Pwn2Own 2012: Google Chrome browser sandbox first to fall

In an interview, Bekrar said his team worked for about six weeks to find the vulnerabilities and write the exploits. ”We had to use two vulnerabilities. The first one was to bypass DEP and ASLR on Windows and a second one to break out of the Chrome sandbox.”

“Our exploit worked against the default installation...

During the hack, Bekrar created a web page booby-trapped with his exploit. Once the target machine visited the page, the exploit ran and opened the Calculator (calc.exe) app outside of the sandbox.”

“There was no user interaction, no extra clicks. Visit the site, popped the box.”