Actively exploited sandbox RCE in all Chromium versions

Cider9986 wrote: post #4

Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.

The release version just now updated to 152.0.7977.83 which has the fix.

Re: Actively exploited sandbox RCE in all Chromium versions

#6

Post by zahlman » Fri, Sep 04, 2026, 10:28 PM UTC

teravor wrote: post #3

petra303 wrote: post #2

Only a score of 8.8?

RCE inside sandbox, so requires chaining with another 0day.

What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

Re: Actively exploited sandbox RCE in all Chromium versions

#7

Post by jnwatson » Fri, Sep 04, 2026, 10:31 PM UTC

zahlman wrote: post #6

teravor wrote: post #3

Earlier quoted context omitted.

RCE inside sandbox, so requires chaining with another 0day.

What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

It means it can execute arbitrary machine code in the sandbox.

Re: Actively exploited sandbox RCE in all Chromium versions

#8

Post by [deleted] » Fri, Sep 04, 2026, 10:31 PM UTC

Cider9986 wrote: post #4

Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.

[deleted]

Re: Actively exploited sandbox RCE in all Chromium versions

#9

Post by anon109 » Fri, Sep 04, 2026, 10:38 PM UTC

Cider9986 wrote: post #4

Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.

Is graphene even affected? JIT is disabled in default configurations.

Re: Actively exploited sandbox RCE in all Chromium versions

#10

Post by Terr_ » Fri, Sep 04, 2026, 10:39 PM UTC

As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising.

"Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."