How would an attacker have used this vulnerability? It seems to me that they'd already have to be able to inject code into the chrome context, to be able to point it towards content they control. Maybe I misunderstand how this works.
[deleted]
Arbitrary code execution through unsanitized browser UI
21–30 of 34 posts
Re: Arbitrary code execution through unsanitized browser UI
#22With regards to severe vulnerabilities such as arbitrary code execution, does anyone have an idea of the status of the major browsers (chrome, edge, safari, firefox). What are the relative rankings of these in terms of security?
There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…
There is no universal metric for security.
What about slashdot-style raw counts of vulnerabilities? As Microsoft got their security more together, it seems like that measure has fallen out of favor.
I am frequently astounded by how many vulnerabilities Firefox point releases address, but I don't know the stats.
Re: Arbitrary code execution through unsanitized browser UI
#23Earlier quoted context omitted.
There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…
There is no universal metric for security. What about slashdot-style raw counts of vulnerabilities? As Microsoft got their security more together, it seems like that measure has fallen out of favor. I am frequently astounded by how many vulnerabilities Firefox point releases address, but I don't know the stats.
That gives actively misleading information in two cases: if two vendors have different standards for vulnerabilities (e.g., is a tab crash a DoS or just a thing that happens sometimes) and if one vendor is more active at actually looking to find vulnerabilities (or incentivizing others to do so) than another. Both of those problems, inverted, make the metric easily gameable in awful ways: you're encouraging vendors to have a high bar for what counts as a security bug and you're encouraging them not to look.
A little more fundamentally, vulnerability counts don't provide a great measure of security architecture: whether defense-in-depth and least privilege are good at mitigating the impact of bugs. If, say, you have a JS PNG decoder and once a year someone finds a way for a malicious PNG to run arbitrary JS within the usual web JS sandbox, that's probably way better than having an unsandboxed native-code PNG decoder and once every three years someone finds a way for a malicious PNG to run arbitrary code on the host. (Maybe you can do something involving weighting vulnerabilities by CVSS score or something.)
Re: Arbitrary code execution through unsanitized browser UI
#24Earlier quoted context omitted.
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.
>Immediately stop using 56, downgrade to the LTS or upgrade to 57 58 is the fixed version. >I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people c…
Clinging to 52 ESR until August 28 is fine. That's what it's there for.
Clinging to 56 is ... well, it's your decision to use what software you want, that's what free software is all about, but since half the point of the changes in 57 was improved security architecture, clinging to 56 and expecting fixes for security bugs seems ill-advised.
Re: Arbitrary code execution through unsanitized browser UI
#25Earlier quoted context omitted.
There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…
Note that Site Isolation isn't on by default, and I still don't know what they're going to do about sites that contain hundreds of cross-domain iframes.
If that helps killing ads and analytics, I don't care 1 second.
Re: Arbitrary code execution through unsanitized browser UI
#26With regards to severe vulnerabilities such as arbitrary code execution, does anyone have an idea of the status of the major browsers (chrome, edge, safari, firefox). What are the relative rankings of these in terms of security?
There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…
> Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work.
I just searched for chrome site isolation and found https://chromeunboxed.com/news/chrome-63-site-isolation-exte.... And from this description the only particularly interesting thing is multiple domains within a single tab get multiple processes, but that doesn't sound all that different from how you get multiple processes per tab if the tab uses browser plugins. What makes this 3 or 4 years in the making?
Also it's disabled by default because of RAM usage.
Re: Arbitrary code execution through unsanitized browser UI
#27Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.
Here is one sad reason.
Customer controlled environment, where the only browsers are IE 11 and FF ESR, and having Chrome is considered security violation, because their IT cannot control it the same way.
Re: Arbitrary code execution through unsanitized browser UI
#28It's funny though how a security related page is insecure because of a misconfigured third party js.
https://imgur.com/a/CBftH https://sslanalyzer.comodoca.com/?url=https%3A%2F%2Fadmin.br...
Re: Arbitrary code execution through unsanitized browser UI
#29With regards to severe vulnerabilities such as arbitrary code execution, does anyone have an idea of the status of the major browsers (chrome, edge, safari, firefox). What are the relative rankings of these in terms of security?
Secure against WHAT?
I don't think you can get into lots of trouble using a recent and updated version of Firefox, Chrome, Edge. Just keep updating.
I don't use Mac/iOS, can't say anything about Safari.
If you're concerned about privacy however, then that's a completely different story (that I'm happy to discuss, but probably in another thread).
Re: Arbitrary code execution through unsanitized browser UI
#30Earlier quoted context omitted.
Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.
Here is one sad reason. Customer controlled environment, where the only browsers are IE 11 and FF ESR, and having Chrome is considered security violation, because their IT cannot control it the same way.
ESR is 52. There is absolutely no good reason to use anything but ESR or the properly maintained version. It will only get you into trouble.