411–420 of 528 posts
How many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buff…
Earlier quoted context omitted.
That's really informative but maybe a little overly capitalist-brained. We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.
> We shouldn't look to the black market as cost discovery for these vulnerabilities We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.
Google is only paying for the vulnerability; the exploit market is also paying for your mortal soul.
Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? H…
Earlier quoted context omitted.
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched. Further: a vulnerability is probably…
I was under the impression that the three letter agencies and contractors bought vulnerabilities?
> Type confusion in V8 Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.
> Unfortunately, it breaks about 30% of the web. More like 99% I use Firefox with Noscript and I'm _totally aware_ that almost no website works without allowing it JS. Even using Noscript it's becoming more and more exhausting every year, it's plain impossible to browse the internet without JS at all.
This is not something just anyone is going to rush into. Bigger teams or js/ts evangelists will eventually arrive at that point if they're running something where no-js (really a side effect of seo goals) is important, but "normal people" will spend this time and engineering effort elsewhere.
I think the industry in general is moving past React, as now, and definitely in near future, the only thing that matters is ideas, the rest is for the LLMs to figure out, and so the "frameworks" are going to completely disappear from people's minds as "programming" essentially becomes "telling the AI what to do" and the AI writes asm or even binary. That is when, no JS, may become more viable again lol.
People, including me, resist it, but in the future "programming" is not going to be about writing code (or even checking it, we're way too slow and error-prone to do that), but about coming up with ideas of how to capture real world problems in an IT system, and how to solve those problems by existing (or novel) ways, picking the right tools for the job (say a statistician picking the fitting metric to capture some property of the system that will actually project meaningful observability improvements and not be "just a bunch of noise") and making the right architectural decisions in terms of correctness, performance, scope, taking into account deadlines and budget. And being the domain model glue. Everything else, all the nitty gritty we used to call programming, all the , is going to be done by AI ... it's a mag 9.5 quake tsunami and it can't be stopped now.
This might completely wipe out things like React (which are largely made for humans writing the code, not for humans consuming the output of that code) faster than anyone thought possible.
Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?
Earlier quoted context omitted.
Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't. However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript…
Okay, but we're still talking about running machine code inside the sandbox , where that functionality is still not available.
Earlier quoted context omitted.
this is why again, researchers should just honestly sell these to vuln brokers instead of donating them to trillion dollar companies for nothing. nothing will change until big tech can no longer rip off security researchers
Who is to say they didn’t already do that?
of course it could be a colleague or someone with access to such tools
Google has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable. Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.
Writing Chromium entirely in Rust wouldn't prevent a JIT bug like this.