A sandbox escape is an exploit that lets code break out of an isolated environment – such as a browser sandbox, virtual machine or container – and act on the host system with greater privileges.
How sandbox escapes work
A sandbox restricts what code can do: a browser’s renderer process cannot read files, a guest virtual machine cannot touch the host, an app on iOS or Android cannot access other apps’ data. A sandbox escape exploits a flaw in the boundary itself, for example:
- a bug in the browser’s privileged broker process, IPC interfaces or the operating system kernel reachable from the sandbox;
- a vulnerability in emulated hardware or the hypervisor (VM escape);
- a container runtime or kernel bug that lets a process in a container control the host (container escape).
Modern browser attacks therefore use exploit chains: one bug for code execution inside the renderer, a second for the escape, and often a third for privilege escalation in the kernel.
Why sandbox escapes matter
Sandboxes are one of the most important security layers, so escaping them is highly valuable. Full chains against Chrome, Safari or iOS appear in zero-day attacks by commercial spyware vendors and are among the most expensive prizes at hacking contests such as Pwn2Own. Notable examples include VENOM (2015), a flaw in QEMU’s virtual floppy controller that could allow escape from many virtual machines, and a 2019 vulnerability in runc that let malicious containers overwrite the host’s runc binary and gain root access. In cloud environments, VM and container escapes threaten the isolation between customers.
How to defend against sandbox escapes
- Update browsers, hypervisors, container runtimes and kernels promptly – escape bugs are frequently exploited as zero-days.
- Layer defences: run containers as non-root, use seccomp and AppArmor profiles, and separate sensitive workloads onto different hosts.
- Enable features such as site isolation and Lockdown Mode for high-risk users.
- Monitor hosts for unexpected processes spawned by sandboxed applications.
