Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day CSS: CVE-2026-2441 exists in the wild

chromereleases.googleblog.com

Post reply on HN
Print view View original

191–200 of 242 posts

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#191

Post by spacebanana7 »

streetfighter64 wrote: post #121
chc4 wrote: post #84

Earlier quoted context omitted.

I don't think you know anything about how these industries work and should probably read some of the published books about them, like "This Is How They Tell Me The World Ends", instead of speculating in a way that will mislead people. Most purchasers of browser exploits are nation-state groups ("gray market") who are heavily incentivized not to screw the seller and would just wire some money directly, not black marke…

I mean, you're still restricted to selling it to your own government, otherwise getting wired a cool $250k directly would raise a few red flags I think. And how many security researchers have a contact in some government-sponsored hacking company anyway? Do you really think that convincing them to buy a supposed zero-day exploit as a one-off would be easy? Say you're in the US. I'm sure there are some CIA teams or wh…

Defence firms like Raytheon are often happy to pay for stuff like this. What happens afterwards with the exploit is anybody's guess. Source - a vague memory of a Darknet diaries episode.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#192

Post by vntok »

bicepjai wrote: post #9
mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

So basically Firefox is not affected ?

No, though Firefox has its own CVE this week: https://thecyberexpress.com/firefox-v147-cve-2026-2447/

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#193

Post by pheggs »

dbdr wrote: post #174
pheggs wrote: post #98

Earlier quoted context omitted.

I would argue that almost all major rust projects use dependencies. Checking the dependencies for vulnerabilities might be just as difficult as checking C code for memory safety, maybe even worse, because dependencies have dependencies and the amount of code to be checked can easily sky rocket. The problem gets even worse if you consider that not all rust code is safe, and that C libraries can be included and so on

Yes, but I believe that results in a cost/benefit analysis. If there are readily available rust crates that do something you need, and the cost of a possible vulnerability is not huge, most projects might decide (right or wrong) that it is worth it. It's an interesting question why projects tend to make different decisions in different languages, but it does not necessarily mean that you have to make the same decisio…

Fair, you see the perspective from someone writing the software and it makes sense. But when I see it though the lenses of someone choosing software to run, I would rather choose a C program with potential memory bugs than a rust program with a lot of dependencies - because I am more scared about supply chain attacks than someone being able to exploit a memory bug. But then again, this obviously changes if the rust program has no dependencies.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#194

Post by intheitmines »

0xbadcafebee wrote: post #146
bri3d wrote: post #130

Earlier quoted context omitted.

Everyone should read this comment, it does a really eloquent job explaining the situation. The fundamental thing to understand is this: The things you hear about that people make $500k for on the gray market and the things that you see people make $20k for in a bounty program are completely different deliverables, even if the root cause bug turns out to be the same. Quoted gray market prices are generally for working…

Why is it the USA doesn't have their own bug bounty program for non-DOD systems? Like, sure, they have a bounty for vulns in govt systems. But why not accept vulns for any system, and offer to pay more than anyone else? It would give them a competitive advantage (offensive & defensive) over every other nation. End one experimental weapons program (or whatever garbage DOD spends its obscene budget on) and suddenly we'…

See the equation group saga https://en.wikipedia.org/wiki/Equation_Group

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#195

Post by pjmlp »

ceteia wrote: post #183
pjmlp wrote: post #179

Earlier quoted context omitted.

Those kind of arguments is like posting news about people still dying while wearing seat belts and helmets, ignoring the lifes that were saved by having them on. By the way, I am having these kind of arguments since Object Pascal, back when using languages safer than C was called straighjacket programming. Ironically, most C wannabe replacements are Object Pascal/Modula-2 like in the safety they offer, except we know…

People made similar arguments regarding C++ versus Ada. The US military and defense industry even got something like a mandate in the 1990s to only write in Ada. And then there was https://en.wikipedia.org/wiki/Ariane_flight_V88 , where US$370 million was lost. The code was written in Ada. And using seat belts and wearing helmets do not help in those cases where 'unsafe' is used to take the seat belts and helmets off…

Yes, people like to point out Ariane explosion, without going into the details, and missing out on F-35 budget explosion much worse, with ridiculous failures like having to reboot its avionics in flight.

