Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day CSS: CVE-2026-2441 exists in the wild

chromereleases.googleblog.com

Post reply on HN
Print view View original

121–130 of 242 posts

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#121

Post by streetfighter64 »

chc4 wrote: post #84
duozerk wrote: post #32

Earlier quoted context omitted.

I read this often, and I guess it could be true, but those kinds of transaction would presumably go through DNM / forums like BF and the like. Which means crypto, and full anonymity. So either the buyer trusts the seller to deliver, or the seller trusts the buyer to pay. And once you reveal the particulars of a flaw, nothing prevents the buyer from running away (this actually also occurs regularly on legal, genuine b…

I don't think you know anything about how these industries work and should probably read some of the published books about them, like "This Is How They Tell Me The World Ends", instead of speculating in a way that will mislead people. Most purchasers of browser exploits are nation-state groups ("gray market") who are heavily incentivized not to screw the seller and would just wire some money directly, not black marke…

I mean, you're still restricted to selling it to your own government, otherwise getting wired a cool $250k directly would raise a few red flags I think. And how many security researchers have a contact in some government-sponsored hacking company anyway? Do you really think that convincing them to buy a supposed zero-day exploit as a one-off would be easy?

Say you're in the US. I'm sure there are some CIA teams or whatever making use of Chromium exploits "off the record", but for any official business the government would just put pressure on Google directly to get what they want. So any project making use of your zero-day would be so secret that it'd be virtually impossible for you to even get in contact with anybody interested to buy it. Sure they might not try to "screw you", but it's sort of like going to the CIA and saying, "Hey would you be interested in buying this cache of illegal guns? Perhaps you could use it to arm Cuban rebels". What do you think they would respond to that?

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#122

Post by waynesonfire »

pear01 wrote: post #49
waynesonfire wrote: post #16

Earlier quoted context omitted.

It was intended as a joke reference to the 2004 Kerry / Bush debate. It's not a coincidence that Google would leave off an ad-blocking variant of Chrome.

did you also take poland being omitted to be some sort of conspiracy? seems you missed the point of why that "Actually, you forgot..." moment became such a punchline. Like it or not Brave is a very niche browser with rather insignificant market share why you would expect them to be mentioned in the first place is entirely lost on me. there are dozens of chromium forks also with under 1% market share, should we be for…

It semeed to me like an obvious telegraph of bias.

I understand the meme very well. What made the Poland meme was that Poland's membership in the coalition was irrelevant to the "grand coalition" narrative--Kerry's omission of Poland is therefore in the same vein as Google's.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#123

Post by DiggyJohnson »

idiotsecant wrote: post #96
throwaway150 wrote: post #70

Earlier quoted context omitted.

So is there anything that would actually satisfy crowd here? Offer $25K and it is "How dare a trillion dollar company pay so little?" Offer $250K and it is "Hmm. Exception! Must be marketing!" What precisely is an acceptable number?

A number better than what the exploit could be sold for on the black market

You can work your day job and make $20-500k/yr or pursue drug dealing and make $5-5000k/yr. I don’t think that’s actually a compelling argument for the latter even if the opportunity cost is better.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#124

Post by hsbauauvhabzb »

DiggyJohnson wrote: post #123
idiotsecant wrote: post #96

Earlier quoted context omitted.

A number better than what the exploit could be sold for on the black market

You can work your day job and make $20-500k/yr or pursue drug dealing and make $5-5000k/yr. I don’t think that’s actually a compelling argument for the latter even if the opportunity cost is better.

Drugs are illegal, exploits are not illegal. Selling them to someone associated with illegal activity is probably illegal, but there is a legitimate fully legal exploit market with buyers like intelligence agencies, and an illegal market with buyers that run oppressive regimes and commit genocide.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#125

Post by hsbauauvhabzb »

i_am_jl wrote: post #102
idiotsecant wrote: post #96

Earlier quoted context omitted.

A number better than what the exploit could be sold for on the black market

I don't believe those numbers will ever come close to converging, let alone bounty prices surpassing black market prices. It seems like these vulnerabilities will always be more valuable to people who can guarantee that their use will generate a return than to people who will use them to prevent a theoretical loss. Beyond that, selling zero-days is a seller's market where sellers can set prices and court many buyers,…

The market is priced at the point that the most economic for the business. Apple buying an exploit for $100m is not worth it (to apple) vs the potential loss of life of people who might be killed if sold on the black market. Buying an exploit for 1m prevents them being used to jailbreak, is good PR, and is ass covering PR insurance in case an Apple exploit cause loss of life (‘the seller could have sold to us, but instead they sold it to an evil corporation’).

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#126

Post by DiggyJohnson »

autoexec wrote: post #116
linkregister wrote: post #108

Earlier quoted context omitted.

What would be an acceptable revenue model? Google Chrome has the same privacy profile with the exception that Google retains the data for their own ad platforms. Selling preferential search access is legally precarious due to FTC's lawsuit against Mozilla.

