Actively exploited sandbox RCE in all Chromium versions

Post by mark_l_watson » Sat, Sep 05, 2026, 12:28 PM UTC

varenc wrote: post #178

grishka wrote: post #138

Earlier quoted context omitted.

Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT. I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's e…

I disagree about JIT performance not mattering. I enabled "Lockdown Mode" on iOS which disables the JIT for the mentioned security reasons, and it causes a very noticeable lagginess on many sites. Of course, the primary cause is the unnecessary JS monstrosities wasting CPU cycles. But practically speaking I can say that disabling the JIT results in a very subpar experience of many JS heavy pages.

Post by grishka » Sat, Sep 05, 2026, 12:40 PM UTC

timr wrote: post #310

grishka wrote: post #288

Earlier quoted context omitted.

> One seemingly small change to a page (like setting innerText) can have many ripple effects with reflow on mamy parts of a page. I haven't looked into how browsers actually do it, but my mental model for it is that if something changes, this merely sets a flag on that element or its parent that its layout is not valid any more. Then, on next vsync, all the elements that have this flag set have their layout recalcula…

OP here. The steel-man argument for React is not that it is faster at rendering. It cannot be , because it ultimately relies on the same DOM that everyone else does to do the job, and it has to set up a massive JS data structure to do what it does, which uses a lot of memory and has big GC costs. Arguments that assert that the React virtual DOM are faster than the native/shadow DOM are simply wrong [1]. Even the Reac…

Post by IshKebab » Sat, Sep 05, 2026, 12:44 PM UTC

publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

Post by claiir » Sat, Sep 05, 2026, 12:45 PM UTC

Post by brookst » Sat, Sep 05, 2026, 12:56 PM UTC

noduerme wrote: post #260

thayne wrote: post #252

Earlier quoted context omitted.

But google is also a monopsony. There isn't anyone else the researcher can ethically sell it to. They just have to take whatever bounty google decides to pay.

I'm just saying it's more evidence that Google should be broken up.