8 ms·

> Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detectio

> Browser exploits are almost all JS-based, and even the few that aren't, are in practice deployed using obfuscation involving JS, to make analysis and detection harder. Go take a look through Pwn2Own. Most browser exploits do not involve JavaScript. JavaScript can be a delivery mechanism for a certain class of payloads, but it's not the substantial weakness in browser vulnerabilities (as opposed to web application vulnerabilities). Given that this isn't familiar to you, I'd recommend you reevaluate how confident you are in the JavaScript-focused defenses you've outlined in the rest of your comment.

userbinator 8y ago
JavaScript can be a delivery mechanism for a certain class of payloads That's exactly what I'm saying --- in the real world, exploits tend to be wrapped in JS even if they don't technically need it. but it's not the substantial weakness in browser vulnerabilities Then what is? My real-world experience also correlates.
- throwawaymath 8y ago
  > Then what is? My real-world experience also correlates. HTML (non-JS) parsing, memory corruption, image processing, filetype validation and process isolation/sandboxing.
dane-pgp 8y ago
The security bugs found during Pwn2Own are usually kept under embargo, and only published later by the browser developers. Here's an article about a Chrome bug found in 2017's Pwn2Own: https://www.computerworld.com/article/3186686/web-browsers/google-patches-chrome-bug-from-fizzled-pwn2own-hack.html https://www.computerworld.com/article/3186686/web-browsers/g... and it does involve JavaScript. Could you provide some recent examples of the sort of browser exploits you mean, that don't require JavaScript? (I assume you're not including exploits in extensions/plugins like Flash or PDF viewers.)
- userbinator 8y ago
  The Firefox Pwn2Own... https://www.computerworld.com/article/3183264/security/mozilla-beats-rivals-patches-firefoxs-pwn2own-bug.html https://www.computerworld.com/article/3183264/security/mozil... ...is also JavaScript-related: https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168
- throwawaymath 8y ago
  Sure: https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224.... Also look at Google Project Zero writeups, and similar CVE details for Firefox and Safari. Some are related to JavaScript (notably, it's hard to exploit V8 if the browser isn't processing any JavaScript!). But the vast majority are memory corruption and sandbox escape issues. Disabling JavaScript insulates you from a nontrivial - but nontheless minority - subset of browser vulnerabilities.
  - dane-pgp 8y ago
    Of the first 28 vulnerabilities listed on that page (representing the past 5 years of CVEs for Chrome), I count only 7 that don't mention V8, JavaScript, PDFs, plugins, or "unspecified vectors". If someone is choosing to disable JavaScript in their browser, I think it is reasonable to expect they are also disabling plugins for other formats like Flash and PDF. We might disagree about whether to include disabling plugins as part of disabling JavaScript, or how to count the "unspecified vectors" CVEs, but the clearest minority is this 25% of vulnerabilities that a JavaScript (and plugins) disabling user would fail to insulate themselves from.
  - userbinator 8y ago
    But the vast majority are memory corruption and sandbox escape issues. ...which require JS to exploit. (What is a "sandbox escape" if there isn't code to... escape it?) I went through the 50 vulnerabilities on that page and looked at the nature of them and inspected any PoC code if any. This is the results: PDF,JS,JS,WebGL(JS),JS,CSS,JS,JS,extension,HTML(but PoC needs JS),JS,PDF,PDF,MIDI(JS),AppCache(JS),PDF,JS,UI,WebRTC(JS),JS,JS(speech recognition!?),JS,JS,JS,JS,JS,JS,JPEG(rendering uninitialised memory --- not exploitable without JS to read that data),JS(WebWorker),HTTP/SSL(!),SVG+JS,UI,JS,XML(!),SVG+JS,JS(audio),Fonts(actually Windows font renderer bug),UI,??(no details available),IndexedDB(JS),WebGL(JS),UI,JS(WebSockets),NaCl(extension),extension,PNG,WebGL(JS),?,JS,WebGL(JS) That's 32/50 confirmed to require JS to exploit, and only 3/50 stood out as being "visit a page with all plugins/JS/extensions disabled, and still get pwned", of which 1 is actually a Windows bug. Disabling JavaScript insulates you from a nontrivial - but nontheless minority - subset of browser vulnerabilities. Looks more like a majority to me.

