Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

151–160 of 520 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#151

Post by flippingheck »

publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

> decision we have made

This might oversell the agency that practicioners have.

Sandboxed zero-install delivery will outcompete anything with more frictionful installs.

It's probably not the right model for a pacemaker though.

Web/JS has been a double-edged sword for FOSS: sure, I can run a free OS, but if most of my "apps" happen to be JS that I can't practically control, then I have won a battle and lost a war.

Re: Actively exploited sandbox RCE in all Chromium versions

#154

Post by 0xbadcafebee »

tptacek wrote: post #92
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…

How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?

Re: Actively exploited sandbox RCE in all Chromium versions

#155

Post by 0xbadcafebee »

ajkjk wrote: post #111
quotemstr wrote: post #45

Earlier quoted context omitted.

You let the market decide. Google could purchase the bugs on the same market blackhats do.

we really do not want to engineer a system in which using bugs to make money is considered economically legitimate activity. It is still crime. The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier. The money is there to make is to incentivize the work of finding and reporting them -- not to outbid the bad actors.

> using bugs to make money

Aka security research.

It's one thing to hold something for ransom ("give me $5M or I release the 0day"). It's another to sell a valuable piece of information ("give me $5M if you want the 0day"). As long as you're only offering the bug to the company who would be impacted by its release, there's nothing unethical about asking for payment.

Maybe you think that, ethically, all bugs should be reported, regardless of payment, because it prevents harm. Well a lot of things prevent harm that we don't all take it upon ourselves to do voluntarily. Should everyone do all safety-related work for free? If we don't want to do it for free, should we not do safety work at all?

If the company really wanted it safe, and they can't make it safe themselves, they can pay someone else to make it safe. If they aren't willing to do that, then nobody is obligated to do free work for them, because we don't require anyone else to do safety-critical work for free. Let's not forget, this isn't a scrappy startup struggling for a seed round, this is one of the world's largest corporations with billions of dollars in cash. If they want your labor, make them pay for it.

Re: Actively exploited sandbox RCE in all Chromium versions

#156

Post by [deleted] »

quotemstr wrote: post #130
ajkjk wrote: post #112

Earlier quoted context omitted.

"Aiding and Abetting" crime is also a crime. Free speech has nothing to do with it.

Has anyone actually been convicted of abetting a crime by selling a vulnerability, by itself, not conspiring with the buyer to commit a crime using said vulnerability? Not as far as I can see. It would be absurd to jail someone for accurately describing a bug.

[deleted]

Re: Actively exploited sandbox RCE in all Chromium versions

#159

Post by randyrand »

0xbadcafebee wrote: post #154
tptacek wrote: post #92

Earlier quoted context omitted.

If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…

How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?

That’s not how things are valued. That’s moreso how the absence of something is valued.

Re: Actively exploited sandbox RCE in all Chromium versions

#160

Post by jeffbee »

tptacek wrote: post #95
quotemstr wrote: post #45

Earlier quoted context omitted.

You let the market decide. Google could purchase the bugs on the same market blackhats do.

Google directly competes with the grey market for vulnerabilities. They are competitive in a bunch of different directions: * They pay for vulnerabilities without reliable exploits (more for vulnerabilities that are demonstrably reliable). * They don't require you to actually build a reliable exploit chain. * They pay up front, not in tranches. * They work with essentially all comers, unlike the grey market, where yo…

They pay in plain old money, too. On the market your counterparty will be a criminal who is trying to scam you every step of the way.
Post reply on HN