Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day CSS: CVE-2026-2441 exists in the wild

chromereleases.googleblog.com

Post reply on HN
Print view View original

231–240 of 242 posts

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#231

Post by pjmlp »

zbentley wrote: post #222
pjmlp wrote: post #198

Earlier quoted context omitted.

Many people enjoy playing games, and video productions, written in a garbage collected C++ engine. Go's main issue is its language design approach.

Say more?

Unreal C++ uses reference counting for anything that gets exposed to the Blueprints development environemnt, Blueprints themselves have automatic resource management and the new addition to the family for Fortnight levels, Verve, also uses automatic memory management.

All of which fall under the point of view of GC implementations as per CS papers and scientific research.

Go well, it could have been a Modula-3/Active Oberon language, instead it became something only a little better than Oberon-07 and Limbo, and even then it still misses features from Limbo, as its plugin package is half backed.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#232

Post by hdgvhicv »

wvbdmp wrote: post #52
hdgvhicv wrote: post #41

Earlier quoted context omitted.

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

Particularly weird impulse for technically inclined people… Although I must admit to the guilty pleasure of gleefully using Chromium-only features in internal apps where users are guaranteed to run Edge.

Are you old enough to have suffered through the ie6 corporate mess?

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#233

Post by hdgvhicv »

ddtaylor wrote: post #79
autoexec wrote: post #57

Earlier quoted context omitted.

HN doesn't want firefox to go away. HN wants firefox to be better, more privacy/security focused, and to stop trying to copy chrome out of the misguided hope that being a poor imitation will somehow make it more popular. Sadly, mozilla is now an adtech company ( https://www.adexchanger.com/privacy/mozilla-acquires-anonym-... ) and by default firefox now collects your data to sell to advertisers. We can expect less an…

As a 25 year Firefox user this is spot on. I held out for 5 years hoping they would figure something out, but all they did was release weird stuff like VPNs and half baked services with a layer of "privacy" nail polish. Brave is an example of a company doing some of the same things, but actually succeeding it appears. They have some kind of VPN thing, but also have Tor tabs for some other use cases. They have some ki…

So Firefox suffers because people like you choose a chrome skin rather than fork.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#234

Post by JoeAltmaier »

stackghost wrote: post #69
JoeAltmaier wrote: post #30

Earlier quoted context omitted.

Maybe it's more complicated than that? With allocate/delete discipline, C can be fairly safe memory-wise (written a million lines of code in C). But automated package managers etc can bring in code under the covers, and you end up with something you didn't ask for. By that point of view, we reverse the conclusion.

>With allocate/delete discipline, C can be fairly safe memory-wise (written a million lines of code in C) The last 40-50 years have conclusively shown us that relying on the programmer to be disciplined, yourself included, does not work.

That personal slam was inappropriate. Save it for other pop-culture sites.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#235

Post by capitainenemo »

3oil3 wrote: post #225
capitainenemo wrote: post #214

Earlier quoted context omitted.

If you're talking about url/search bar at the bottom on mobile, that's customisable - actually they ask you which you prefer when you install it, but you can change it at any time in settings. (personally I prefer all that stuff at the bottom since it's more conveniently where all my other phone nav is, and visibility fits in well with how I scroll)

I mean on the computer, and I haven't found a way to have it at the top.

Alright, now I'm doubly confused, since the search bar is typically on the address bar which is at the top of the screen. You might want to test a clean profile. Perhaps some customisation along the way changed things on your setup.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#238

Post by bicepjai »

autoexec wrote: post #57
hdgvhicv wrote: post #41

Earlier quoted context omitted.

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

HN doesn't want firefox to go away. HN wants firefox to be better, more privacy/security focused, and to stop trying to copy chrome out of the misguided hope that being a poor imitation will somehow make it more popular. Sadly, mozilla is now an adtech company ( https://www.adexchanger.com/privacy/mozilla-acquires-anonym-... ) and by default firefox now collects your data to sell to advertisers. We can expect less an…

I did not know this. Why are you doing this Mozilla !? How does the words privacy-safe measurement and targeting in the same sentence make any sense.

>> Anonym will now become a separate business unit within Mozilla to develop new solutions for privacy-safe measurement, targeting and optimization.

At this point can someone fork Firefox and maintain separately ?

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#239

Post by iririririr »

astrobe_ wrote: post #221
iririririr wrote: post #86

Earlier quoted context omitted.

why on earth would you even assume somthing like this? honestly curious. do you think "based on chrome" means they forked the engine and not just "applied some UI skin"?

The CVE itself only lists Chrome as the "affected software configuration", and I missed the line saying other browsers in the blog post, so I had a slight doubt. Other projects could use a drop-in replacement lib for the CSS, that's something one sees sometimes for other things (e.g. crypto libs - some projects have compile-time options ready for this).

They would have been if they could patch and release under a day. They are not affected only because they lag behind a little.

Why do you dream things up? no chrome based browser will do html/js/css different. it's all hooked deep in the engine. they only add things on top and change the chrome (the confusingly named ux component)

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#240

Post by BrendanEich »

jacquesm wrote: post #93
hdgvhicv wrote: post #41

Earlier quoted context omitted.

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

HN wants Firefox but with better stewardship and fewer misdirected funds. Mozilla - wrongly - believes that the majority of FF users believe in Mozilla's hobby projects rather than that they care about their browser. That's why - as far as I know - to this day it is impossible to directly fund Firefox. They'd rather take money from google than to be focusing on the one thing that matters.

A mundane reason for why donations to the 501c3 parent Mozilla Foundation can't go to Firefox or Gecko engineers is U.S. tax law. We found out the hard way after the IRS San Jose office said we could run only as a foundation and take "sponsorship income" tax-free. They reneged and litigated; this led to the creation of the arms-length Mozilla Corporation that's wholly owned by the Foundation. Per IRS regulations, it cannot be funded by grants from the parent Mozilla Foundation.

The corporation could let users pay for Firefox, and pay tax on that revenue. While I was there, no one thought this would help enough to be worth the effort, compared to just working on other things while taking Google search revshare.

With Brave, I've pushed for user-pays as an option. We let a user buy Premium Search (no ads, but this is possible for free) to support us. It's a small but non-negligible amount of revenue per year, and growing slowly, but we did it on principle. Same will go for buy-once zero-telemetry Brave Origin, stripped down Brave coming in a month or two.

Post reply on HN