Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

21–30 of 516 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#21

Post by jimrandomh »

zahlman wrote: post #6
teravor wrote: post #3

Earlier quoted context omitted.

RCE inside sandbox, so requires chaining with another 0day.

What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.

Re: Actively exploited sandbox RCE in all Chromium versions

#23

Post by zahlman »

jnwatson wrote: post #7
zahlman wrote: post #6

Earlier quoted context omitted.

What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

It means it can execute arbitrary machine code in the sandbox.

Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?

Re: Actively exploited sandbox RCE in all Chromium versions

#25

Post by r_lee »

ranger_danger wrote: post #16
r_lee wrote: post #15

Earlier quoted context omitted.

I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.

Seems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...

great link, thanks

Re: Actively exploited sandbox RCE in all Chromium versions

#26

Post by Cider9986 »

lima wrote: post #22
anonymousiam wrote: post #18

Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.

Which browser has a better security track record?

Vanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium

Re: Actively exploited sandbox RCE in all Chromium versions

#27

Post by CookieCrisp »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?

Re: Actively exploited sandbox RCE in all Chromium versions

#29

Post by esseph »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

The problem is they are being flooded with both fake AND real disclosures. Imagine if they tried to pay out $250,000 or more per bug? Would the cost be worth it? Maybe, but shareholders may not be pleased... Unless they viewed it as insurance against it being more financially sound for the finder to sell the exploit on the gray or black market instead...

Re: Actively exploited sandbox RCE in all Chromium versions

#30

Post by r_lee »

zahlman wrote: post #23
jnwatson wrote: post #7

Earlier quoted context omitted.

It means it can execute arbitrary machine code in the sandbox.

Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?

because with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native

can't get a proper ios/Android RCE with just JS code exec

Post reply on HN