Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

251–260 of 527 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#251

Post by altairprime »

cogman10 wrote: post #142
altairprime wrote: post #119

Earlier quoted context omitted.

The discount Google is getting on bounties versus internal spend is easy to estimate: # assumed to be $0.5mil USD or greater A := What quantity of salaries-and-benefits and AI-dollars does Google spend on zero-day research? # assumed to be greater than zero B := How many full sandbox RCEs are they *hoping* to discover per year with that budget? # $/RCE budgeted spend C := A ÷ B # $/bounty D := $1000 USD # % discount…

> or they're negligent in budgeting for RCE discovery at all, or they assign zero value to the security of the Chromium platform underpinning Edge, Electron, et al I generally agree, but a 3rd explanation is they figure that too generous a bounty will flood them with reports of minor issues making major ones harder to see (and costing time and money to verify that could be spent looking for security issues).

Having previously worked near a bounty program, I can confirm that they are regardless flooded with people fishing for bounties, even before AI, no matter how cheap the bounty may be — people will grift anything with the most pathetic skript kiddie attempts possible to try and pad their resume with a hit, and bounties that pay $0 are more valuable than pull requests that pay $0.

Re: Actively exploited sandbox RCE in all Chromium versions

#252

Post by thayne »

noduerme wrote: post #240
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

Well, the implication (and I'm not saying this is right) is that to Google it's only worth $1k to have this brought to their attention by a white hat, versus finding out by exploitation. Which means that they have zero concern from this incident about reputational damage to themselves or their browser. That's pretty good circumstantial evidence of a monopolistic practice, when you can safely assume that there's effec…

But google is also a monopsony. There isn't anyone else the researcher can ethically sell it to. They just have to take whatever bounty google decides to pay.

Re: Actively exploited sandbox RCE in all Chromium versions

#253

Post by roywiggins »

socalgal2 wrote: post #218
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

you're taking someone's word it's being exploited. It says right at the top of the report > allowed a remote attacker to execute arbitrary code *inside the sandbox* A bug in V8 leads to code execution in Chrome's web page process. It does not lead to execution in general. For that you need other exploits that escape the web page process. Those are not detailed here. This CVE is not a big deal. You're responding the p…

> I chained this bug with an n-day sandbox escape and flagged the v8CTF.

https://serotav.github.io/Writeups/v8/when-sorting-leads-to-...

Re: Actively exploited sandbox RCE in all Chromium versions

#254

Post by esseph »

Barbing wrote: post #63
esseph wrote: post #29

Earlier quoted context omitted.

The problem is they are being flooded with both fake AND real disclosures. Imagine if they tried to pay out $250,000 or more per bug? Would the cost be worth it? Maybe, but shareholders may not be pleased... Unless they viewed it as insurance against it being more financially sound for the finder to sell the exploit on the gray or black market instead...

Pre-flood, they didn’t pay more did they? > viewed it as insurance Of course. Beyond the ethics, the social obligation, sleeping well at night by compensating hardworking people fairly. “We can’t pay more or we’d have to hire more human reviewers” should never be a massive company’s line of thinking.

https://bughunters.google.com/about/key-stats

Total rewards given $81,933,423

Re: Actively exploited sandbox RCE in all Chromium versions

#255

Post by onion2k »

tantalor wrote: post #166
0xbadcafebee wrote: post #154

Earlier quoted context omitted.

How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?

The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.

The value of future reports should also be a component though. By paying a low amount you discourage ethical bug bounty hackers from bothering to look for more exploits. If I think I'm only getting $1000 for a Chrome issue versus $100,000 for an Acme Co issue, I'll be spending my time looking for Acme Co issues.

Bug bounties are as much a way of attracting talent to even try to exploit your system as they are about the exploits themselves. If you lowball the bounties the talent goes elsewhere.

Re: Actively exploited sandbox RCE in all Chromium versions

#256

Post by grishka »

timr wrote: post #228
varenc wrote: post #178

Earlier quoted context omitted.

I disagree about JIT performance not mattering. I enabled "Lockdown Mode" on iOS which disables the JIT for the mentioned security reasons, and it causes a very noticeable lagginess on many sites. Of course, the primary cause is the unnecessary JS monstrosities wasting CPU cycles. But practically speaking I can say that disabling the JIT results in a very subpar experience of many JS heavy pages.

That's largely because a lot of developers have made the devil's bargain of replacing standard web stuff with badly re-implemented JS versions of same. People did it because they could , but never considered if they should . See most of the ecosystem around React, for reference. It's idiotic that things like URL management are done in Javascript. Or form controls. I guarantee that if we stopped doing this kind of stu…

> See most of the ecosystem around React, for reference.

I've never used React myself, but what I've heard about it makes me question my own sanity. So are you going to tell me that instead of just updating the DOM tree directly I'm going to apply the changes to my data, then pass the entire model to the framework, which would then diff it with the previous version to get the changes back out, it would then call my functions that return components, and it would then diff the virtual DOM to find out what changed, and only then would it update the actual page? Why the fuck would anyone ever want that? What's so hard about simply changing the innerText or inserting elements or whatever?

Oh and now Google and Apple are insisting that this is the way to do UIs in native apps as well, with Compose and SwiftUI respectively.

The way the front end developer community seems to largely encourage learning top-down isn't helping either. I'll forever remember that one guy we made a small project with. He learned React but had no clue what "send a request" and "pass a parameter" means, and I had to explain him how to use XHR.

Re: Actively exploited sandbox RCE in all Chromium versions

#259

Post by ruuda »

pizlonator wrote: post #146
publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs. That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it. (Posted from a memory safe browser - WebKit MiniBrowser compil…

In Chromium you can turn off V8's JIT compiler for this reason. You can even opt in again for sites you trust that need the additional performance.

Re: Actively exploited sandbox RCE in all Chromium versions

#260

Post by noduerme »

thayne wrote: post #252
noduerme wrote: post #240

Earlier quoted context omitted.

Well, the implication (and I'm not saying this is right) is that to Google it's only worth $1k to have this brought to their attention by a white hat, versus finding out by exploitation. Which means that they have zero concern from this incident about reputational damage to themselves or their browser. That's pretty good circumstantial evidence of a monopolistic practice, when you can safely assume that there's effec…

But google is also a monopsony. There isn't anyone else the researcher can ethically sell it to. They just have to take whatever bounty google decides to pay.

I'm just saying it's more evidence that Google should be broken up.
Post reply on HN