Record $250K Bug Bounty Awarded for Discovering Critical Chrome RCE Flaw

Google has awarded a record-breaking $250,000 bug bounty to security researcher Micky for discovering a critical remote code execution vulnerability in Google Chrome that could allow attackers to escape the browser’s sandbox protection.

The flaw, tracked internally as issue 412578726, represents one of the most severe Chrome vulnerabilities discovered in recent years and highlights the ongoing security challenges facing modern web browsers.

Critical Sandbox Escape Vulnerability

The vulnerability stems from a flaw in Chrome’s ipcz (Inter-Process Communication Zone) system, specifically within the Transport::Deserialize function.

The bug allows a malicious renderer process to duplicate privileged browser process handles, effectively breaking out of Chrome’s carefully designed sandbox security model.

This sandbox is a crucial security feature that isolates web content from the underlying operating system, preventing malicious websites from accessing sensitive system resources.

According to the technical details provided by the researcher, the vulnerability occurs when the Transport::Deserialize function creates transport objects using header.destination_type without proper validation.

A malicious renderer can exploit this by passing “kbroker” as the header.destination_type when sending requests to the browser process.

This manipulation tricks the browser into treating the renderer as a privileged broker process, granting it unauthorized access to duplicate sensitive browser process handles.

The exploitation process involves several sophisticated steps that demonstrate the complexity of modern browser security research.

First, the renderer process sends a RequestIntroduction to the broker using its own node name, obtaining two transport channels.

The attacker then sends a ReferNonBroker request with modified header information, followed by connect and RelayMessage requests designed to extract privileged handle values from the browser process.

The researcher discovered that by sending multiple RelayMessage requests with handle values ranging from 4 to 1000, an attacker could retrieve all corresponding handles from the browser process.

Once obtained, these privileged handles, particularly thread handles, provide the pathway for complete sandbox escape, potentially allowing arbitrary code execution with elevated privileges on the victim’s system.

This vulnerability bears similarities to CVE-2025-2783, which was reported earlier by researchers from Kaspersky, but demonstrates significantly higher complexity in its exploitation methodology.

The bug was introduced through a previous code change and affects multiple Chrome build configurations, though some debugging builds include additional protections that would alert developers to the suspicious handle duplication attempts.

The $250,000 bounty amount reflects both the severity of the flaw and Google’s commitment to incentivizing security research.

This payout likely represents one of the highest individual bug bounty rewards in Chrome’s history, underscoring the critical nature of sandbox escape vulnerabilities.

The discovery and responsible disclosure of such flaws through bug bounty programs remain essential components of maintaining browser security in an increasingly complex threat landscape.

Google has marked the issue as fixed, though specific timeline details for the patch deployment across all Chrome versions remain under review.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!