Actively exploited sandbox RCE in all Chromium versions • Hacker News Board

Re: Actively exploited sandbox RCE in all Chromium versions

#31

Post by p-e-w » Fri, Sep 04, 2026, 11:23 PM UTC

lima wrote: post #22

anonymousiam wrote: post #18

Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.

Which browser has a better security track record?

Firefox with uBlock Origin. It’s astonishing how many exploits uBO stops before they ever reach your browser engine. It’s the antivirus of the 2020s.

Re: Actively exploited sandbox RCE in all Chromium versions

#32

Post by Genwald » Fri, Sep 04, 2026, 11:23 PM UTC

ranger_danger wrote: post #16

r_lee wrote: post #15

Earlier quoted context omitted.

I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.

Seems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...

V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear.

https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...

Re: Actively exploited sandbox RCE in all Chromium versions

#33

Post by p-e-w » Fri, Sep 04, 2026, 11:25 PM UTC

zahlman wrote: post #23

jnwatson wrote: post #7

Earlier quoted context omitted.

It means it can execute arbitrary machine code in the sandbox.

Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?

It can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.

Re: Actively exploited sandbox RCE in all Chromium versions

#34

Post by esseph » Fri, Sep 04, 2026, 11:26 PM UTC

thenewnewguy wrote: post #28

Does anybody have a source for the "actively exploited" part of the HN title?

"Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out."

Re: Actively exploited sandbox RCE in all Chromium versions

#35

Post by esseph » Fri, Sep 04, 2026, 11:28 PM UTC

Cider9986 wrote: post #26

lima wrote: post #22

Earlier quoted context omitted.

Which browser has a better security track record?

Vanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium

Right, but it's value-add on a derivative, not its own standalone engine.

Re: Actively exploited sandbox RCE in all Chromium versions

#36

Post by john_strinlai » Fri, Sep 04, 2026, 11:28 PM UTC

thenewnewguy wrote: post #28

Does anybody have a source for the "actively exploited" part of the HN title?

by nature of being in the "known exploited vulnerabilities catalog" (https://www.cisa.gov/known-exploited-vulnerabilities-catalog...)

"CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild."

Re: Actively exploited sandbox RCE in all Chromium versions

#37

Post by computably » Fri, Sep 04, 2026, 11:28 PM UTC

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

> How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

On average, probably not that much. What's the amortized cost of all testing, static analysis, and audit / code review, per "prevented potential bug"?

Re: Actively exploited sandbox RCE in all Chromium versions

#38

Post by crtasm » Fri, Sep 04, 2026, 11:28 PM UTC

thenewnewguy wrote: post #28

Does anybody have a source for the "actively exploited" part of the HN title?

This line, I think? >This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Re: Actively exploited sandbox RCE in all Chromium versions

#39

Post by teravor » Fri, Sep 04, 2026, 11:29 PM UTC

CookieCrisp wrote: post #27

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?

ideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.

Re: Actively exploited sandbox RCE in all Chromium versions

#40

Post by azakai » Fri, Sep 04, 2026, 11:30 PM UTC

d2kx wrote: post #14

Cider9986 wrote: post #4

Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.

This issue is already fixed in Google Chrome (152.0.7977.83)

TFA says

> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

So it was fixed in 152.0.7977.82 (before .83), if I read that right.