Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

401–410 of 527 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#401

Post by [deleted] »

WarmWash wrote: post #369
ruszki wrote: post #355

Earlier quoted context omitted.

Google should have been split up into shreds like 2 decades ago. Search wants to have income from ads? Good sell it to anybody who pays the most, just like every single newspaper does. Gmail wants to sell our data, or ad space? Good sell them, and not just reuse them internally. Chrome wants to monetize every single request you do? Go, sell them on the open market. And not this fake, "we're separate companies, but on…

Google is the answer to an Internet that largely blocks ads and uses backdoors to circumvent pay walls. A single massive pillar with enough surface area to carry all the dead weight. If people want a better internet, they can start fostering one, rather than endlessly complain that someone else should be fostering it for them. There will probably be upwards of 1000 people who read this comment that have used Google s…

[deleted]

Re: Actively exploited sandbox RCE in all Chromium versions

#402

Post by nixon_why69 »

WarmWash wrote: post #365
nixon_why69 wrote: post #213

Earlier quoted context omitted.

That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google. A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".

Your conflating capitalism with markets. Markets are fundamental things and exist regardless of any kind of moral "should". Otherwise we wouldn't have people buying hard drugs or trafficing women.

If we abandon the moral "should", then the right move is to shake down Google along the lines I already said.

Google should, as a rational actor, pay out better for legitimate vulnerabilities that pose actual risk to them to avoid such a situation.

My beef here is that morality and ethics are only assigned to the researchers.

Re: Actively exploited sandbox RCE in all Chromium versions

#404

Post by mccr8 »

esseph wrote: post #29
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

The problem is they are being flooded with both fake AND real disclosures. Imagine if they tried to pay out $250,000 or more per bug? Would the cost be worth it? Maybe, but shareholders may not be pleased... Unless they viewed it as insurance against it being more financially sound for the finder to sell the exploit on the gray or black market instead...

In fact, Google will pay you $250,000 for a full chain exploit. The CVE reported here is a renderer process vulnerability. Google used to pay more for those before the vulnpocalypse. Now, they are fixing hundreds of bugs per week that they find themselves.

https://bughunters.google.com/about/rules/chrome-friends/chr...

Re: Actively exploited sandbox RCE in all Chromium versions

#405

Post by bethekidyouwant »

fguerraz wrote: post #377
kllrnohj wrote: post #359

Earlier quoted context omitted.

This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with

If it’s being exploited “in the wild”, it means someone has already found how to chain it, otherwise what would be the point?

Right but this actually hasn’t happened…

Re: Actively exploited sandbox RCE in all Chromium versions

#406

Post by mccr8 »

odyssey7 wrote: post #374

How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buff…

JIT bugs like this are not easily solved simply by writing a browser in a typesafe language.

Here's the commit that fixes this issue: https://chromium.googlesource.com/v8/v8/+/e0562d87ad9c17042b...

Re: Actively exploited sandbox RCE in all Chromium versions

#407

Post by Retr0id »

odyssey7 wrote: post #374

How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buff…

How do you write a performant memory-safe JS JIT?

Re: Actively exploited sandbox RCE in all Chromium versions

#408

Post by mccr8 »

keel-control wrote: post #399

Google has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable. Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.

Writing Chromium entirely in Rust wouldn't prevent a JIT bug like this.

Re: Actively exploited sandbox RCE in all Chromium versions

#409

Post by bethekidyouwant »

r_lee wrote: post #68
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

this is why again, researchers should just honestly sell these to vuln brokers instead of donating them to trillion dollar companies for nothing. nothing will change until big tech can no longer rip off security researchers

Who is to say they didn’t already do that?

Re: Actively exploited sandbox RCE in all Chromium versions

#410

Post by killerstorm »

razemio wrote: post #278
dingdong2026 wrote: post #275

Earlier quoted context omitted.

My thought exactly. Which is why I have NoScript in my Firefox and have gotten used to manually enabling javascript for select pages. Small price to pay. Unfortunately the web is full of trivial websites that have no business running javascript. Recently wanted to read the famed post on Gates Notes. But for some reason Bill requires javascript to render text and images. Which reminded me Bill is not a person with goo…

Wow... I understand your point but if you feel that strong about gates using js on his personal website, it is a bit harsh isn't it? Could have multiple reasons why it is needed. Especially for someone with such a huge follower base. Lazy loading, tracking, client based adjustments, using a framework, fun [:)]... I could go on with a 100 more points why js might be needed.

I don't think there's any valid reason to _require_ JS on a static web site unless interactivity is the whole point.
Post reply on HN