HN

Need help?
<- Back
Actively exploited sandbox RCE in all Chromium versions

Actively exploited sandbox RCE in all Chromium versions

negura

Comments (205)

  • david_shaw
    Let's take a moment to talk about the monetary value of this vulnerability.According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.
  • publlus_enigma
    Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
  • throwatdem12311
    I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.
  • Cider9986
    Brave is beating GrapheneOS on update timeliness:https://github.com/GrapheneOS/Vanadium/releaseshttps://github.com/brave/brave-browser/releasesOnly if you use Nightly wait maybe not.
  • mikeweiss
    Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?
  • pizlonator
    Sounds wild.(Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)
  • thenewnewguy
    Does anybody have a source for the "actively exploited" part of the HN title?
  • Woodi
    struct MessageBuffer{ int msgType; union { char *name; int nameID; }; };That finally convinced me getting data using functions (accessors, getters, setters) is a good thing, even in C :) Just all that unnecesary if's are so annoing and killing performance...
  • pertique
    Not to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.
  • basilikum
    For what is this exploited in the wild when it doesn't include a sandbox escape?Is this chained with n-days?
  • snorbleck
    So basically, Edge, Brave and any other browser built on Chromium. Nice.
  • johnnyApplePRNG
    NIST probably had this one filed and ready to announce years agolike those news agencies have obituaries of famous old people pre-written
  • roschdal
  • TZubiri
    Why is this 8.8?It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.
  • Animats
    Chromium, or just Chrome?
  • b8
    $1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.
  • Terr_
    As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising."Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."
  • radium3d
    Doesn't everyone else immediately update everything on their computer before they start doing anything?
  • petra303
    Only a score of 8.8?
  • anon
    undefined
  • vilas900420
    [flagged]
  • colincowardly
    [dead]
  • mamzxcvbn779807
    [dead]
  • anonymousiam
    Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.