What's this about?
The expert-led results are the most concrete in the post. Against a hardened browser, Astra discovered previously unknown vulnerabilities and turned them into working exploit chains — building a full browser-compromise chain that escaped the sandbox and executed commands on the host, triggered by the browser opening an HTML file. Against a hardened operating system it found multiple vulnerabilities and combined them into a local privilege-escalation chain from an unprivileged user to root.
What is an exploit chain?
Modern systems are defended in layers, and one bug rarely gets you anywhere useful. A chain strings several together: one to get code running inside the sandboxed renderer, another to break out of the sandbox, another to escalate privileges on the host. Each link needs a separate vulnerability and each transition is its own engineering problem. Chaining is the part that has always required a skilled human — it needs a model of the whole system, not just one flaw. That is what is being reported as automated here.
Why does this matter to you?
- "Opening an HTML file" is the threat model, and it is the most ordinary action a computer performs.
- Local privilege escalation to root on a hardened OS is the other half of every real intrusion.
- Both results are against hardened targets — the assessment deliberately excluded easy wins.