PatchGap · Weakness Pattern
Sandbox or temp directory shared and predictably named
WP-SANDBOX-TMP
LogicError
5 CVEs
5 mapped
CWE-377CWE-379
2026-09 → 2026-09
A sandboxed or elevated process is confined to (or stages files in) a per-user directory that is shared with, predictable to, or writable by other same-user processes, opening a race, squatting, or search-path surface. A lower-privileged local actor can pre-create, replace, or contend for files the higher-privileged process trusts.
Invariant
Each sandboxed or elevated process must use an exclusively-created, symlink-resolved, per-process directory that no other same-user process can predict, write, or race against.
Mechanism
Members share the shape of relying on shared or predictable per-user Darwin directories or user-writable temp locations: staging and relaunching an elevated executable from a user-writable temp dir, placing an attacker-controllable directory on the elevated process’s search path (CVE-2026-87530); granting sandboxed children broad access to shared Darwin user directories, exposing a race/squatting surface (CVE-2026-91712, CVE-2026-91743); using non-canonical /var paths that resolve into shared space (CVE-2026-91727); and creating working directories with non-exclusive adopt-if-present semantics on predictable, same-user-writable paths (CVE-2026-91748). The common thread is shared, guessable storage that a lower-privileged actor can influence.
Fix shape
Confine each process to its own exclusively-created, symlink-resolved, per-process subdirectory keyed by an unpredictable identifier, and never stage elevated executables from a user-writable location.
CVEs in this pattern
3 components · Extensions, CredentialProvider, Core| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-87530 | LogicError in CredentialProvider | CredentialProvider | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-91712 | Race in Extensions | Extensions | chrome | High | 2026-09 | 🔧 |
| CVE-2026-91727 | LogicError in Extensions | Extensions | chrome | High | 2026-09 | 🔧 |
| CVE-2026-91743 | Race in Core | Core | chrome | High | 2026-09 | 🔧 |
| CVE-2026-91748 | Race in Extensions | Extensions | chrome | High | 2026-09 | 🔧 |
Hunt for siblings
Scanners should flag temp/working-directory creation that uses predictable names, shared per-user paths, or adopt-if-present semantics, and any elevated relaunch whose search path includes a user-writable directory.
Mitigations that would catch this class
- Create per-process directories with exclusive (fail-if-exists) semantics and unpredictable names, never adopt-if-present on a shared path.
- Canonicalize and resolve symlinks before confining a sandboxed child, and scope it to its own subtree rather than a shared per-user directory.
- Stage and launch elevated executables only from directories writable solely by the elevated principal, keeping user-writable dirs off the search path.