Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

441–450 of 540 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#441

Post by AustinDev »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

No company will ever value your privacy or security more than or equal to how much you value them. This is why you gotta keep an unencrypted bitcoin private key in your password manager. I'll know pretty quickly (within ~ 10 minutes or less) that someone has access to all of my passwords.

Re: Actively exploited sandbox RCE in all Chromium versions

#442

Post by toast0 »

flatline wrote: post #383
tptacek wrote: post #92

Earlier quoted context omitted.

If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…

Isn’t the implication that the vulnerability had already been found and exploited instead of reported to Google, because its value to Google was so low? Whoever found it originally had more incentive to sell it on the grey/black market. Or is the incentive structure truly different for vulnerabilities discovered to be already in the wild?

Surely google has telemetry when their sandbox is escaped? (Only mostly /s)

Re: Actively exploited sandbox RCE in all Chromium versions

#445

Post by vhiremath4 »

It seems like the Chromium issue on their bugboard, which presumably would have the example HTML and vuln patch, is blocked from being viewed. Is this because making it public increases the risk of exploitation?

https://issues.chromium.org/issues/542403045

Re: Actively exploited sandbox RCE in all Chromium versions

#446

Post by rglover »

vlovich123 wrote: post #387
rglover wrote: post #315

Earlier quoted context omitted.

It's a simple multiplier number and you can set a cap on it (and payout amounts). Where's the fire?

CVEs are handed out like candy for non issues, the severity rating system isn’t a serious evaluation of the actual severity (eg a vulnerable function may not even be compiled in), the scoring is inconsistent and subjective and frequently inflated to make the severity seem worse, and with the AI flood they have a massive backlog of handing out CVEs. Like look at CVEs curl dealt with at one point that were just complet…

> But honestly if you’re the one proposing a “simple solution” maybe do some research yourself.

It's an off the cuff idea on a nerd forum. Relax buddy.

Re: Actively exploited sandbox RCE in all Chromium versions

#447

Post by ndriscoll »

quotemstr wrote: post #130
ajkjk wrote: post #112

Earlier quoted context omitted.

"Aiding and Abetting" crime is also a crime. Free speech has nothing to do with it.

Has anyone actually been convicted of abetting a crime by selling a vulnerability, by itself, not conspiring with the buyer to commit a crime using said vulnerability? Not as far as I can see. It would be absurd to jail someone for accurately describing a bug.

It would be absurd to jail someone for accurately describing a bug on their blog or whatever.

Not so much for taking money from someone who the buyer should know has no reason to be interested in buying the information. And either you know who your counterparty is, in which case you know that they are using it nefariously, or you don't know who your counterparty is, in which case you know that they are using it nefariously. Any court and any jury should see straight through this.

Similarly if you figure out how to get the ATM down the street to give you free money, and you "accurately describe the bug" to people who pay you, and they use it to steal money from the ATM, expect to be charged for participating in, and in fact being an instrumental enabler of their crime. Because it is beyond all reasonable doubt that you could've believed they could have been interested enough to pay you for any other reason.

Re: Actively exploited sandbox RCE in all Chromium versions

#448

Post by Eridrus »

hnav wrote: post #428

What do CVEs like this one mean for the likes of fly.io and cloudflare who use V8 for sandboxing 3p workloads? I guess they have some degree of KYC and some hardening outside the sandbox, but chaining this with a container escape running under a free tier account could pwn the host.

You can just ask ChatGPT these questions these days, but it was a fun read:

fly.io depends on Firecracker microVMs, so you should be concerned if you're running untrusted code, but not concerned about other people interacting with you wrt v8.

Cloudflare depends on v8 isolates, which depend on the trustworthiness of the v8 sandbox, which is a non-trivial hurdle, but not an insurmountable one for attackers with the resources to have a v8 bug in the first place.

Re: Actively exploited sandbox RCE in all Chromium versions

#449

Post by DANmode »

preg_match wrote: post #436
DANmode wrote: post #382

Earlier quoted context omitted.

No, the telltale sign of a SPA is that it’s an app that’s a single fucking page, lol Please stop changing the definitions of explicit words and phrases - to anyone reading this!

Right but the implication of a SPA is that it’s an application which has many logical pages, but only one real page. The logical pages are constructed by dynamically updating the DOM using JavaScript. As opposed to navigating to a new, server-provided page. For example, a search function. For a MPA, each search query would be a new page. For a SPA, each query is a new logical page, served on the same real page. Techn…

> it’s just a site

sigh

…does someone else want to finish this up?

Re: Actively exploited sandbox RCE in all Chromium versions

#450

Post by DANmode »

realusername wrote: post #271
DANmode wrote: post #181

Earlier quoted context omitted.

> SPAs will be slow no matter what. Uh…no? You’re presumably talking about specific terrible prebuilt frameworks - not someone building a nice vanilla SPA.

I've never seen an SPA which scales properly and doesn't become a bloated mess, maybe that's possible but it's definitely harder to make it work than using traditional server side template rendering

Plenty of app usecases don’t need to “scale” - immediately or ever!
Post reply on HN