Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

501–510 of 535 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#501

Post by bawolff »

Batman8675309 wrote: post #370
p-e-w wrote: post #31

Earlier quoted context omitted.

Firefox with uBlock Origin. It’s astonishing how many exploits uBO stops before they ever reach your browser engine. It’s the antivirus of the 2020s.

uBO stops exploits? Source?

malvertising is really a method of delivering exploits, but there is no reason to think its relavent to this situation.

For non technical users, scam adverts are probably the biggest threat.

So i agree ubo is an important security technology, but its probably irrelavent to the topic at hand.

Re: Actively exploited sandbox RCE in all Chromium versions

#502

Post by sans_souse »

Eridrus wrote: post #448
hnav wrote: post #428

What do CVEs like this one mean for the likes of fly.io and cloudflare who use V8 for sandboxing 3p workloads? I guess they have some degree of KYC and some hardening outside the sandbox, but chaining this with a container escape running under a free tier account could pwn the host.

You can just ask ChatGPT these questions these days, but it was a fun read: fly.io depends on Firecracker microVMs, so you should be concerned if you're running untrusted code, but not concerned about other people interacting with you wrt v8. Cloudflare depends on v8 isolates, which depend on the trustworthiness of the v8 sandbox, which is a non-trivial hurdle, but not an insurmountable one for attackers with the res…

> just ask ChatGPT these questions these days, but it was a fun read

I'd prefer they ask here. Just saying.

Re: Actively exploited sandbox RCE in all Chromium versions

#503

Post by drewfax »

anon109 wrote: post #9
Cider9986 wrote: post #4

Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.

Is graphene even affected? JIT is disabled in default configurations.

That's how the system or browser should be configured. Secure by default and any insecurity must be an opt-in. But Google won't do it because their websites are JS heavy monster trucks and millions of websites run their tracking scripts which require JIT enabled by default for optimal page load.

Re: Actively exploited sandbox RCE in all Chromium versions

#504

Post by lima »

nikanj wrote: post #417
mikeweiss wrote: post #183

Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?

Doesn’t any tag let you run arbitrary code inside a sandbox anyway?

Inside the JS sandbox, not the browser's outer containment sandbox.

Re: Actively exploited sandbox RCE in all Chromium versions

#505

Post by acchow »

kccqzy wrote: post #471
preg_match wrote: post #433

Earlier quoted context omitted.

The additional performance from the JIT is actually really small for most tasks. It should, ideally, be disabled by default. For your average JS you get It’s only very heavy calculations that see a boost in performance. But, realistically, how many websites require this or currently use this today? This is pretty typical across JIT engines, too. PHP also sees only a slight increase in performance from the JIT. Becaus…

I’ve done that long ago. In fact on iOS it’s simpler: since Apple doesn’t allow third party browsers to use the JIT, using any browser other than Safari will disable the JIT.

Chrome on iOS has always been JIT'd because it used a WKWebView.

It still uses a WKWebView today, even in the EU, despite Apple now allowing alternative browser engines in the EU as of 2 years ago.

I'm sure Chrome will eventually ship Blink+V8 in the EU. It will take some time

Re: Actively exploited sandbox RCE in all Chromium versions

#506

Post by aka-rider »

WarmWash wrote: post #369
ruszki wrote: post #355

Earlier quoted context omitted.

Google should have been split up into shreds like 2 decades ago. Search wants to have income from ads? Good sell it to anybody who pays the most, just like every single newspaper does. Gmail wants to sell our data, or ad space? Good sell them, and not just reuse them internally. Chrome wants to monetize every single request you do? Go, sell them on the open market. And not this fake, "we're separate companies, but on…

Google is the answer to an Internet that largely blocks ads and uses backdoors to circumvent pay walls. A single massive pillar with enough surface area to carry all the dead weight. If people want a better internet, they can start fostering one, rather than endlessly complain that someone else should be fostering it for them. There will probably be upwards of 1000 people who read this comment that have used Google s…

Google is routinely buying and destroying competitors. They lower prices to kill competition en-masse. They promote their own products in search and elsewhere over paid ads.

Search Engine have chicken and egg problem, you can only have a good search if enough people use it to tune the ranking and see enough search spam cases.

“Just compete with a monopoly on their own field with one hand tied behind”

Re: Actively exploited sandbox RCE in all Chromium versions

#507

Post by r_lee »

bethekidyouwant wrote: post #459
r_lee wrote: post #419

Earlier quoted context omitted.

you're not allowed to burn exploits like that if you've signed a deal, and who would risk that for $1k? of course it could be a colleague or someone with access to such tools

“You are not allowed to do things” - lol

I forgot HN doesn't believe in contracts. sorry.

from what I remember, they also don't pay it all out at once but rather over time where the payments stop if the bug gets patched.

I don't understand why you're being so cocky here? this is how many 0 click exploits are sourced

Re: Actively exploited sandbox RCE in all Chromium versions

#508

Post by antonvs »

Levitating wrote: post #272
robalni wrote: post #264

Earlier quoted context omitted.

That's basically the comment I was just going to write but you made me not need to. We need simpler protocols and formats, especially those that are used over the internet. I want everyone to really start fighting for this. I always use a browser that doesn't run any scripts (w3m) for both this reason and others. It hurts when I see websites that don't work without js. A bit funny though that this page is one of them…

> We need simpler protocols and formats But we do! It doesn't get much simpler than HTML/CSS/JS. It's just abused to make apps instead of web documents.

There is no possible interpretation under which JS fits “simpler protocols and formats,” and no world in which JS could form part of a truly secure network client environment.

Re: Actively exploited sandbox RCE in all Chromium versions

#509

Post by r_lee »

anonymars wrote: post #478
kllrnohj wrote: post #359

Earlier quoted context omitted.

This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with

I'm curious now, how is it being actively exploited? Unless there is already some other exploit with which it's currently being chained?

there are many vulns that are sitting idle waiting to be chained like this. plus in some cases adjacent bugs can be found once you find a bug like this.

Re: Actively exploited sandbox RCE in all Chromium versions

#510

Post by r_lee »

bethekidyouwant wrote: post #405
fguerraz wrote: post #377

Earlier quoted context omitted.

If it’s being exploited “in the wild”, it means someone has already found how to chain it, otherwise what would be the point?

Right but this actually hasn’t happened…

"Google is aware that an exploit for CVE-2026-85046 exists in the wild."
Post reply on HN