Collected research

Uncovering a crazy privilege escalation from Chrome extensions

@deryilz · derineryilmaz.com

On ChromeOS a Chrome extension holding only the downloads permission can save an HTML file and open it through a filesystem:chrome://file-manager/external URL, running script on the privileged File Manager origin.

Record

Researcher

@deryilz

Published by

derineryilmaz.com

Format

Advisory

Topic

Browser

In the archive

• Collected in the 2023 research round

Related sources

• some more concise proof-of-concept code

Tags

• sandbox-escape
• privilege-escalation
• browser-extension
• xss
• same-origin-policy
• info-leak
• cve
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of @deryilz, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.