5 ms·
It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations en
by 013a 9y ago
It probably means if you want mitigations right now, you can flip that flag. Otherwise wait for Chrome to auto-update with new versions that have mitigations enabled by default.
- mintplant 9y agoWould I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?
- londons_explore 9y agoYour OS needs patching, as do any programs which handle secret stuff like passwords, cookies, or tokens and interact with the internet (ie. web browsers).
- tonfa 9y agoWasn't there a PoC for a second issue of js reading memory from its own process? Could potentially be an issue (eg reading data from another website)
- olliej 9y agono
- bpye 9y agoThe OS patch stops you reading kernel space from user space trivially (ie. without eBPF in the Project Zero example). You can still cause leakage from the same context, for example, the V8 JIT can read all of the processes memory, without site isolation that can include data on other web pages, passwords, cookies, etc.