Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

461–470 of 545 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#461

Post by stymaar »

strictnein wrote: post #86
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

If this would have included a full RCE chain with Sandbox escape Google would have paid significantly more. Having just a Sandbox RCE is neat, I've got some on my laptop currently, but it's just a piece of the puzzle.

That sounds like a dumb strategy because if non-evil people sit on individual pieces of the puzzle waiting to solve it in full google loses most of the advantage of having a multi-layer system…

Re: Actively exploited sandbox RCE in all Chromium versions

#462

Post by make3 »

codedokode wrote: post #127
ajkjk wrote: post #111

Earlier quoted context omitted.

we really do not want to engineer a system in which using bugs to make money is considered economically legitimate activity. It is still crime. The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier. The money is there to make is to incentivize the work of finding and reporting them -- not to outbid the bad actors.

"Crime" is very flexible term. One country's criminal is another country hero. Maybe the author would sell the vulnerability to an organization making exploits for government use. "Safety" is also a relative thing, when the world is safer for one party, it is usually worse for another.

Brain dead moral relativism argument. The question is whether eg. a group trying to scam elders out of insurance money or a Columbian cartel to hack local politicians to do blackmail, or South Sudan to hack Darfur or whatever, should be allowed to compete with the companies making products for their own exploits.

99.999% of people will agree that reducing software vulnerabilities is desirable if they're able to understand the question, including the bad actors themselves a lot of the times.

The situations like bad state actors are already not bound by laws, and things like keeping activism legal are better fought for through other ways

Re: Actively exploited sandbox RCE in all Chromium versions

#463

Post by 12_throw_away »

quotemstr wrote: post #457
ndriscoll wrote: post #447

Earlier quoted context omitted.

It would be absurd to jail someone for accurately describing a bug on their blog or whatever. Not so much for taking money from someone who the buyer should know has no reason to be interested in buying the information. And either you know who your counterparty is, in which case you know that they are using it nefariously, or you don't know who your counterparty is, in which case you know that they are using it nefar…

Has anyone actually been charged and convicted for disclosing knowledge of a vulnerability in exchange for money with no further collusion to commit a crime?

Hmm. Are you aware of any publicly identifiable security researchers that openly talk about selling their exploits on the black market?

Since it's all so legal and risk-free, you'd think selling an exploit for a million bucks would be quite the feather in their cap!

It may also be helpful to visualize being interviewed by the FBI and being asked "Did you sell this exploit? To whom? How much did you receive? For what purpose did you think it would be used?". And to remember they already know the answers to these questions, and lying to the FBI is also a crime.

Re: Actively exploited sandbox RCE in all Chromium versions

#464

Post by richdougherty »

Retr0id wrote: post #407
odyssey7 wrote: post #374

How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buff…

How do you write a performant memory-safe JS JIT?

You probably need a programming language more powerful than Rust that can encode and check the complicated invariants needed by the JIT.

There are classes of type system—"dependently-typed"—where you can encode arbitrary predicates into the type checking. I've remember seeing examples where they could prove arbitrary facts at the assembly level, including self-modifying code. Lean is such a language, currently very popular, but there are others.

Correctness of such programs depends on some basic assumptions about the CPU/memory environment, which should work absent hardware bugs like speculative execution or side channels. Although these could probably be encoded as well, and accounted for.

Without such a general proof language, you could probably make a special language to support JIT development, although its type system would be very complicated and the language itself could be a source of bugs.

Given such languages or proofs (maybe tractable now with AI-assisted theorem proving), you can actually make insanely performant code, since you don't really need to rely on other runtime protection so much (although maybe a good idea still).

Re: Actively exploited sandbox RCE in all Chromium versions

#465

Post by strenholme »

tkot wrote: post #424
strenholme wrote: post #167

Earlier quoted context omitted.

There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.

Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?

It looks like more of Firefox has been ported over to Rust since then:

https://www.wilderssecurity.com/threads/security-chromium-ve...

The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase.

It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3]

[1] Djbdns was around back then but wasn’t open source, which limited its adoption.

[2] https://lwn.net/2001/0208/

[2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.

Re: Actively exploited sandbox RCE in all Chromium versions

#466

Post by ok123456 »

iknowstuff wrote: post #437
jameshart wrote: post #412

Earlier quoted context omitted.

The black market also prices in a risk premium for ‘this is illegal and you could go to jail for selling me this’. Google is only paying for the vulnerability; the exploit market is also paying for your mortal soul.

I'm surprised that selling knowledge is illegal? Is it really? Maybe it shouldn't be

Ask Stephen Huntley Watt.

Re: Actively exploited sandbox RCE in all Chromium versions

#467

Post by TZubiri »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

>Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment

Why not?

"Hey, I found a cvss 8.8 bug in chrome that allows arbitrary code execution when loading my http url. For X USD I can send a report along, and for Y USD I can send a commit with the fix."

Sounds like a basic contract to me

What I do think is ethically dubious is:

"Hey I found this bug and I will MAKE IT PUBLIC WITHIN 90 DAYS SO LOOK AT IT"

I know it's a convention from 'security researchers', but I think the first approach is more ethical than the latter.

Re: Actively exploited sandbox RCE in all Chromium versions

#468

Post by grishka »

DANmode wrote: post #382
grishka wrote: post #291

Earlier quoted context omitted.

I wouldn't consider that an SPA at all, it's just a page with an interactive element. An SPA is something that renders everything client-side and uses a generic client API to talk to the backend. A telltale sign of an SPA is that the first thing you see when you open it is some sort of loading indicator instead of the actual page you're visiting.

No, the telltale sign of a SPA is that it’s an app that’s a single fucking page, lol Please stop changing the definitions of explicit words and phrases - to anyone reading this!

By that definition, Smithereen, my fediverse server software, is also an SPA, since it does what I call "ajax navigation" on desktop, so that the notifications websocket doesn't get disconnected and reconnected every time you click a link. It's technically a single page that gets most of its content replaced at runtime when you click a link, after all, right?

Re: Actively exploited sandbox RCE in all Chromium versions

#469

Post by quotemstr »

12_throw_away wrote: post #463
quotemstr wrote: post #457

Earlier quoted context omitted.

Has anyone actually been charged and convicted for disclosing knowledge of a vulnerability in exchange for money with no further collusion to commit a crime?

Hmm. Are you aware of any publicly identifiable security researchers that openly talk about selling their exploits on the black market? Since it's all so legal and risk-free, you'd think selling an exploit for a million bucks would be quite the feather in their cap! It may also be helpful to visualize being interviewed by the FBI and being asked "Did you sell this exploit? To whom? How much did you receive? For what…

My question stands.

Re: Actively exploited sandbox RCE in all Chromium versions

#470

Post by kccqzy »

kllrnohj wrote: post #359
Gabrys1 wrote: post #276

Earlier quoted context omitted.

Knowing the vulnerability, creating an exploit might be relatively easy now that we have AI to figure the boring stuff out.

This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with

Right and in recent memory Google actually awarded a renderer sandbox escape with $250k [0]. Now you can see actually how serious this is.

[0]: https://news.ycombinator.com/item?id=44861106

Post reply on HN