{"slug": "cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit", "title": "CVE-2026-40369 Exploit Code Drops Three Months After Patch — and AI Agents Inherit the Sandbox Escape", "summary": "Security researcher Ori Nimron has released functional exploit code for CVE-2026-40369, a Windows kernel vulnerability patched by Microsoft in May 2026, three months after the patch. The deterministic exploit, which provides a 12-byte controlled increment and is reachable from the renderer sandboxes of Chrome, Edge, and Firefox, also affects browser-based AI agents such as Gemini, Claude, and Copilot, which inherit the sandbox escape. The public disclosure followed a rejection at Pwn2Own Berlin 2026, and the vulnerability was independently confirmed by VoidSec.", "body_md": "Ori Nimron has released functional exploit code for [CVE-2026-40369](https://github.com/orinimron123/CVE-2026-40369-EXPLOIT), a Windows kernel vulnerability, three months after Microsoft issued a patch. The release of this code, rather than the existence of the vulnerability itself, represents the primary security concern for enterprise environments. While the vulnerability was addressed in the May 2026 Patch Tuesday cycle, the availability of reliable, public exploit material significantly lowers the barrier for exploitation in unpatched systems.\n\nThe vulnerability resides in ntoskrnl.exe within the ExpGetProcessInformation function, specifically when handling info class 253, or SystemProcessInformationExtension. The root cause is a failure in the NtQuerySystemInformation function; when the length parameter is set to zero, the ProbeForWrite mechanism becomes a no-op. This allows an unvalidated kernel pointer to pass directly into a write loop. The resulting primitive is a 12-byte controlled increment, where the exploit increments DWORDs based on the number of processes, total threads, and total handles on the system. Microsoft updated the CVE description on June 1, 2026, reclassifying the issue from an untrusted pointer dereference to a heap-based buffer overflow.\n\nThe exploit is 100% deterministic, requiring no probabilistic techniques to achieve execution. This reliability eliminates the skill floor typically associated with kernel exploitation. The full chain provided in the proof-of-concept includes a KASLR bypass via a prefetch tool, an arbitrary kernel read, token privilege escalation, and the eventual acquisition of a SYSTEM shell. Crucially, this chain is reachable from the renderer sandboxes of Chrome, Edge, and Firefox. The NtQuerySystemInformation function is not restricted by win32k lockdown, restricted tokens, or untrusted integrity levels, making the [sandbox escape](/glossary/sandbox-escape/) highly effective.\n\nThis risk profile extends directly to browser-based AI agents, including Gemini in Chrome, Claude, and Copilot. These agents operate within the same renderer sandboxes as the browser itself. Because the sandbox does not prevent access to this kernel primitive, any compromise of the agent’s execution environment provides a direct path to SYSTEM-level privileges. The AI agent effectively inherits the vulnerability of the host browser, turning a sandbox escape into a full system compromise.\n\nThe public disclosure followed a rejection at Pwn2Own Berlin 2026, where the submission was turned away due to a full slot list. This marks a notable instance in the 19-year history of the event where a working zero-day remote code execution submission was rejected. Following this, Nimron proceeded with full public disclosure. The vulnerability was independently confirmed by [VoidSec](https://voidsec.com/blog/cve-2026-40369-twelve-bytes-to-escape-the-browser-sandbox/) in their analysis, *Twelve Bytes to Escape the Browser Sandbox*, which detailed a separate exploitation chain involving SYSTEM primary token forgery via NtCreateToken.\n\nThe three-month window since the May patch has left a significant exposure gap, as many organizations have not yet applied the update. The combination of a deterministic exploit and universal browser reach makes this code drop a high-priority concern. The existence of two independent exploitation chains — one from Nimron and one from VoidSec — underscores the accessibility of the underlying flaw.\n\nThe rejection of this submission by Pwn2Own Berlin 2026 led directly to the public release of the exploit code on GitHub. This code provides a 100% deterministic kernel escape reachable from the renderer sandboxes of Chrome, Edge, and Firefox. Because browser-based AI agents operate within these same sandboxes, they inherit this vulnerability. Consequently, organizations that have not applied the three-month-old patch now face a deterministic kernel escape path from every major browser.", "url": "https://wpnews.pro/news/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit", "canonical_source": "https://forkast.news/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit-the-sandbox-escape/", "published_at": "2026-08-19 12:49:37+00:00", "updated_at": "2026-08-19 13:11:38.427140+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["Ori Nimron", "Microsoft", "CVE-2026-40369", "Chrome", "Edge", "Firefox", "Gemini", "Claude"], "alternates": {"html": "https://wpnews.pro/news/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit", "markdown": "https://wpnews.pro/news/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit.md", "text": "https://wpnews.pro/news/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit.txt", "jsonld": "https://wpnews.pro/news/cve-2026-40369-exploit-code-drops-three-months-after-patch-and-ai-agents-inherit.jsonld"}}