Cybersecurity Research

Linux Kernel Bug Let Attackers Jump From Chrome Browser Straight to Full System Control

Project Zero · 8 Aug 2025

Key Takeaway Ensure your business devices and browsers are set to update automatically, since patches for deep technical flaws like this one are often rolled out quietly but are critical for closing real attack paths.

Google's Project Zero team discovered a security vulnerability (CVE-2025-38236) in the Linux kernel's handling of a little-used feature called MSG_OOB, which allows a single byte of 'out-of-band' data to be sent ahead of normal data over certain socket connections. Although Chrome itself does not use this feature, it was unintentionally accessible from within Chrome's renderer sandbox on Linux systems because the sandbox did not block the relevant function flags.

The flaw affects Linux kernel versions 6.9 and later and can be triggered fairly easily, leading to a use-after-free condition that researchers showed could be exploited to escalate from code execution inside a sandboxed Chrome process all the way to kernel-level compromise. The MSG_OOB feature is rarely used outside of some Oracle products, yet it was enabled by default in Linux configurations and, until December 2024, could not even be disabled.

The bug has since been reported and fixed in the Linux kernel, and Chrome has separately blocked MSG_OOB messages from being sent within its renderer sandbox to close off this attack path. This case highlights how obscure, rarely used system features can still create serious security exposure when combined with sandbox escape techniques.

Summarised by CISO AI from Project Zero, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.