CVE-2026-39808

🚨 Évasion de la sandbox root de FortiSandbox - CVE-2026-39808 🎯 Aperçu Ce dépôt contient une preuve de concept PoC propre et bien documentée pour CVE-2026-39808 — une vulnérabilité critique d'injection de commandes non authentifiée dans Fortinet FortiSandbox qui permet l'évasion de la sandbox et...

CVE-2023-21674

Premier 0-day in-the-wild de 2023 🔥 CVE-2023-21674 est une vulnérabilité dans l'appel de procédure locale avancée ALPC de Windows qui pourrait entraîner une évasion du sandbox du navigateur et permettre aux attaquants d'obtenir les privilèges SYSTEM, découverte par Avast root@kitploit: kd !analyz...

iOS18.6.2-Persistent-Automation-Exploit-in-Siri-Shortcuts-and-Apple-SWC

Validation d’entrée inappropriée dans les raccourcis Siri et Shared Web Credentials Découvert par : Joseph Goydish II Date de découverte : 20 août 2025 Sévérité : Élevée Résumé exécutif Ce rapport décrit une chaîne de vulnérabilités de sévérité élevée affectant les raccourcis Siri d’Apple et le...

CVE-2026-11114-Node.js-vm-Sandbox-Escape-via-Proxy

CVE-2026-11114 – Évasion de sandbox Node.js vm via Proxy Code du programme Node.js root@kitploit: // sandboxserver.js - Vulnerable VM sandbox const vm = require'vm'; const express = require'express'; const app = express; app.useexpress.json; app.post'/eval', req, res = const code = req.body.code;...

CVE-2026-85050

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85048

A flaw was found in the Compositing component of Chromium. A remote attacker, who has already compromised the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could lead to arbitrary code execution outside of the sandbox, allowing the attacker...

CVE-2023-28229

CVE-2023-28229 Windows CNG KeyIso RPC EoP/SBX Découvert par: @k0shl Référence: https://whereisk0shl.top/post/isolate-me-from-sandbox-explore-elevation-of-privilege-of-cng-key-isolation Si la compilation échoue, renommez rpc.h en autre chose car je n'avais pas réalisé que rpc.h est un include...

TimeAfterFree

TimeAfterFree إثبات مفهوم PoC للهروب من صندوق الحماية sandbox في PHP 8 يوضح تجاوز disablefunctions على أنظمة تشبه يونكس. يستغل هذا الاستغلال ثغرة استخدام بعد التحرير use-after-free لتجاوز disablefunctions وتنفيذ أوامر النظام. تستخدم تقنيات الاستغلال المستخدمة لتسريب مؤشرات الكومة والحصول على...

CVE-2019-0808

CVE-2019-5786 и CVE-2019-0808 эксплойт-цепочка для Chrome 72.0.3626.119 stable на Windows 7 x86. Этот эксплойт использует изоляцию сайтов для брутфорса CVE-2019-5786. host1wrapper/iframe.html — это скрипт-обёртка, который многократно загружает эксплойт в iframe. Сама цепочка находится в каталоге...

bl_sbx

blsbx itunesstored & bookassetd Évasion de la sandbox Ce dépôt contient une preuve de concept montrant comment des bases de données downloads.28.sqlitedb et BLDatabaseManager.sqlite malveillantes peuvent échapper à la sandbox d'itunesstored et bookassetd sur iOS. En abusant de leurs mécanismes de...

CVE-2024-54152

⚙️🔨 EN COURS CVE-2024-54152 POC Angular Expressions fournit des expressions pour le framework web Angular.JS en tant que module autonome. Avant la version 1.4.3, un attaquant peut écrire une expression malveillante qui s'échappe du bac à sable pour exécuter du code arbitraire sur le système. Avec...

CVE-2026-85047

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85047

Improper input validation in the Transactions Platform component of Google Chrome on iOS (versions prior to 152.0.7977.82 ) allows a remote attacker to potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. User interaction is required for exploitation. The CNA ...

EUVD-2026-70712

Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-85048

A use-after-free vulnerability in the Compositing component of Google Chrome prior to 152.0.7977.82 allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The Chromium team rates this High severity. The CVSS...

EUVD-2026-70707

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85050

CVE-2026-85050 is an out-of-bounds write in the WebGL component of Google Chrome on Android , affecting versions prior to 152.0.7977.82 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , yielding a CVSS 3.1 score of 9.6 (CRITICAL) with scope...

CVE-2026-85048

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70705

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85052

CVE-2026-85052 is an out-of-bounds read in the CrashReporting component of Google Chrome prior to 152.0.7977.82 . A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read memory outside the browser's security sandbox, resulting in information dis...