Escaping the Chrome Sandbox Through DevTools

Post by alt227 » Thu, Oct 17, 2024, 12:56 PM UTC

billy99k wrote: post #53

Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

I've made lots of money with bug bounties over the years and mostly stopped this year in favor of private consulting. Companies will try anything to get out of paying, even through the major platforms. I once found a bug where I could access all of the names, addresses, emails, and phone numbers of all users for this new contest this company was running. I even found public announcements on Twitter. They told me this…

Post by gsck » Thu, Oct 17, 2024, 1:06 PM UTC

faangguyindia wrote: post #46

Etheryte wrote: post #3

Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.

Chrome needs to be rewritten in Rust asap

Post by lenerdenator » Thu, Oct 17, 2024, 1:26 PM UTC

forkerenok wrote: post #2

That's a neat vulnerability chain and a great writeup. Appreciated the breakdown of the vulnerable code as well! I'm always impressed by the simplicity of tricks like "Press F12 to try again", this is just so naughty :)

Post by magic_hamster » Thu, Oct 17, 2024, 1:51 PM UTC

n2d4 wrote: post #8

thrdbndndn wrote: post #6

Earlier quoted context omitted.

I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…

> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

Post by echoangle » Thu, Oct 17, 2024, 2:43 PM UTC

scotty79 wrote: post #45

TheDong wrote: post #5

Earlier quoted context omitted.

If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc. You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run…

Run calc.exe actually means steal money of everybody in their entire organization or blackmail the entire organization by encypting all the data they need to function.