Actively exploited sandbox RCE in all Chromium versions • Hacker News Board

Re: Actively exploited sandbox RCE in all Chromium versions

#361

Post by ruuda » Sat, Sep 05, 2026, 1:47 PM UTC

gib444 wrote: post #281

ruuda wrote: post #257

> Type confusion in V8 Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.

> Unfortunately, it breaks about 30% of the web Only 30%? In 2026? With CloudFlare and Anubis et al absolutely everywhere? Not to mention SPAs

Right, Anubis is a fair point, that has for sure been rising in recent months. Often when I get an Anubis page, I am reminded that I was doomscrolling and that I did not want to see the page that badly anyway, and I close the tab.

Re: Actively exploited sandbox RCE in all Chromium versions

#362

Post by heresie-dabord » Sat, Sep 05, 2026, 1:50 PM UTC

pizlonator wrote: post #146

publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs. That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it. (Posted from a memory safe browser - WebKit MiniBrowser compil…

> WebKit MiniBrowser compiled with Fil-C

Sir, do you happen to have instructions for doing this? We who benefit from your philanthropy salute you.

Re: Actively exploited sandbox RCE in all Chromium versions

#363

Post by Levitating » Sat, Sep 05, 2026, 1:52 PM UTC

christophilus wrote: post #318

Levitating wrote: post #272

Earlier quoted context omitted.

> We need simpler protocols and formats But we do! It doesn't get much simpler than HTML/CSS/JS. It's just abused to make apps instead of web documents.

Hm. HTML, maybe. CSS and JS? No way. View the CSS here sometime: https://a.singlediv.com/

That you can do complicated things with it does not make it complicated.

Re: Actively exploited sandbox RCE in all Chromium versions

#364

Post by heresie-dabord » Sat, Sep 05, 2026, 1:52 PM UTC

throwaway27448 wrote: post #327

phoghed wrote: post #321

Earlier quoted context omitted.

We have them, and have had them for a long time. Nobody wants to use them.

> Nobody wants to use them. Wikipedia is basically the most popular application of all time and it doesn't rely on javascript. People just generally don't give a shit about where their money goes.

> People just generally don't give a shit

The whole biosphere is over there in the corner, weeping.

Re: Actively exploited sandbox RCE in all Chromium versions

#365

Post by WarmWash » Sat, Sep 05, 2026, 1:53 PM UTC

nixon_why69 wrote: post #213

JoshTriplett wrote: post #193

Earlier quoted context omitted.

> We shouldn't look to the black market as cost discovery for these vulnerabilities We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.

That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google. A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".

Your conflating capitalism with markets.

Markets are fundamental things and exist regardless of any kind of moral "should". Otherwise we wouldn't have people buying hard drugs or trafficing women.

Re: Actively exploited sandbox RCE in all Chromium versions

#366

Post by nbk_2000 » Sat, Sep 05, 2026, 1:55 PM UTC

paulhebert wrote: post #202

tptacek wrote: post #161

Earlier quoted context omitted.

Not so much, the grey market is pretty well structured.

Is there anywhere I could read more about this? Sound very interesting!

The Grugq has done several interesting interviews/articles on the industry.

There's also a couple of Darknet Diaries episodes with similar interviews.

Re: Actively exploited sandbox RCE in all Chromium versions

#367

Post by mellowbadger70 » Sat, Sep 05, 2026, 1:55 PM UTC

[flagged]

Re: Actively exploited sandbox RCE in all Chromium versions

#368

Post by rvz » Sat, Sep 05, 2026, 1:56 PM UTC

odyssey7 wrote: post #347

pizlonator wrote: post #146

Earlier quoted context omitted.

I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs. That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it. (Posted from a memory safe browser - WebKit MiniBrowser compil…

When Chromium and V8 are written in a memory-safe language then I might believe this. Yes, if your JavaScript engine is written in C++, it’s going to be very hard to avoid very gross bugs. We have better options now. The ability of adversaries to find and exploit very gross bugs in C++ codebases should have already compelled the industry to move to memory safety. Now that AI has democratized the ability to scour C++…

Exactly this. This is a never ending problem with C/C++ and it's these same memory corruption CVEs appearing all the time.

I also cringe at projects that "compile C to WASM" and then believe that it is immediately "memory-safe". (It really is not.)

The only exception for C/C++ projects is Fil-C which that is memory-safe. New projects at this point should just consider using Rust instead.

Re: Actively exploited sandbox RCE in all Chromium versions

#369

Post by WarmWash » Sat, Sep 05, 2026, 1:57 PM UTC

ruszki wrote: post #355

xnx wrote: post #287

Earlier quoted context omitted.

How would you break up Google that would make browsers more secure?

Google should have been split up into shreds like 2 decades ago. Search wants to have income from ads? Good sell it to anybody who pays the most, just like every single newspaper does. Gmail wants to sell our data, or ad space? Good sell them, and not just reuse them internally. Chrome wants to monetize every single request you do? Go, sell them on the open market. And not this fake, "we're separate companies, but on…

Google is the answer to an Internet that largely blocks ads and uses backdoors to circumvent pay walls. A single massive pillar with enough surface area to carry all the dead weight.

If people want a better internet, they can start fostering one, rather than endlessly complain that someone else should be fostering it for them.

There will probably be upwards of 1000 people who read this comment that have used Google services for 15+ years, never loaded a single ad, and complain about Google ruining the internet. Please, pick-up a mirror. Nobody wants to build a competitor to serve your cheap ass

Re: Actively exploited sandbox RCE in all Chromium versions

#370

Post by Batman8675309 » Sat, Sep 05, 2026, 1:58 PM UTC

p-e-w wrote: post #31

lima wrote: post #22

Earlier quoted context omitted.

Which browser has a better security track record?

Firefox with uBlock Origin. It’s astonishing how many exploits uBO stops before they ever reach your browser engine. It’s the antivirus of the 2020s.

uBO stops exploits? Source?