4 ms·
Probably they found the vulnerability through Chromium, then extended that to "everything that uses SQLite". Hard to tell anything without more details though.
by sebazzz 8y ago
Probably they found the vulnerability through Chromium, then extended that to "everything that uses SQLite". Hard to tell anything without more details though.
But if that is the case this is huge. SQLite is used in many places nowadays: Websites, browsers (Chromium and Firefox, I know of), various software including some Android apps. That also probably means the attack vector is some procedure where input is sanitized (assuming SQLite provides that, I never programmed against the C API).
- ronsor 8y agoWebKit; worse off, WebKit and Chromium expose SQLite almost directly through WebSQL! Drive-by malware!
- jakeogh 8y agoIf I understand correctly, it requires JS to be enabled (which it is usually). (Edit: wrong term, it's not "HTML5 Local Storage", it's "HTML5 Database" thanks): Chromium (EDIT: idk yet) Webkit2: https://webkitgtk.org/reference/webkit2gtk/stable/WebKitSettings.html#WebKitSettings--enable-html5-database https://webkitgtk.org/reference/webkit2gtk/stable/WebKitSett...
- ronsor 8y agoDrive-by malware used to require Flash or Java... which used to always be enabled. Edit: don't disable local storage! you'll break lots of things that way, and I don't think that includes WebSQL.