New Chrome Zero-Day

#1

Post by bsaunder » Thu, Nov 07, 2019, 9:53 PM UTC

New Chrome Zero-Day
kaspersky.com

Re: New Chrome Zero-Day

#2

Post by maerF0x0 » Thu, Nov 07, 2019, 9:59 PM UTC

I would suggest we put the date in these kind of 0 day titles. Nov 4 in this case...

Re: New Chrome Zero-Day

#3

Post by maxmcd » Thu, Nov 07, 2019, 10:17 PM UTC

Previous discussion: https://news.ycombinator.com/item?id=21425804

Re: New Chrome Zero-Day

#4

Post by 0xdeadb00f » Thu, Nov 07, 2019, 10:19 PM UTC

I'm assuming this doesn't affect Chromium, or Chromium(-based) browsers on Android then? Seeing as it isn't mentioned.

Re: New Chrome Zero-Day

#5

Post by NikolaeVarius » Thu, Nov 07, 2019, 10:23 PM UTC

Was already patched on Oct 31 https://chromereleases.googleblog.com/2019/10/stable-channel...

Re: New Chrome Zero-Day

#6

Post by andrewstuart » Thu, Nov 07, 2019, 10:29 PM UTC

Why would cybercriminals not just report the bug and pick up the cash from Google? Is it genuinely that much more lucrative to exploit it?

Re: New Chrome Zero-Day

#7

Post by mark-r » Thu, Nov 07, 2019, 10:31 PM UTC

0xdeadb00f wrote: post #4

I'm assuming this doesn't affect Chromium, or Chromium(-based) browsers on Android then? Seeing as it isn't mentioned.

The article specifically mentions that it was discovered on Windows, but that doesn't mean some variation couldn't exist for other platforms.

Re: New Chrome Zero-Day

#8

Post by imposterr » Thu, Nov 07, 2019, 10:32 PM UTC

andrewstuart wrote: post #6

Why would cybercriminals not just report the bug and pick up the cash from Google? Is it genuinely that much more lucrative to exploit it?

You can only sell to Google once. You can sell it to different exploit houses many times.

But also historically, some places pay in the several hundred thousand compared to tech companies that pay in the tens of thousands. So even if they only sell it once, they can make more.

Re: New Chrome Zero-Day

#9

Post by wnevets » Thu, Nov 07, 2019, 10:35 PM UTC

andrewstuart wrote: post #6

Why would cybercriminals not just report the bug and pick up the cash from Google? Is it genuinely that much more lucrative to exploit it?

>Why would cybercriminals not just report the bug and pick up the cash from Google?

Probably because they're not the ones actually finding the bugs.

Re: New Chrome Zero-Day

#10

Post by 0xdeadb00f » Thu, Nov 07, 2019, 10:39 PM UTC

mark-r wrote: post #7

0xdeadb00f wrote: post #4

I'm assuming this doesn't affect Chromium, or Chromium(-based) browsers on Android then? Seeing as it isn't mentioned.

The article specifically mentions that it was discovered on Windows, but that doesn't mean some variation couldn't exist for other platforms.

I meant more along the lines of: is this a Chrome specific vulnerability or is the vuln apparent in Chromium and thus are all Chromium-based browsers (on any platform) affected?