Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day CSS: CVE-2026-2441 exists in the wild

chromereleases.googleblog.com

Post reply on HN
Print view View original

51–60 of 242 posts

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#51

Post by wepple »

duozerk wrote: post #17
mpeg wrote: post #5

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." That's pretty bad! I wonder what kind of bounty went to the researcher.

> That's pretty bad! I wonder what kind of bounty went to the researcher. I'd be surprised if it's above 20K$. Bug bounties rewards are usually criminally low; doubly so when you consider the efforts usually involved in not only finding serious vulns, but demonstrating a reliable way to exploit them.

> but demonstrating a reliable way to exploit them

Is this a requirement for most bug bounty programs? Particularly the “reliable” bit?

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#52

Post by wvbdmp »

hdgvhicv wrote: post #41
bicepjai wrote: post #9

Earlier quoted context omitted.

So basically Firefox is not affected ?

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

Particularly weird impulse for technically inclined people…

Although I must admit to the guilty pleasure of gleefully using Chromium-only features in internal apps where users are guaranteed to run Edge.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#55

Post by [deleted] »

8-prime wrote: post #28
w4yai wrote: post #22

Earlier quoted context omitted.

Why ?

To me at least it reads funny because when I think of CSS I think of the language itself and not the accompanying tools that are then running the CSS. Saying "Markdown has a CVE" would sound equally off. I'm aware that its not actually CSS having the vulnerability but when simplified that's what it sounds like.

[deleted]

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#57

Post by autoexec »

hdgvhicv wrote: post #41
bicepjai wrote: post #9

Earlier quoted context omitted.

So basically Firefox is not affected ?

The listed browsers are basically skins on top of the same chromium base. It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

HN doesn't want firefox to go away. HN wants firefox to be better, more privacy/security focused, and to stop trying to copy chrome out of the misguided hope that being a poor imitation will somehow make it more popular.

Sadly, mozilla is now an adtech company (https://www.adexchanger.com/privacy/mozilla-acquires-anonym-...) and by default firefox now collects your data to sell to advertisers. We can expect less and less privacy for firefox users as Mozilla is now fully committed to trying to profit from the sale of firefox users personal data to advertisers.

Re: Zero-day CSS: CVE-2026-2441 exists in the wild

#60

Post by skydhash »

cogman10 wrote: post #34
pheggs wrote: post #19

Earlier quoted context omitted.

I love rust but honestly I am more scared about supply chain attacks through cargo than memory corruption bugs. The reason being that supply chain attacks are probably way cheaper to pull off than finding these bugs

If you can bring in 3rd party libraries, you can be hit with a supply chain attack. C and C++ aren't immune, it's just harder to pull off due to dependency management being more complex (meaning you'll work with less dependencies naturally).

You’ll find more quality libraries in C because people don’t care about splitting them down to microscopic parcels. Even something like ‘just’ have tens of deps, including one to check that something is executable.

https://github.com/casey/just/blob/master/Cargo.toml

That’s just asking for trouble down the line.

Post reply on HN