Linux Kernel Flaw Let Attackers Escape Chrome's Security Sandbox

Google's Project Zero has detailed a serious Linux kernel vulnerability (CVE-2025-38236) discovered while reviewing a new kernel feature called MSG_OOB, which allows a single byte of priority data to be sent ahead of normal data over certain UNIX domain sockets. The researcher found the feature contained a security flaw affecting Linux kernel versions 6.9 and later, which was reported and has since been fixed.

What makes this notable is that although Chrome itself does not use MSG_OOB, the feature was still accessible from within Chrome's renderer sandbox on Linux systems because the sandbox did not block certain socket options. This meant that an attacker who already had code execution inside Chrome's restricted renderer process could potentially use this obscure kernel feature as a stepping stone to escape the sandbox and gain deeper system access. Chrome has since blocked the use of MSG_OOB messages within its renderer processes to close off this path.

The research highlights how obscure, rarely used kernel features (in this case, a networking capability used almost nowhere outside of some Oracle products) can still pose real security risks simply because they are enabled by default. The underlying kernel flaw has been patched, and browser vendors and system administrators are expected to apply relevant updates.