userbinator 8y ago

JavaScript can be a delivery mechanism for a certain class of payloads That's exactly what I'm saying --- in the real world, exploits tend to be wrapped in JS even if they don't technically need it. but it's not the substantial weakness in browser vulnerabilities Then what is? My real-world experience also correlates.

throwawaymath 8y ago
> Then what is? My real-world experience also correlates. HTML (non-JS) parsing, memory corruption, image processing, filetype validation and process isolation/sandboxing.

dane-pgp 8y ago

The security bugs found during Pwn2Own are usually kept under embargo, and only published later by the browser developers. Here's an article about a Chrome bug found in 2017's Pwn2Own: https://www.computerworld.com/article/3186686/web-browsers/google-patches-chrome-bug-from-fizzled-pwn2own-hack.html https://www.computerworld.com/article/3186686/web-browsers/g... and it does involve JavaScript. Could you provide some recent examples of the sort of browser exploits you mean, that don't require JavaScript? (I assume you're not including exploits in extensions/plugins like Flash or PDF viewers.)

userbinator 8y ago
The Firefox Pwn2Own... https://www.computerworld.com/article/3183264/security/mozilla-beats-rivals-patches-firefoxs-pwn2own-bug.html https://www.computerworld.com/article/3183264/security/mozil... ...is also JavaScript-related: https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168
throwawaymath 8y ago
Sure: https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/opec-1/Google-Chrome.html https://www.cvedetails.com/vulnerability-list/vendor_id-1224.... Also look at Google Project Zero writeups, and similar CVE details for Firefox and Safari. Some are related to JavaScript (notably, it's hard to exploit V8 if the browser isn't processing any JavaScript!). But the vast majority are memory corruption and sandbox escape issues. Disabling JavaScript insulates you from a nontrivial - but nontheless minority - subset of browser vulnerabilities.
- dane-pgp 8y ago
  Of the first 28 vulnerabilities listed on that page (representing the past 5 years of CVEs for Chrome), I count only 7 that don't mention V8, JavaScript, PDFs, plugins, or "unspecified vectors". If someone is choosing to disable JavaScript in their browser, I think it is reasonable to expect they are also disabling plugins for other formats like Flash and PDF. We might disagree about whether to include disabling plugins as part of disabling JavaScript, or how to count the "unspecified vectors" CVEs, but the clearest minority is this 25% of vulnerabilities that a JavaScript (and plugins) disabling user would fail to insulate themselves from.
- userbinator 8y ago
  But the vast majority are memory corruption and sandbox escape issues. ...which require JS to exploit. (What is a "sandbox escape" if there isn't code to... escape it?) I went through the 50 vulnerabilities on that page and looked at the nature of them and inspected any PoC code if any. This is the results: PDF,JS,JS,WebGL(JS),JS,CSS,JS,JS,extension,HTML(but PoC needs JS),JS,PDF,PDF,MIDI(JS),AppCache(JS),PDF,JS,UI,WebRTC(JS),JS,JS(speech recognition!?),JS,JS,JS,JS,JS,JS,JPEG(rendering uninitialised memory --- not exploitable without JS to read that data),JS(WebWorker),HTTP/SSL(!),SVG+JS,UI,JS,XML(!),SVG+JS,JS(audio),Fonts(actually Windows font renderer bug),UI,??(no details available),IndexedDB(JS),WebGL(JS),UI,JS(WebSockets),NaCl(extension),extension,PNG,WebGL(JS),?,JS,WebGL(JS) That's 32/50 confirmed to require JS to exploit, and only 3/50 stood out as being "visit a page with all plugins/JS/extensions disabled, and still get pwned", of which 1 is actually a Windows bug. Disabling JavaScript insulates you from a nontrivial - but nontheless minority - subset of browser vulnerabilities. Looks more like a majority to me.