-write-xattr)
  4. Call LSRegisterURL to register the app with Launch Services
  5. Call LSSetDefaultHandlerForURLScheme to claim mailto: (and chickennuggets://)
  6. When Chrome loads a page with window.location = "mailto:...", Chrome dispatches to the OS, which launches the hijacked handler outside the sandbox

The PoC demonstrates this from inside HandleRasterCHROMIUM in gpu/command_buffer/service/raster_decoder.cc, reachable from a compromised renderer via GPU command buffer IPC. The payload writes a file to ~/Desktop/gpu_escape_poc.txt and opens TextEdit.

The mailto: hijack is particularly impactful: every website with a “contact us” or “email” link uses mailto:, and the hijack is system-wide (affects Chrome, Safari, Slack, and every other application). window.location = "mailto:..." fires automatically on page load with zero user interaction.

Additional Comments

  • Content Shell does not dispatch external protocol navigations. In Chrome, window.location = "mailto:..." will trigger the RCE.
  • com.apple.lsd.modifydb was added in f92299c (2019-04-24, bug 871280): “macOS V2 Sandbox: Allow lsd.modifydb in GPU v2 sandbox.” Present for ~7 years across all Chrome releases since Chrome 76.

Summary

GPU sandbox escape on macOS via lsd.modifydb > RCE

Custom Questions

Type of crash:

no crash, clean sandbox escape.

Crash state:

No crash reports available as we are working within the GPU sandbox policy (sandbox/policy/mac/gpu.sb line 28). output of ~/Desktop/gpu_escape_poc.txt:

Darwin Macbook.local 25.3.0 Darwin Kernel Version 25.3.0: Wed Jan 28 20:53:31 PST 2026; root:xnu-12377.81.4~5/RELEASE_ARM64_T8122 x86_64
 0:16  up 21 days,  3:17, 18 users, load averages: 1.99 1.71 1.81

Reporter credit:

Mark Blaszczyk

Additional Data

Category: Security
Chrome Channel: Stable
Regression: N/A \

View on issue tracker
Links in the report
On This Page