Does it a help in this case if one runs the browser in a sandbox? E.g. in docker?
They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?
They can then break out from the browser, but only get to docker with that exploit, and it's unlikely they have a docker exploit too at hand, is it?
If you are running Firefox on X11 (which most Linux users probably still do), you do not need to escape Docker. You can make screenshot, capture keystrokes, and send keystrokes, all through the X11 socket.
(Furthermore, you do not need a Docker exploit, a Linux kernel exploit can be enough to break out of a container. This is one of the reasons for e.g. gVisor to implement syscalls in userland and in a safer language.)
Using VMs as e.g. Qubes OS does is probably a bit safer than a Docker container.
Also, this is why Wayland is much more restrictive about these types of operations. People love to complain that "I could do thing with X without special privileges" but the world has moved on since X was designed and it absolutely has not kept up.
It creates boundaries, but, like a typical suburban garden fence, they aren't hardened security boundaries.
Basically what I'm saying is, it's very much a security boundary. It's far from a decorative fence.
Now breaking out of a docker container with --privileged or even just CAP_SYS_ADMIN is much easier.
Docker does do a decent job of setting some sensible defaults - but it isn't a security sandbox and they don't market it as such.
[0] https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-fr...
Since default docker runs linux, running the browser in a linux docker can be enough, because they usually have windows exploits.