[dead]
Actively exploited sandbox RCE in all Chromium versions
11–20 of 518 posts
Re: Actively exploited sandbox RCE in all Chromium versions
#12Earlier quoted context omitted.
RCE inside sandbox, so requires chaining with another 0day.
What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
[deleted]
Re: Actively exploited sandbox RCE in all Chromium versions
#13Re: Actively exploited sandbox RCE in all Chromium versions
#14Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.
This issue is already fixed in Google Chrome (152.0.7977.83)
Re: Actively exploited sandbox RCE in all Chromium versions
#15Earlier quoted context omitted.
What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
It means it can execute arbitrary machine code in the sandbox.
I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
Re: Actively exploited sandbox RCE in all Chromium versions
#16Earlier quoted context omitted.
It means it can execute arbitrary machine code in the sandbox.
I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
Seems to use OS-specific kernel syscall filtering facilities.
Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d...
Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...
Re: Actively exploited sandbox RCE in all Chromium versions
#17Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.
The release version just now updated to 152.0.7977.83 which has the fix.
I upgraded Vivaldi, which is reporting 152.0.7977.112
Re: Actively exploited sandbox RCE in all Chromium versions
#18Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.
Re: Actively exploited sandbox RCE in all Chromium versions
#19Earlier quoted context omitted.
RCE inside sandbox, so requires chaining with another 0day.
What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
Re: Actively exploited sandbox RCE in all Chromium versions
#20Let's take a moment to talk about the monetary value of this vulnerability.
According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.
The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?
Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?
It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.