> What would be an acceptable revenue model? They could start with the one they've refused for ages even though many have asked for it. Let people directly donate to fund the development of firefox (as opposed to just giving mozilla money to funnel into any number of their other projects). They could even make money selling merch if they didn't tank the brand. Firefox could have a very nice niche to fill as a privacy…

Well said. Do you know of any recent reports or if anyone has actually gone through the funding calculations regarding the funding model you described (let’s call it “FF-direct”) versus Mozilla’s status quo funding model?

Primary questions are: How much does FF cost to sustain? How much is spent on new performance, functionality and feature development? What number does Firefox need to compete directly with Chrome? If you asked an experienced FF project contributor what is the delta between the previous two questions?

- a 20+ year Firefox power user very familiar with the FF project, web browsers, and how they compete

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#127

Post by vsgherzi »

pheggs wrote: post #119
vsgherzi wrote: post #117

Earlier quoted context omitted.

But the thing is these DO get exploited in the wild we see that again and again in high value targets like operating systems. That's why apple and google go to such high extremes to work in things like bounds checking. ROP JOB chains have gotten good and LLMS are even able to help these days (if you have the bankroll) It's a culture problem and I still have hope we can change that. My big hope is that as more big pla…

> But the thing is these DO get exploited in the wild we see that again and again in high value targets like operating systems. Yes but so do supply chain attacks. I mean we both know there's never a way to be absolutely secure and it's all just about probability. The question is how to determine what product may have better chances. All I am saying is that I personally prioritize fewer dependencies over memory safet…

right but these differ drastically, one is writing perfect code which is quite difficult the other is opting not to take a dependency. One is much more realistic.

I agree on software quality going down, I'm looking very closely at foundational software being written in rust (mostly in the kernel) and it seems to be okay for now.

The other hope is that maybe one day rust will get a fatter standard lib. I understand the opposition to this but I really want a series of crates tied strongly to the ecosystem and funded and audited by the foundation. I think this is the way they were going with offering the foundation maintainer fund.

Personally I'm thinking about moving my career into embedded to escape the massive dependencies and learn more about how computers really work without all the slop on top.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#128

Post by idiotsecant »

gbalduzzi wrote: post #114
i_am_jl wrote: post #102

Earlier quoted context omitted.

I don't believe those numbers will ever come close to converging, let alone bounty prices surpassing black market prices. It seems like these vulnerabilities will always be more valuable to people who can guarantee that their use will generate a return than to people who will use them to prevent a theoretical loss. Beyond that, selling zero-days is a seller's market where sellers can set prices and court many buyers,…

> So why would anyone ever take a bounty instead of selling on the black market? Risk! I like to believe there are also ethics involved in most cases

Systems that rely on ethical behaviour to function generally dont last long

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#129

Post by jacquesm »

LunaSea wrote: post #103
jacquesm wrote: post #93

Earlier quoted context omitted.

HN wants Firefox but with better stewardship and fewer misdirected funds. Mozilla - wrongly - believes that the majority of FF users believe in Mozilla's hobby projects rather than that they care about their browser. That's why - as far as I know - to this day it is impossible to directly fund Firefox. They'd rather take money from google than to be focusing on the one thing that matters.

I don't think that Mozilla believes that their pet projects are what the use community wants. I think they just don't care. Google's check will clear next year anyways.

That's probably true.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#130

Post by bri3d »

clucas wrote: post #109
duozerk wrote: post #17

Earlier quoted context omitted.

> That's pretty bad! I wonder what kind of bounty went to the researcher. I'd be surprised if it's above 20K$. Bug bounties rewards are usually criminally low; doubly so when you consider the efforts usually involved in not only finding serious vulns, but demonstrating a reliable way to exploit them.

Here is a comment that really helped me understand bug bounty payouts: https://news.ycombinator.com/item?id=43025038

Everyone should read this comment, it does a really eloquent job explaining the situation.

The fundamental thing to understand is this: The things you hear about that people make $500k for on the gray market and the things that you see people make $20k for in a bounty program are completely different deliverables, even if the root cause bug turns out to be the same.

Quoted gray market prices are generally for working exploit chains, which require increasingly complex and valuable mitigation bypasses which work in tandem with the initial access exploit; for example, for this exploit to be particularly useful, it needs a sandbox escape.

Developing a vulnerability into a full chain requires a huge amount of risk - not weird crimey bitcoin in a back alley risk like people in this thread seem to want to imagine, but simple time-value risk. While one party is spending hundreds of hours and burning several additional exploits in the course of making a reliable and difficult-to-detect chain out of this vulnerability, fifty people are changing their fuzzer settings and sending hundreds of bugs in for bounty payout. If they hit the same bug and win their $20k, the party gambling on the $200k full chain is back to square one.

Vulnerability research for bug bounty and full-chain exploit development are effectively different fields, with dramatically different research styles and economics. The fact that they intersect sometimes doesn't mean that it makes sense to compare pricing.

Post reply on HN