Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

141–150 of 518 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#141

Post by nik282000 »

whizzter wrote: post #83
asveikau wrote: post #67

Earlier quoted context omitted.

I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.

I still do "random" browsing in FF with NoScript, that said, I'll acknowledge the frequency of updates of Chrome,etc and years of hardening. It's not the Bonzi-buddy and driveby-installed IE toolbars wild west of the early 00s.

The browsers on the computers at work show that it is very much still the driveby tool-bar install days.

Re: Actively exploited sandbox RCE in all Chromium versions

#142

Post by cogman10 »

altairprime wrote: post #119
CookieCrisp wrote: post #27

Earlier quoted context omitted.

While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?

The discount Google is getting on bounties versus internal spend is easy to estimate: # assumed to be $0.5mil USD or greater A := What quantity of salaries-and-benefits and AI-dollars does Google spend on zero-day research? # assumed to be greater than zero B := How many full sandbox RCEs are they *hoping* to discover per year with that budget? # $/RCE budgeted spend C := A ÷ B # $/bounty D := $1000 USD # % discount…

> or they're negligent in budgeting for RCE discovery at all, or they assign zero value to the security of the Chromium platform underpinning Edge, Electron, et al

I generally agree, but a 3rd explanation is they figure that too generous a bounty will flood them with reports of minor issues making major ones harder to see (and costing time and money to verify that could be spent looking for security issues).

Re: Actively exploited sandbox RCE in all Chromium versions

#143

Post by martyfunkhouser »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

If you really explore the concept of worth, Google "engineers" are grossly overpaid, otherwise they would have found this themselves already.

How many PMs are making more than bug bounties to fetch coffee and bagels?

Their priorities are all out of order.

Re: Actively exploited sandbox RCE in all Chromium versions

#145

Post by cute_boi »

grishka wrote: post #138
publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT. I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's e…

Agree. Chrome should just disable JIT by default and boom many website owner will start to optimize their website.

Re: Actively exploited sandbox RCE in all Chromium versions

#146

Post by pizlonator »

publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs.

That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it.

(Posted from a memory safe browser - WebKit MiniBrowser compiled with Fil-C. Pretty sure this is safer than even V8 and the heap sandbox.)

Re: Actively exploited sandbox RCE in all Chromium versions

#147

Post by bothers »

ajkjk wrote: post #111
quotemstr wrote: post #45

Earlier quoted context omitted.

You let the market decide. Google could purchase the bugs on the same market blackhats do.

we really do not want to engineer a system in which using bugs to make money is considered economically legitimate activity. It is still crime. The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier. The money is there to make is to incentivize the work of finding and reporting them -- not to outbid the bad actors.

> The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier.

Yeah let's see how this plays out, paying people less than their time is worth for RCEs.

Re: Actively exploited sandbox RCE in all Chromium versions

#149

Post by pizlonator »

basilikum wrote: post #74

For what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?

There's a risk that someone had been sitting on a sandbox escape that assumed having RCE inside the sandbox first, and so they'd been waiting for an RCE exactly like this one.

Those folks would not be disclosing their sandbox escape unless they were good guys.

(Posted with a memory safe WebKit, Fil-C FTW)

Re: Actively exploited sandbox RCE in all Chromium versions

#150

Post by fuzzfactor »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

>researchers shouldn't hold bugs for ransom or demand high payment.

Hell no, the same level bugs at Google should be enthusiastically paid way more than from an undercapitalized startup, who actually needs the help more so. Should be orders of magnitude difference in relation to scale.

>it makes sense to pay them what the bug's actually worth.

Honest fair-dealing should come into play at least but there are some players who have struck it so rich they can now take enough pride to pay an additional premium just because they can, and their good human nature almost compels them ethically to do way more than the minimum.

Just apparently not at Google.

If a company has achieved financial success to a degree that they are no longer worried about complete failure for the foreseeable future, then it's only a matter of generosity vs Scrooge-like behavior.

What's missing from their overall business acumen if they can't even afford to project an image of generosity yet?

If they're not actively making a serious effort to pay the maximum they can well afford for bugs that are truly serious, there is a technical term for that. Chickenshit.

Post reply on HN