Ori Nimron has released functional exploit code for CVE-2026-40369, a Windows kernel vulnerability, three months after Microsoft issued a patch. The release of this code, rather than the existence of the vulnerability itself, represents the primary security concern for enterprise environments. While the vulnerability was addressed in the May 2026 Patch Tuesday cycle, the availability of reliable, public exploit material significantly lowers the barrier for exploitation in unpatched systems.
The vulnerability resides in ntoskrnl.exe within the ExpGetProcessInformation function, specifically when handling info class 253, or SystemProcessInformationExtension. The root cause is a failure in the NtQuerySystemInformation function; when the length parameter is set to zero, the ProbeForWrite mechanism becomes a no-op. This allows an unvalidated kernel pointer to pass directly into a write loop. The resulting primitive is a 12-byte controlled increment, where the exploit increments DWORDs based on the number of processes, total threads, and total handles on the system. Microsoft updated the CVE description on June 1, 2026, reclassifying the issue from an untrusted pointer dereference to a heap-based buffer overflow.
The exploit is 100% deterministic, requiring no probabilistic techniques to achieve execution. This reliability eliminates the skill floor typically associated with kernel exploitation. The full chain provided in the proof-of-concept includes a KASLR bypass via a prefetch tool, an arbitrary kernel read, token privilege escalation, and the eventual acquisition of a SYSTEM shell. Crucially, this chain is reachable from the renderer sandboxes of Chrome, Edge, and Firefox. The NtQuerySystemInformation function is not restricted by win32k lockdown, restricted tokens, or untrusted integrity levels, making the sandbox escape highly effective.
This risk profile extends directly to browser-based AI agents, including Gemini in Chrome, Claude, and Copilot. These agents operate within the same renderer sandboxes as the browser itself. Because the sandbox does not prevent access to this kernel primitive, any compromise of the agent’s execution environment provides a direct path to SYSTEM-level privileges. The AI agent effectively inherits the vulnerability of the host browser, turning a sandbox escape into a full system compromise.
The public disclosure followed a rejection at Pwn2Own Berlin 2026, where the submission was turned away due to a full slot list. This marks a notable instance in the 19-year history of the event where a working zero-day remote code execution submission was rejected. Following this, Nimron proceeded with full public disclosure. The vulnerability was independently confirmed by VoidSec in their analysis, Twelve Bytes to Escape the Browser Sandbox, which detailed a separate exploitation chain involving SYSTEM primary token forgery via NtCreateToken.
The three-month window since the May patch has left a significant exposure gap, as many organizations have not yet applied the update. The combination of a deterministic exploit and universal browser reach makes this code drop a high-priority concern. The existence of two independent exploitation chains — one from Nimron and one from VoidSec — underscores the accessibility of the underlying flaw.
The rejection of this submission by Pwn2Own Berlin 2026 led directly to the public release of the exploit code on GitHub. This code provides a 100% deterministic kernel escape reachable from the renderer sandboxes of Chrome, Edge, and Firefox. Because browser-based AI agents operate within these same sandboxes, they inherit this vulnerability. Consequently, organizations that have not applied the three-month-old patch now face a deterministic kernel escape path from every major browser.