Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

101–110 of 524 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#101

Post by bawolff »

quotemstr wrote: post #45
CookieCrisp wrote: post #27

Earlier quoted context omitted.

While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?

You let the market decide. Google could purchase the bugs on the same market blackhats do.

Well, someone did decide to tell google about this in exchange for a thousand dollars (albeit unclear how much the money was the motivator). Doesn't that mean the market did decide in google's favour?

Re: Actively exploited sandbox RCE in all Chromium versions

#102

Post by tcdent »

publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

V8 as a runtime goes far deeper than just webpages.

Re: Actively exploited sandbox RCE in all Chromium versions

#104

Post by nixosbestos »

Espressosaurus wrote: post #79
asveikau wrote: post #67

Earlier quoted context omitted.

I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.

It became insane because nothing bloody worked without Javascript some time in the early 2010s. Like cellphones, javascript became necessary if you want to use webmail, access your bank's website, or whatever.

I say this as someone does NOT disable JS in my main browser (because like, I have a job), but also knows a fair bit about why Firefox inside Tails now restarts in some cases...

It's the classic thing. Across every gdmf metric, excluding with "true empathy", no one *gives a fuck* until it affects them, or someone within (1-3) degrees of separatation. And having broad empathy is generally a good way to get yourself labeled/astrocized: both about as obvious "compriate" and obvious "adversary".

Re: Actively exploited sandbox RCE in all Chromium versions

#105

Post by s1artibartfast »

bawolff wrote: post #97
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

> But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. I'd point out that part of the reason the grey and black market pays so well is because it is that type of market. You have to pay people extra to look past their morals and a risk premium against potential reputational and legal consequences. That said, the gap is probably not just that.

It seems like by definition it is.

Someone could sell it on the black market, sell it to Google, or just move on with their life and not sell it.

I don't know what this is worth on the black market, maybe I'd be scammed by even trying to sell it. Maybe I don't want to be a bad person. These are all things that go into the prices

Re: Actively exploited sandbox RCE in all Chromium versions

#106

Post by bawolff »

asveikau wrote: post #67
publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.

In fairness, in the early 2000s they were probably right. Early browser security model was a bit of a mess. The fact that this article is even talked about is a sign of how much better things are.

Re: Actively exploited sandbox RCE in all Chromium versions

#107

Post by solenoid0937 »

dataflow wrote: post #96
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

It sounds insultingly low, yeah. I'm trying to imagine why they would pay so little. The only two reasons I can think of are either (a) they were already aware of it and fixing it, and therefore the report didn't really change much, or (b) it requires an unusual configuration or otherwise rare opportunity to that makes it impractical to exploit most users. Really curious to see what the issue was whenever it gets mad…

(c) there are so many undiscovered vulnerabilities that it doesn't make sense for them to offer a decent payout

Re: Actively exploited sandbox RCE in all Chromium versions

#108

Post by jeremyjh »

iririririr wrote: post #13
teravor wrote: post #3

Earlier quoted context omitted.

RCE inside sandbox, so requires chaining with another 0day.

what is online ad networks for $100, alex

I don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades.

My read of Google's disclosure is that there is likely no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is correctly an 8.8 there would be a critical assessment of a known chain. The only reason there wouldn't be, would be if the other vulnerability is known to Google but has no patch yet.

Re: Actively exploited sandbox RCE in all Chromium versions

#109

Post by ThunderSizzle »

Espressosaurus wrote: post #79
asveikau wrote: post #67

Earlier quoted context omitted.

I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.

It became insane because nothing bloody worked without Javascript some time in the early 2010s. Like cellphones, javascript became necessary if you want to use webmail, access your bank's website, or whatever.

I still run with u matrix though, and most third party requests can be limited, but I no longer have enough patience when a required page doesn't work - I'll just rely on ublock origin to work.

Re: Actively exploited sandbox RCE in all Chromium versions

#110

Post by quotemstr »

asdfaoeu wrote: post #99
quotemstr wrote: post #45

Earlier quoted context omitted.

You let the market decide. Google could purchase the bugs on the same market blackhats do.

Blackhat markets will always be able to pay better. Selling to Google though you aren't chancing jail time.

> Blackhat markets will always be able to pay better.

... than Google?

> Selling to Google though you aren't chancing jail time.

Why would you go to jail for selling a vulnerability? It's free speech.

Post reply on HN