It is like bringing the news of that lucky soul, that only survived a car crash, because it was thrown out of the car, managed to land in such a way that it survived the crash, survival statistics be dammed.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#196

Post by pjmlp »

josefx wrote: post #185
tgv wrote: post #180

Earlier quoted context omitted.

I think the parent tries to refer to Carbon: https://en.wikipedia.org/wiki/Carbon_(programming_language)

I actually wasn't aware of that language. It was more a reference to the overblown claims Pike made in the early days of Go, where he presented it as the c++ replacement for everything Google.

Yeah, but that was never Google, rather Rob Pike and his peers that never liked C++.

Note that even though C++ was born as UNIX language, as C sibling, at Bell Labs, Plan 9 and Inferno never supported it.

Here is the blog post from Rob Pike, https://commandcenter.blogspot.com/2012/06/less-is-exponenti...

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#197

Post by koito17 »

topspin wrote: post #39
DetroitThrow wrote: post #13

Earlier quoted context omitted.

It's pretty hard to have an accidental a use after free in the FireFox CSS engine because it is mostly safe Rust. It's possible, but very unlikely.

That came to my mind as well. CSS was one of the earliest major applications of Rust in FireFox. I believe that work was when the "Fearless Concurrency" slogan was popularized.

Yup. To this day, Firefox remains the only browser with a *parallel* CSS engine. Chromium and WebKit teams have considered this and decided not to pursue since it's really easy to get concurrency wrong.

If I recall correctly, the CSS engine was originally developed for Servo and later embedded into Firefox.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#198

Post by pjmlp »

StilesCrisis wrote: post #113
josefx wrote: post #68

Earlier quoted context omitted.

I heard they once created an entire language that would replace C++ in all their projects. Obviously they never rewrote Chrome in Go. > 10s of billions are spent to try to get Chromium to not have these vulnerabilities, using those tools. And here we are. Shouldn't pages run in isolated and sandboxed processes anyway? If that exploit gets you anywhere it would be a failure of multiple layers.

I don't think Go was ever planned to completely overtake C++. It is still a garbage collected language at the end of the day.

Many people enjoy playing games, and video productions, written in a garbage collected C++ engine.

Go's main issue is its language design approach.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#199

Post by afiori »

jacquesm wrote: post #93
hdgvhicv wrote: post #41

Earlier quoted context omitted.

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

HN wants Firefox but with better stewardship and fewer misdirected funds. Mozilla - wrongly - believes that the majority of FF users believe in Mozilla's hobby projects rather than that they care about their browser. That's why - as far as I know - to this day it is impossible to directly fund Firefox. They'd rather take money from google than to be focusing on the one thing that matters.

I am pretty sure that the issue is that they either admit to being so l stuck as a vassal beholden to Google, or they pretend to be enterprising and forward looking with many promising projects

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#200

Post by ceteia »

pjmlp wrote: post #195
ceteia wrote: post #183

Earlier quoted context omitted.

People made similar arguments regarding C++ versus Ada. The US military and defense industry even got something like a mandate in the 1990s to only write in Ada. And then there was https://en.wikipedia.org/wiki/Ariane_flight_V88 , where US$370 million was lost. The code was written in Ada. And using seat belts and wearing helmets do not help in those cases where 'unsafe' is used to take the seat belts and helmets off…

Yes, people like to point out Ariane explosion, without going into the details, and missing out on F-35 budget explosion much worse, with ridiculous failures like having to reboot its avionics in flight. It is like bringing the news of that lucky soul, that only survived a car crash, because it was thrown out of the car, managed to land in such a way that it survived the crash, survival statistics be dammed.

Wasn't the F-35 budget "explosion", or overruns, caused in general by mismanagement? But I will not argue that C++ is perfect. Instead, the ttps://en.wikipedia.org/wiki/Ariane_flight_V88 , where US$370 million was lost, with code written in Ada, is an example where Ada was presented as a safer language and even mandated in the military industry, but where it turned out less well in practice. Even proclaimed "safer" languages can have catastrophic failures, and one can suspect that they might even be less safe in practice, especially if they need mandates to be picked. Instead of Ada companies or other organizations lobbying to force industry to use their language, maybe it is better if there is free competition, and then the onus is on the software development companies to deliver high quality. Ada has improved since the 1990s, perhaps because it has been forced to compete fairly with C, C++ and other languages. Following that thinking, increased, not decreased, competition should be encouraged.

Your lucky soul analogy argument doesn't make any sense.

Post reply on HN