CVE-2025-43330: breaking out of a sandbox using font files
3 faxmeyourcode 3 9/17/2025, 3:08:47 PM bsssq.xyz ↗
Comments (3)
faxmeyourcode · 3h ago
I am not the author of this post. The exploration of the scheme based sandbox permissions DSL was interesting to me. It's a classic issue of a custom parser with bad input validation.
bsssq · 1h ago
thanks for sharing! yes, it's a textbook vulnerability that was really quite trivial to exploit.
faxmeyourcode · 52m ago
It was a fun read - digestible for those of us without a ton of experience in advanced security background knowledge.