$1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.
Anyone who sells such an exploit should go to prison.
Actively exploited sandbox RCE in all Chromium versions
211–220 of 527 posts
Re: Actively exploited sandbox RCE in all Chromium versions
#212Earlier quoted context omitted.
[flagged]
[flagged]
Before the LLMs made the emdash the tool of the electronic oppressor I used it often enough and other people did too.
I hate that it's basically become the little hitler moustache of punctuation. There was at least one guy who was really enjoying his tiny little moustache until he couldn't anymore. That is the emdash for me.
Re: Actively exploited sandbox RCE in all Chromium versions
#213Earlier quoted context omitted.
That's really informative but maybe a little overly capitalist-brained. We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.
> We shouldn't look to the black market as cost discovery for these vulnerabilities We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.
That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google.
A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".
Re: Actively exploited sandbox RCE in all Chromium versions
#214Earlier quoted context omitted.
How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?
That’s not how things are valued. That’s moreso how the absence of something is valued.
Go without air for a few minutes and you’ll die, and yet they give the stuff away for free.
Re: Actively exploited sandbox RCE in all Chromium versions
#215Earlier quoted context omitted.
[flagged]
Before the LLMs made the emdash the tool of the electronic oppressor I used it often enough and other people did too. I hate that it's basically become the little hitler moustache of punctuation. There was at least one guy who was really enjoying his tiny little moustache until he couldn't anymore. That is the emdash for me.
> the emdash has become the little hitler moustache of punctuation
Legendary.
Miss that shit too.
Ez way to shit on Windows users who had to double up endashes like they were impoverished.
I guess in your analogy the double endash is Stalin’s mustache and the Soviet Union in general - Gaudy, excessive, starving for more
Re: Actively exploited sandbox RCE in all Chromium versions
#216[dead]
Re: Actively exploited sandbox RCE in all Chromium versions
#217Earlier quoted context omitted.
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…
[flagged]
Mate, it’s a style thing that depends on which style guide you’re following
AP recommends spaces around them, whereas Chicago doesn’t
besides if we’re critiquing incorrect following of English orthography
—Sentences should be capitalized
—The word “don’t” requires an apostrophe
—End sentences with a period
—That’s incorrect usage of an em-dash at the end there — but what does it matter anyways ;)
Re: Actively exploited sandbox RCE in all Chromium versions
#218Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…
you're taking someone's word it's being exploited. It says right at the top of the report
> allowed a remote attacker to execute arbitrary code *inside the sandbox*
A bug in V8 leads to code execution in Chrome's web page process. It does not lead to execution in general. For that you need other exploits that escape the web page process. Those are not detailed here. This CVE is not a big deal. You're responding the poster's title, not the actual CVE
Re: Actively exploited sandbox RCE in all Chromium versions
#219[dead]
Re: Actively exploited sandbox RCE in all Chromium versions
#220Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?
Yes, it says right in the CVE
> allowed a remote attacker to execute arbitrary code *inside the sandbox*