The issue with sandbox strategy.

[minusmulticoloredper]

I searched online for a range of browsers built on the latest Chromium version that would run on Windows 7. All of them displayed empty sandbox policies on Windows 7, whereas these policies were properly shown on Windows 10 and later versions. Initially, I believed this was simply a compatibility issue with Windows 7. However, after injecting Vxkex into Ungoogled-Chromium, I found that the sandbox policy was still empty.

I thought that since the browser worked fine on Windows 10, I could trick it into thinking it was running on Windows 10. So, I enabled the system version spoofing feature in Vxkex and launched the browser again. To my surprise, the sandbox policy was now displayed correctly.

I am not a developer—just a user—but I suspect that Chromium checks the operating system version and applies different sandbox policies accordingly. Since there’s no sandbox policy designed specifically for Windows 7, it defaults to an empty policy.

Test results are as follows:

Without Vxkex enabled

With Vxkex enabled

With OS version spoofing enabled

[minusmulticoloredper]

I would like the developers to address and resolve the issue with the sandbox policy error.

[minusmulticoloredper]

win32ss/supermium#1162

[e3kskoy7wqk]

but I suspect that Chromium checks the operating system version and applies different sandbox policies accordingly.

Your suspicion is reasonable. The sandbox policies applied on Windows 7 can be considered a subset of those applied on Windows 10. The reason some sandbox policies applied on Windows 10 are not applied on Windows 7 is that they are not supported on Windows 7.

Additionally, your statement that Chromium for windows 7 displayed empty sandbox policies on Windows 7 is incorrect. Clearly, I have enabled the sandbox. If you have Google Chrome 109, you will observe that the sandbox behavior of Chromium for windows 7 on both Windows 7 and Windows 10 is very similar to that of Google Chrome 109 on both operating systems.

[fukyou-fukme]

Could the absence of this sandbox policy lead to a decrease in browser security? Is it possible to replicate the sandbox policies used by browsers in Windows 10 to lower versions of Windows? Alternatively, can the sandbox policies from Chromium 109 be ported over? Or is there a way to mimic the operating system version in the browser to enforce the sandbox policies from Windows 10?

[e3kskoy7wqk]

Could the absence of this sandbox policy lead to a decrease in browser security?

I am not sure if the absence of this sandbox policy will lead to a decrease in browser security. However, Chromium for windows 7 has ported the sandbox policies from Chromium 109, making it very similar to Chromium 109's sandbox policies. Since Chromium 109 is not considered to have security issues, Chromium for windows 7 should not be suspected of having security issues either.

Is it possible to replicate the sandbox policies used by browsers in Windows 10 to lower versions of Windows?

Or is there a way to mimic the operating system version in the browser to enforce the sandbox policies from Windows 10?

Achieving this without using the Windows 7 extended kernel would be difficult; otherwise, I believe Google would have implemented it.

[minusmulticoloredper]

Is this issue going to be fixed in the next version?

[e3kskoy7wqk]

It's unlikely. I don't know how to fix it. If someone could tell me, that would be great.

[minusmulticoloredper]

I used DeepSeek to analyze the Chromium source code, not sure if that could be of any help to you.

[e3kskoy7wqk]

@minusmulticoloredper When I initially modified Chromium to support Windows 7 last year, I recall making changes to this part of the code. I believe I integrated parts of version 109 into it, and it worked fine on Windows 7. For over a year, I haven’t touched these sandbox-related changes since they never caused any issues.

Thank you so much for your help—perhaps I really should revisit and update this code soon.

[ZepopaOwleMukasa]

@e3kskoy7wqk

Just as a heads-up, the Supermium developer is currently tinkering with the sandbox on older operating systems too. Maybe there is something useful in there to check out for, let's call it, inspiration.

win32ss/supermium@5c81204