With regards to severe vulnerabilities such as arbitrary code execution, does anyone have an idea of the status of the major browsers (chrome, edge, safari, firefox). What are the relative rankings of these in terms of security?
Arbitrary code execution through unsanitized browser UI
11–20 of 34 posts
Re: Arbitrary code execution through unsanitized browser UI
#12Does this affect the Tor browser's ancient version of Firefox?
Tor Browser is based on Firefox 52 ESR. From the article:
This issue did not affect […] Firefox 52 ESR.
Re: Arbitrary code execution through unsanitized browser UI
#13Earlier quoted context omitted.
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.
>Immediately stop using 56, downgrade to the LTS or upgrade to 57 58 is the fixed version. >I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people c…
It broke add-ons that weren't being maintained, primarily. It's true that for some users, this would be very unpleasant, but I have five extensions working fine here in 59.0b5 (including important security/usability ones like uBlock Origin and Stylus).
Re: Arbitrary code execution through unsanitized browser UI
#14Earlier quoted context omitted.
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.
>Immediately stop using 56, downgrade to the LTS or upgrade to 57 58 is the fixed version. >I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people c…
> 58 is the fixed version.
FTA: This issue did not affect Firefox for Android or Firefox 52 ESR.
> That's because 57 was a complete dumpster fire.
I disagree.
> It broke all the add ons.
Yes, it did. They probably should've made 56 an ESR.
> Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this.
They must not be doing a very good job, since I've seen the death of long-loved addons mentioned in every Firefox thread on HN for years.
Re: Arbitrary code execution through unsanitized browser UI
#15Well, here is the patch with a relevant test: https://reviewboard.mozilla.org/r/215474/diff/3#index_header Seems to create an iFrame, sets the source to "chrome://global/content/win.xul", then creates a div (with a NS) inside it and sets the content to: bar() Meh. The expected results is the div contents is: Meh.
Nah, that test relies on being run with chrome privileges. Firefox refuses to even load such a page within an iframe ordinarily.
Re: Arbitrary code execution through unsanitized browser UI
#16This is the kind of advisory that comfort me in my choice to use ESR; browsers are so critical security-wise that it just seems safer. Although if everyone did that nobody would test new features I guess.
Re: Arbitrary code execution through unsanitized browser UI
#17How would an attacker have used this vulnerability? It seems to me that they'd already have to be able to inject code into the chrome context, to be able to point it towards content they control. Maybe I misunderstand how this works.
Re: Arbitrary code execution through unsanitized browser UI
#18With regards to severe vulnerabilities such as arbitrary code execution, does anyone have an idea of the status of the major browsers (chrome, edge, safari, firefox). What are the relative rankings of these in terms of security?
There is no universal metric for security.
What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion.
Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work.
They have had an excellent bounty program. They have project 0 doing advanced offensive research, much of which has been relevant to browsers.
They fuzz a ton and have managed to solicit others to do the same (not that other browsers don't/ haven't).
Their sandbox is incredible and constantly evolving. They basically invented seccomp v2 just to improve their sandboxing stature on linux. They implemented 'forceaslr' before EMET was even a thing to help prevent info leaks from third party libs.
Their new kernel32.dll unloading mitigation is awesome, and as far as I know the first instance of such a thing.
I could really go on and on, I'm sure - they have taken incredible proactive measures and they're just getting better at it.
We can see similar growth in Edge, which has had a sandbox for years. Firefox has more recently gotten a sandbox and the move to rust is encouraging.
But... yeah, in my opinion, Chrome takes the cake.
Re: Arbitrary code execution through unsanitized browser UI
#19Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.
56 will never get backported security fixes of any kind. For the record, neither will 57, as 58 is the current stable version. Mozilla does not apply security fixes to versions of Firefox other than the latest stable and the latest ESR.
Re: Arbitrary code execution through unsanitized browser UI
#20With regards to severe vulnerabilities such as arbitrary code execution, does anyone have an idea of the status of the major browsers (chrome, edge, safari, firefox). What are the relative rankings of these in terms of security?
There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…
Note that Site Isolation isn't on by default, and I still don't know what they're going to do about sites that contain hundreds of cross-domain iframes.