Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

Post reply on HN
Print view View original

161–170 of 524 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#161

Post by tptacek »

jeffbee wrote: post #160
tptacek wrote: post #95

Earlier quoted context omitted.

Google directly competes with the grey market for vulnerabilities. They are competitive in a bunch of different directions: * They pay for vulnerabilities without reliable exploits (more for vulnerabilities that are demonstrably reliable). * They don't require you to actually build a reliable exploit chain. * They pay up front, not in tranches. * They work with essentially all comers, unlike the grey market, where yo…

They pay in plain old money, too. On the market your counterparty will be a criminal who is trying to scam you every step of the way.

Not so much, the grey market is pretty well structured.

Re: Actively exploited sandbox RCE in all Chromium versions

#162

Post by [deleted] »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

[deleted]

Re: Actively exploited sandbox RCE in all Chromium versions

#163

Post by andrekandre »

cute_boi wrote: post #145
grishka wrote: post #138

Earlier quoted context omitted.

Running code by itself isn't that bad, it's the fact that browser developers have decided for some reason that this code needs to be as performant as possible, so, JIT. I don't get it! The way JS is typically used, it doesn't even benefit from JIT all that much. Making ajax requests, doing stuff with strings, and moving DOM elements around doesn't need every CPU clock cycle to be used as optimally as possible. It's e…

Agree. Chrome should just disable JIT by default and boom many website owner will start to optimize their website.

jira and confluence come to mind...

Re: Actively exploited sandbox RCE in all Chromium versions

#165

Post by JacobKfromIRC »

flippingheck wrote: post #151
publlus_enigma wrote: post #55

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

> decision we have made This might oversell the agency that practicioners have. Sandboxed zero-install delivery will outcompete anything with more frictionful installs. It's probably not the right model for a pacemaker though. Web/JS has been a double-edged sword for FOSS: sure, I can run a free OS, but if most of my "apps" happen to be JS that I can't practically control, then I have won a battle and lost a war.

I wish Haketilo [1] would have caught on more. There's so many free JavaScript apps but we're mostly just missing a way to actually control which version or derivative of the JavaScript is run.

There's also the problem of most free apps not doing a good job of providing license info and a link to source code, but this could be sidestepped by a trusted repository which provides license info itself.

[1] https://haketilo.koszko.org/

Re: Actively exploited sandbox RCE in all Chromium versions

#166

Post by tantalor »

0xbadcafebee wrote: post #154
tptacek wrote: post #92

Earlier quoted context omitted.

If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…

How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?

The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.

Re: Actively exploited sandbox RCE in all Chromium versions

#167

Post by strenholme »

anonymars wrote: post #136
snorbleck wrote: post #90

So basically, Edge, Brave and any other browser built on Chromium. Nice.

Monocultures are great!

There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs.

I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.

Re: Actively exploited sandbox RCE in all Chromium versions

#168

Post by nixon_why69 »

tptacek wrote: post #92
david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…

That's really informative but maybe a little overly capitalist-brained.

We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.

Re: Actively exploited sandbox RCE in all Chromium versions

#169

Post by pertique »

Not to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.

Re: Actively exploited sandbox RCE in all Chromium versions

#170

Post by gblargg »

david_shaw wrote: post #20

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…

People are free to pool their money and offer higher bounties.
Post reply on HN