The Chrome VRP Panel has decided to award $250k for this report

Post by matsemann » Mon, Aug 11, 2025, 7:43 AM UTC

Retr0id wrote: post #39

matsemann wrote: post #34

Is there somewhere explaining this bug in terms understandable for someone not dabbling in this? I don't really understand how this works to "escape the sandbox". Normally it's like a website you visit that get access it shouldn't have. But this talk about renderers and native apis make it seem like it's stuff another process on the computer would do?

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

Post by markdown » Mon, Aug 11, 2025, 7:50 AM UTC

rvz wrote: post #42

dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug. Won't complain about that.

Post by MrGilbert » Mon, Aug 11, 2025, 7:52 AM UTC

renewiltord wrote: post #17

MrGilbert wrote: post #8

"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…

Indeed, one of the great tragedies of life is that this happens. Humans cannot survive without water, yet the median water bill is $80, which is about 1% of the median household's income. People make so much money but refuse to pay for something that literally sustains their life. Join me in requiring that every household at least 10x the amount they pay for this precious water. To employees of water companies: Thank…

Post by ajb » Mon, Aug 11, 2025, 7:54 AM UTC

whatever1 wrote: post #44

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Why not collect from both of the sources? First collect with your black hat and then with your white.

Post by hnlmorg » Mon, Aug 11, 2025, 7:56 AM UTC

sour-taste wrote: post #36

ad-astra wrote: post #5

Impressive. Feel like finding issues like this in such a large project is like looking for a needle in a haystack

I feel like it's the opposite. In a huge project there's bound to be many weird interactions between components, and it's about picking the important/security relevant ones and finding edge cases. In this case the focus was on the interaction between the renderer process and the broker. That forms a security boundary so it makes sense to focus your efforts there - google will pay for such exploits since they can in t…