Escaping the Chrome Sandbox Through DevTools
1–10 of 85 posts
Re: Escaping the Chrome Sandbox Through DevTools
#2That's a neat vulnerability chain and a great writeup. Appreciated the breakdown of the vulnerable code as well!
I'm always impressed by the simplicity of tricks like "Press F12 to try again", this is just so naughty :)
Re: Escaping the Chrome Sandbox Through DevTools
#3Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
Re: Escaping the Chrome Sandbox Through DevTools
#4really sick writeup, felt like a thriller novel
Re: Escaping the Chrome Sandbox Through DevTools
#5Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
If you can trick someone into installing a malicious extension with arbitrary permissions, you can already run arbitrary code on every webpage they visit, including their logged in bank, social media, etc.
You think an attacker is right now thinking "Man, I know exactly how to make a lot of victims install an extension, but I can only steal their coinbase wallet and bank accounts, if only there was a way I could run calc.exe on their machine too..." who's going to pay more than $20k to upgrade from "steal all their money" to "steal all their money and run calc.exe"?
Re: Escaping the Chrome Sandbox Through DevTools
#6Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market."
Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless.
To give a straightforward answer: no, I don’t think $20k is underpaid. The severity of a bug isn't based on how it could theoretically affect people but on how it actually does. There's no evidence this is even in the wild, and based on the description, it seems complicated to exploit for attacks.
Re: Escaping the Chrome Sandbox Through DevTools
#7God damn that is one of the best things I’ve ever read.
Super clever sleuthing
Re: Escaping the Chrome Sandbox Through DevTools
#8Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market." Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless. To give a straightforward a…
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does
No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.
Re: Escaping the Chrome Sandbox Through DevTools
#9Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
they say:
`This also means that, unfortunately, the bug will not work on stable builds of Google Chrome since the release channel is set to the proper value there`
So it's only working on Chromium, a way smaller attack surface than the whole Chrome users
Re: Escaping the Chrome Sandbox Through DevTools
#10Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
If it had worked for Chrome it should (and maybe would) have been a lot higher. Also: doesn't it use an extension?
I was under the impression that extensions were un-sandboxed and basically just executables I trust to run with the same privilege as the browser itself (which is a lot, at least under windows).