Getting outright code execution (calc.exe) is only useful once you also have a way to escape the sandbox, after you've got code execution in the process you exploited. It's sort of a forced realization of real capability based security, like Eros or Capsicum. Given the complex layout and rendering engines in browsers, this is good to have - they're almost purely computational logic, so they don't need many capabilities like 'Open File' or 'Spawn Process'. All the rendering and layout logic for the page is computed in a separate process, and draw commands are sent over a IPC pipe instead to a controlled renderer, which actually issues draw commands to the GPU. But, if we go by 'Being able to spawn calc.exe on someone's computer' - if you simply look at the amount of effort needed to attack a program like Chrome versus Firefox and successfully break out of the sandbox - yes, when done correctly, it adds a good layer of defense in depth.Ĭhrome for example doesn't even let render processes touch OpenGL. It depends on how the sandbox is actually constructed, and what information/level of control the attacker is attempting to obtain. I'm not sure about any studies, only my own observations and attempts at breaking browsers.

Sandboxed web browser