speedyfriend433/sandbox_extension-TOCTOU-bug
Can I trust it?
Worth a closer look before you use it.
Warnings Check
Very new: it was created 11 days ago. Wait a little before installing it.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change 10 days ago.
Licence OK
MIT: you can use it for free, also in a commercial product. Keep the licence notice.
Quick checks from public data. They help, but they are no guarantee.
What it is
Proof-of-concept describing a claimed sandbox escape: sandbox_extension_issue_file resolves symlinks at issue time without SANDBOX_EXTENSION_NOFOLLOW, so a symlink can be swapped after issuing an extension and the consumed extension then reads an out-of-sandbox file. The README…
Who it's for
Security researchers and macOS or iOS developers analysing sandbox extension behaviour and TOCTOU issues
How to use it
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up speedyfriend433/sandbox_extension-TOCTOU-bug in my project. Follow its README: https://github.com/speedyfriend433/sandbox_extension-TOCTOU-bug. Explain each step and check it is safe before running anything.
Star curve
Get alerts for repos like this
We'll email you when repos like this start rising. Free, once a week, only what matches.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/speedyfriend433/sandbox_extension-TOCTOU-bug?ref=badge)Similar repos
- anthropics/sandbox-runtime
A command-line tool and TypeScript library that runs arbitrary processes under OS-level filesystem and network restrictions without a container. It uses sandbox-exec on macOS, bubblewrap on Linux and
- TelegramMessenger/widget-sandbox
A no-network sandbox framework for running HTML widgets delivered inside Telegram messages. Widget JavaScript runs in QuickJS with no network access, and all output is validated against allowlists bef
- fush520/fush-vue-mcp
Chrome extension and MCP server for security testing of Vue front ends: route extraction, router guard bypass, unauthorized route probing, Pinia/Vuex store dumps, anti-debugging bypass and API hooks.
- dinosn/php-cve-2026-10961x-lab-poc
Lab reproduction and vulnerability-research package for PHP 8.5.11 CVE-2026-109618 and CVE-2026-109619, a remote code execution chain using memory disclosure via session cookies and a use-after-free.
- Forbiddeniadive/ashampoo-uninstaller
The README describes a PowerShell setup script hosted on git-software.cc that it says installs a pre-activated Ashampoo Uninstaller build for Windows x64, about 1.5 GB. The repository has no source co
- earendil-works/djs
A small no_std Rust JavaScript and TypeScript engine, built mainly for wasm32 as a replacement for QuickJS in pi's codemode. VM state lives in one byte arena, so snapshots are plain byte copies, and e