2 ms·
Would I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?
by mintplant 9y ago
Would I be correct in assuming a browser-level mitigation isn't necessary if you're running a patched OS?
- londons_explore 9y agoYour OS needs patching, as do any programs which handle secret stuff like passwords, cookies, or tokens and interact with the internet (ie. web browsers).
- tonfa 9y agoWasn't there a PoC for a second issue of js reading memory from its own process? Could potentially be an issue (eg reading data from another website)
- olliej 9y agono
- bpye 9y agoThe OS patch stops you reading kernel space from user space trivially (ie. without eBPF in the Project Zero example). You can still cause leakage from the same context, for example, the V8 JIT can read all of the processes memory, without site isolation that can include data on other web pages, passwords, cookies, etc.