Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

391–400 of 527 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#391

Earlier quoted context omitted.

In fairness, in the early 2000s they were probably right. Early browser security model was a bit of a mess. The fact that this article is even talked about is a sign of how much better things are.

Plus add in Flash and Java applets.

And ActiveX!

Re: Actively exploited sandbox RCE in all Chromium versions

#393

Earlier quoted context omitted.

[flagged]

The idea here is that uBlock filters the domains that may serve the malware in the first place. It basically works the same as a DNS filter.

You should be using a DNS filter ideally so it never hits the device in the first place. Adding an extension only increases browser attack surface.

Re: Actively exploited sandbox RCE in all Chromium versions

#394
post #245

Earlier quoted context omitted.

The idea here is that uBlock filters the domains that may serve the malware in the first place. It basically works the same as a DNS filter.

Which you can also easily do with uBlock Origin Lite in Chrome/Chromium.

People pretend like uBoL doesn’t work at all

Re: Actively exploited sandbox RCE in all Chromium versions

#395

Earlier quoted context omitted.

[flagged]

I'm willing to believe that stock chrome has a better record than stock Firefox, but > and on top of it you’re recommending an extension as a security measure ... Yes? Why can a browser extension not be a security measure/improvement?

Because extensions especially MV2 ones only increase attack surface.

Re: Actively exploited sandbox RCE in all Chromium versions

#397

How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buff…

There's more to it than just using a memory safe language.

Re: Actively exploited sandbox RCE in all Chromium versions

#399
Google has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable.

Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.

Re: Actively exploited sandbox RCE in all Chromium versions

#400

How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buff…

Type confusion bugs exist in Rust programs too, the language does not eliminate all such issues (though it does help somewhat). I think it would be more prudent to wait until we have details before getting on the soapbox.
Post reply on HN