Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

forbes.com

Post reply on HN
Print view View original

61–70 of 150 posts

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#61

Post by paxys »

_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

You are making the assumption that an engine with fewer optimizations that runs slower will be safer by default, but I fail to see the connection between the two.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#62

Post by paxys »

hdjjhhvvhga wrote: post #24
bawolff wrote: post #10

Earlier quoted context omitted.

There is no indication yet that this is due to complex web standards. It could be, but we literally dont know what the bug is yet.

But we do know that it is Javascript-related, so please correct me if I'm wrong but disabling JS for all websites except the ones you really, really trust and need should offer long-term general protection against such 0-days in most cases.

There are lots of 0day exploits outside of the JavaScript engine. Going down this path, it would be safest to not use the web at all, or really just not own a computer.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#63

Post by hedora »

Ourgon wrote: post #16
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

> I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of…

Try running the modern web without a supported GPU (eg through VNC on a VM with a vesa video card).

Even trivial sites will knock over the fastest Xeon available. I can't imagine how much worse it would be if you also disabled the JS JIT.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#65

Post by the_common_man »

fn-mote wrote: post #42

I use snap for some applications in spite of the trouble it has caused me. I was super-happy to find out that it had upgraded me to a not-vulnerable verson of chromium before I even knew to look. For all of the (deserved) hate snap gets, there are some shining up sides.

I use apt and it didn't update to this vulnerable version in the first place, so there's that

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#66

Post by newman555 »

gruez wrote: post #20

Is there a site/service/mailing list that provides notifications for critical/RCE/in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.

funny enough, was asking my self the same question yesterday after 5-minute googling didn’t get me anywhere. I see a recommendation mentioned below, but as I also saw, hard to find something where you can control signal to noise ratio

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#67

Post by tedunangst »

Ourgon wrote: post #54
bastawhiz wrote: post #17

Earlier quoted context omitted.

> it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines. I don't plan on my bank trying to 0day my browser. If anything, I trust them not to do anything malicious m…

You don't seem to understand what I wrote so I'll explain it: - imagine a slow-but-secure browser, 10 to 100 times as slow and using 10 times as much memory as stated by the parent poster - imagine your bank and payment processor using a minimal amount of Javascript on their sites to make it possible to use that secure-but-slow browser without incurring too big a performance penalty Do you now see what I mean? It is…

The dangerous assumption here is that whatever sandbox you put the bad browser in actually contains it.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#68

Post by tedunangst »

bastawhiz wrote: post #17
Ourgon wrote: post #16

Earlier quoted context omitted.

> I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of…

> it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines. I don't plan on my bank trying to 0day my browser. If anything, I trust them not to do anything malicious m…

Even bank pages contain a lot of analytics, and any of those sites could be used against you.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#69

Post by hdjjhhvvhga »

paxys wrote: post #62
hdjjhhvvhga wrote: post #24

Earlier quoted context omitted.

But we do know that it is Javascript-related, so please correct me if I'm wrong but disabling JS for all websites except the ones you really, really trust and need should offer long-term general protection against such 0-days in most cases.

There are lots of 0day exploits outside of the JavaScript engine. Going down this path, it would be safest to not use the web at all, or really just not own a computer.

No, I think it's reductio ad absurdum; what I mean is reasonable means of reducing risks for people who don't use that much web apps and consume mostly text such as news etc.
Post reply on HN