[dead]
Actively exploited sandbox RCE in all Chromium versions
131–140 of 517 posts
Re: Actively exploited sandbox RCE in all Chromium versions
#132Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.
It's so ubiquitous and unavoidable at this point.. I was at a conference lecture in 2020 where someone was suggesting disabling JavaScript and I thought the same thing— how absurd. The times have really changed...
Re: Actively exploited sandbox RCE in all Chromium versions
#133[deleted]
Re: Actively exploited sandbox RCE in all Chromium versions
#134For what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?
If it's in the CISA known exploited vulnerabilities catalog, tell me if I'm wrong but I assume people don't go around exploiting million dollar 0-days in public just to fuck around safely in a chrome sandbox.
So maybe we're going to see another CVE for the sandbox escape soon?
Re: Actively exploited sandbox RCE in all Chromium versions
#135For what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?
Crypto mining would be one application. But also, combined with a sandbox escape would make it particularly devastating. Usually full control of a device takes at least two exploits given the layers of security present in OS and browser environments.
Re: Actively exploited sandbox RCE in all Chromium versions
#136So basically, Edge, Brave and any other browser built on Chromium. Nice.
Monocultures are great!
Re: Actively exploited sandbox RCE in all Chromium versions
#137Earlier quoted context omitted.
> Blackhat markets will always be able to pay better. ... than Google? > Selling to Google though you aren't chancing jail time. Why would you go to jail for selling a vulnerability? It's free speech.
Telling someone the steps to rob a bank world probably catch you some charges, I'm assuming.
No, it wouldn't.
Re: Actively exploited sandbox RCE in all Chromium versions
#138Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT.
I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's exceedingly rare for websites to actually be doing something that needs raw performance. And SPAs will be slow no matter what.
Re: Actively exploited sandbox RCE in all Chromium versions
#139Earlier quoted context omitted.
You let the market decide. Google could purchase the bugs on the same market blackhats do.
Well, someone did decide to tell google about this in exchange for a thousand dollars (albeit unclear how much the money was the motivator). Doesn't that mean the market did decide in google's favour?
Someone decided to tell Google about this in exchange for an unknown amount of money, chosen unilaterally by Google at a later date, at which point the market value of the vulnerability is $0.
There's no way money is the motivator.
Re: Actively exploited sandbox RCE in all Chromium versions
#140[dead]