Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

291–300 of 528 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#291

Post by grishka »

dvdkon wrote: post #282
grishka wrote: post #198

Earlier quoted context omitted.

At this point SPA pretty much implies React. But even if you optimize everything the best you could and avoid any third-party runtime dependencies, it's still going to be significantly more work to make API requests and do client-side rendering vs just rendering HTML server-side.

Not always. Consider an SPA that connects via WebSockets and streams in data, adding points to a chart. The JS-less alternative would be refreshing an SVG or even the whole page once a second. The SPA is clearly more efficient here (unless someone screws it up badly).

I wouldn't consider that an SPA at all, it's just a page with an interactive element. An SPA is something that renders everything client-side and uses a generic client API to talk to the backend. A telltale sign of an SPA is that the first thing you see when you open it is some sort of loading indicator instead of the actual page you're visiting.

Re: Actively exploited sandbox RCE in all Chromium versions

#292

Post by terseus »

ruuda wrote: post #257

> Type confusion in V8 Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.

> Unfortunately, it breaks about 30% of the web.

More like 99%

I use Firefox with Noscript and I'm _totally aware_ that almost no website works without allowing it JS.

Even using Noscript it's becoming more and more exhausting every year, it's plain impossible to browse the internet without JS at all.

Re: Actively exploited sandbox RCE in all Chromium versions

#293

Post by necovek »

ajkjk wrote: post #111
quotemstr wrote: post #45

Earlier quoted context omitted.

You let the market decide. Google could purchase the bugs on the same market blackhats do.

we really do not want to engineer a system in which using bugs to make money is considered economically legitimate activity. It is still crime. The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier. The money is there to make is to incentivize the work of finding and reporting them -- not to outbid the bad actors.

I would say that maintaining legacy systems as a software engineer is effectively "using bugs to make money" and very much an "economically legitimate activity".

If old systems had no bugs/issues, companies could do without the maintenance burden altogether (which includes even systems not being evolved/extended).

Re: Actively exploited sandbox RCE in all Chromium versions

#294

Post by rectang »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

The potential damage is all to users bound by terms and conditions, who are unlikely to collect damages successfully from a vendor. Structurally, vendors don’t have to care. Therefore, vulnerabilities have little direct financial value to a vendor.

It’s natural to feel cognitive dissonance because the value to the vendor is so disproportionate to the potential harm to users, but the incentive structure is what it is.

A vulnerability which lets an attacker harm the vendor has much higher direct financial value.

Re: Actively exploited sandbox RCE in all Chromium versions

#295

Post by oynqr »

pizlonator wrote: post #149
basilikum wrote: post #74

For what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?

There's a risk that someone had been sitting on a sandbox escape that assumed having RCE inside the sandbox first, and so they'd been waiting for an RCE exactly like this one. Those folks would not be disclosing their sandbox escape unless they were good guys. (Posted with a memory safe WebKit, Fil-C FTW)

You should add a disclaimer that you are the CEO of Fil-C. /s

In the context of this vulnerability, I doubt memory safety would have made much of a difference.

This is a great reminder though, currently doing a full userspace replacement on my 3D printer and Fil-C might be just what I need for the irreplaceable C parts.

Re: Actively exploited sandbox RCE in all Chromium versions

#297

Post by soiax »

malinono wrote: post #296

Sandbox RCE again. Every "it's sandboxed so it's safe" pitch really means "we hope the sandbox holds." Not a security model, just a sentence.

The title is bad, it is not sandbox escape, it is "RCE inside the sandbox", so only RCE when sandbox is disabled.

Re: Actively exploited sandbox RCE in all Chromium versions

#298

Post by [deleted] »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

[deleted]

Re: Actively exploited sandbox RCE in all Chromium versions

#299

Post by noja »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

> how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

What? That's not how you calculate the value of something at all.

The value is not based on the prevention, it's the cost of the cure.

Re: Actively exploited sandbox RCE in all Chromium versions

#300

Post by dijit »

razemio wrote: post #278
dingdong2026 wrote: post #275

Earlier quoted context omitted.

My thought exactly. Which is why I have NoScript in my Firefox and have gotten used to manually enabling javascript for select pages. Small price to pay. Unfortunately the web is full of trivial websites that have no business running javascript. Recently wanted to read the famed post on Gates Notes. But for some reason Bill requires javascript to render text and images. Which reminded me Bill is not a person with goo…

Wow... I understand your point but if you feel that strong about gates using js on his personal website, it is a bit harsh isn't it? Could have multiple reasons why it is needed. Especially for someone with such a huge follower base. Lazy loading, tracking, client based adjustments, using a framework, fun [:)]... I could go on with a 100 more points why js might be needed.

I know that this is sarcasm, but there are people who really think this.

They get emotional (usually angry) when you tell them you disable javascript- as if every site that serves any kind of content has an automatic entitlement to run arbitrary code on your computer.

Post reply on HN